Services
Affected Platforms
Summary
Microsoft Purview is introducing always-on diagnostics for Endpoint Data Loss Prevention on Windows devices, starting in June 2025. This feature collects persistent diagnostic data, simplifying issue investigation. Logs are retained for up to 90 days. The rollout requires no admin action and enhances support ticket submissions.
Details
Coming soon for Microsoft Purview Data Loss Prevention (DLP): Always-on diagnostics for Endpoint DLP on Windows devices (Phase 1).
This feature enables automatic, persistent diagnostic data collection from onboarded Windows endpoint devices. It simplifies issue investigation by capturing comprehensive trace logs locally—eliminating the need to reproduce issues when submitting support tickets to Microsoft. Logs can be retained for up to 90 days, enabling deeper analysis of transient or hard-to-reproduce issues.
This message is associated with Microsoft 365 Roadmap ID 495683.
When this will happen:
Public Preview: We began rolling out early June 2025 and expect to complete by mid-June 2025.
General Availability (Worldwide): We will begin rolling out mid-September 2025 and expect to complete by late September 2025.
How this will affect your organization:
After this rollout:
- Enhanced diagnostics are available automatically on supported Windows devices with Endpoint DLP enabled.
- Users can submit support tickets with complete logs on the first attempt—no need for repeated log collection.
- Reduces the burden of reproducing issues, especially for transient events.
- No admin permissions are required for information workers (IWs) to run the retrieval tool.
What you need to do to prepare:
This rollout will happen automatically by the specified dates with no admin action required before the rollout. Review your current configuration to assess the impact on your organization. You may want to notify your admins and/or users about this change and update internal documentation.
Learn more: Always-on diagnostics for endpoint DLP | Microsoft Learn