Overview of the update
Microsoft has announced a change to how its Purview Data Loss Prevention (DLP) system interacts with web traffic. DLP is a set of tools used to ensure that sensitive information, such as financial records or personal client data, is not shared outside the business environment. Currently, these protections are primarily applied to known cloud applications documented in the Microsoft Defender Cloud App catalogue.
Starting in late 2026, administrators will be able to apply these security rules to all websites accessed via the corporate network. This is achieved through integration with Entra Global Secure Access (GSA), which is Microsoft's tool for managing how users connect to the internet and private resources.
Broadening web security
The update allows businesses to set a default security posture for the entire internet. Previously, if a staff member used a niche website or a new cloud service that Microsoft had not yet indexed, the automated data protections might not have applied.
With this change, a business can choose to apply its data protection policies to every website by default. Alternatively, they can set rules for all websites while making specific exceptions for known, trusted cloud applications. This helps prevent the accidental or intentional upload of company files to obscure file-sharing sites or unapproved web-based tools.
Implementation timeline
Microsoft intends to begin a preview of this feature in November 2026, with a full release scheduled for December 2026. This is a long-term roadmap item, and it is possible the dates may shift as development progresses.
Businesses do not need to take immediate action. However, those who handle sensitive data under UK GDPR or other regulatory frameworks may wish to note this as a future method for tightening internal controls. It will require the use of Entra Global Secure Access, which may involve additional licensing depending on the specific Microsoft 365 subscription held by the business.