MC1474107 Stay informedFeature updateUser impactAdmin impact

Microsoft Purview: Archive file classification behavior change for Endpoint Data Loss Prevention on Windows endpoints

Microsoft Purview Microsoft 365 admin center

Versions captured by this deployment. Earlier versions and notices may be missing; first observed is not first published.

Ends: 7 Dec 2026
Roadmap: 570965
Platforms: Web

Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".

Microsoft's start date: 18 Sep 2026
Last changed by Microsoft: 18 Sep 2026
First seen here: 19 Oct 2026
Versions seen: 1

What the notice says

Microsoft's text, with its sections, lists and tables; source markup removed

What and why

We are updating archive file classification behavior for Microsoft Purview Endpoint Data Loss Prevention (DLP) on Windows endpoints to align with classification behavior across Microsoft cloud workloads. This change improves consistency in classification results, reduces event-reporting noise, and enhances performance when processing archive files.

This message is associated with Microsoft 365 Roadmap ID 570965.

Rollout schedule

Public Preview: Beginning in late September 2026 and expected to complete in mid-October 2026
General Availability (Worldwide): Beginning in late October 2026 and expected to complete in early November 2026

Impact on your organization

Who is affected

Organizations using Microsoft Purview Endpoint DLP on Windows endpoints with archive file classification enabled

Platforms and services

Microsoft Purview
Endpoint Data Loss Prevention (DLP)
Windows endpoints

What will happen

Archive files such as .zip and .rar files will be classified directly.
Classification of archive files will occur as a single, atomic operation.
Individual files contained within an archive will no longer generate separate classification events.
Only the outer archive file will be reported in Endpoint DLP events.
Context-based and sensitivity label-based policy evaluation will continue to apply to content within archive files.
Existing DLP policy behavior for evaluating content within archive files is unchanged.
No administrator configuration changes are required.
No user action is required.

Action required and recommendations

No action is required.

We recommend that administrators:

Review internal documentation that describes archive file classification behavior.
Update operational and monitoring procedures if they reference individual event generation for files contained within archives.
Inform compliance and security teams that Endpoint DLP reporting will show events for the outer archive file instead of individual files within the archive.

Compliance considerations

Question	Answer
Does the change alter how existing customer data is processed, stored, or accessed?	Archive files will be classified as a single atomic object and reported as the outer archive file rather than generating separate events for files within the archive.
Does the change alter how admins can monitor, report on, or demonstrate compliance activities?	Yes. Administrators will see reporting and event-generation changes. Individual files inside archives will no longer generate separate events, and reporting will be associated with the outer archive file.

570965

What changed

Between the versions this installation saw, newest first

This installation has seen one version of this notice, first on 19 Oct 2026. Later changes will show here.

Linked documentation

Microsoft pages the notice links to

The notice links to no Microsoft Learn or Support page that this installation reads.

Not confirmed here

What this page cannot tell you

Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
Versions before 19 Oct 2026: this installation first saw the notice after Microsoft posted it.