Critical assets classified based on interaction with sensitive documents (Purview eDLP)
Analysis / inference: Microsoft Security Exposure Management now uses Purview eDLP sensitive document interactions to dynamically reclassify endpoint asset criticality.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Security Exposure Management - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Security Exposure Management introduces dynamic asset reclassification based on endpoints interacting with sensitive documents tracked by Purview eDLP, reverting after five days of inactivity and including out-of-the-box detection for specific credential sensitive information types.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThis feature automatically elevates endpoint asset criticality within Microsoft Security Exposure Management when devices interact with sensitive Purview eDLP documents, helping security teams focus defenses on high-value targets.
Improves pre-breach visibility by automatically tagging endpoints handling sensitive data as high criticality without manual asset tagging.
Section 03 · Recommended actions
- Review predefined classifications in Microsoft Security Exposure Management documentation.
- Monitor Microsoft Defender XDR experiences for newly elevated high-criticality assets.
- Verify whether endpoints accessing Purview eDLP sensitive information types are successfully reclassified as high criticality.
- Check Microsoft Defender XDR experiences to confirm visibility of the dynamically tagged assets.