Forum Discussion
Alert on DLP Policy Change
Is it possible to configure an alert from Purview when a DLP policy is created, amended or removed?
I am trying to build a process to satisfy NIST CM-6(2): Respond to Unauthorized Changes that identifies when a policy chnage happens and to cross reference to an authorised change record.
I can find the events Updated, Created or Changed a DLP Poloicy in audit search but can Purview be configured to generate an alert when these events happen?
1 Reply
Purview does not natively open such functionality, so you have to either integrate with Sentinel or similar solutions, or create your own based on the Graph API/PowerShell. Here's a sample article from Tony that explores a similar scenario: https://office365itpros.com/2025/01/28/azure-automation-for-audit-searches/
