Hi Has anyone noticed or aware of a backend change, that has altered the behaviour of 365 Defender behaviour towards DLP policy breaches? We use DLP and whilst alerts will trigger, only rarely was it triggered all the way through to Sentinel. Now we've got Sentinel going bananas over incidents which it didn't seem to care about before. I figure either "someone" has altered a setting or there's an infrastructure change. There were changes in the interface last week as we had "Take a tour, see what's new" dialogue. Obvs, I've asked the right people internally if anyone has made any changes (which resulted in a resounding "NO!".
Somethings' changed somewhere....
