purview EDLP

Manually relabeling every file after each policy edit is not Microsoft’s documented behavior. For an already classified file, Endpoint DLP checks for changed policies, rules, or sensitive information types when the file is read, and reevaluates policy without necessarily extracting its text again. A reused classification result should not be confused with skipping enforcement. First check the affected device in Purview > Settings > Device onboarding > Devices: both Configuration status and Policy sync status should be Updated. Reproduce the restricted activity on an unchanged supported file and compare the policy, rule, and action recorded in Activity Explorer. Recheck policy mode, scope, browser/app exclusions, and supported file-type coverage; a 10 KB condition does not establish universal file support. If only rewriting restores protection after synchronization, collect the original reproduction, policy versions, OS and Defender versions, and client diagnostics for Microsoft Support rather than modifying files in bulk.