Microsoft Purview DLP: Extending Data Security to Google Workspace, Box, Salesforce, and More

REPORT: Purview DLP and Auto-Labeling Expand to Non-Microsoft Apps

Microsoft Purview Data Loss Prevention (DLP) and Information Protection’s auto-labeling capabilities are being extended to a suite of non-Microsoft connected applications, including Google Workspace, Box, Dropbox, Salesforce, ServiceNow, AWS, and Cisco Webex. This major update—Roadmap ID 568075—enters public preview in July 2026 and will reach general availability (GA) in September 2026. The update aligns Microsoft’s data protection strategy with the modern enterprise reality: business data flows through multiple cloud providers, not just Microsoft 365.

This expansion means that, for the first time, DLP policies and auto-labeling can be automatically enforced on content stored in third-party platforms—without manual workarounds or relying solely on the partner ecosystem’s own security controls. Microsoft is rolling out these capabilities via the Purview compliance portal, with granular management for each supported app. The configuration path is: Microsoft Purview portal > Data loss prevention > Policy.

WHAT’S NEW THIS CYCLE

• Feature: Purview DLP and Information Protection auto-labeling for connected third-party apps.
• Status: Public Preview in July 2026, GA September 2026.
• Admin Center Path: Microsoft Purview portal > Data loss prevention > Policy > Create Policy > Locations (now includes non-Microsoft connectors).
• PowerShell/API: New support is rolling out via the Microsoft.Graph.InformationProtection module; policy management is unified under the New-MgInformationProtectionPolicy and Set-MgInformationProtectionPolicy cmdlets for all supported locations.
• Connector onboarding: Admins must first configure each non-Microsoft platform as a connected app in Microsoft Entra admin center > Applications > Enterprise applications.

IMPACT: Who and What is Affected

Organizations using a hybrid SaaS stack—where sensitive data is stored and shared across platforms like Google Drive, Box, Salesforce, or Dropbox—are directly affected. Previously, Microsoft DLP and auto-labeling only protected Microsoft 365 workloads (SharePoint, Exchange, Teams, OneDrive). Sensitive information residing in or transiting through external platforms was a blind spot, increasing the risk of data leaks, compliance breaches, or inconsistent governance.

Example scenarios now in scope:

• A user downloads a sensitive Excel file from SharePoint, uploads it to a Google Drive folder, and shares it externally—DLP can now detect and auto-label that document in Google Drive, even if the user never returns it to Microsoft 365.
• Customer data uploaded to Box by a field agent is automatically classified and, if policy dictates, sharing can be blocked in real time.
• Salesforce records containing credit card numbers are auto-labeled and, if required, protected with encryption—without relying on Salesforce’s own (often separate) DLP controls.

EDUCATE: How Purview DLP Extends to Connected Apps

Purview DLP works by inspecting content for sensitive information types, pattern matches, or custom conditions. With this update, Purview ingests file and record metadata, performs content scans (where API permissions allow), and enforces labeling/protection natively inside the third-party app. Each connector’s capabilities are determined by the APIs exposed by the partner; for example, Google Workspace and Box allow deep file inspection, while some apps (like Salesforce) may restrict DLP to certain object types or fields.

Administrators configure DLP policies as before, but now select additional locations for enforcement. The underlying enforcement engine remains Microsoft’s Unified DLP, but with added connectors and new policy targeting logic. Note: initial rollout supports a subset of conditions and actions per app—review the documentation for supported scenarios per connector.

DETECT: Reporting on DLP Coverage Across Connected Apps

To assess your current policy coverage and identify gaps—including which connectors are active and which policies target them—use PowerShell with the Microsoft Graph module. The following script enumerates all DLP policies, their enforcement status, and which locations (including connected apps) they cover. This script supports pagination and includes error handling for large tenants.

Import-Module Microsoft.Graph.InformationProtection
Connect-MgGraph -Scopes 'InformationProtectionPolicy.Read.All'

try {
    $policies = @()
    $page = 1
    $response = Invoke-MgGraphRequest -Method GET -Uri 'https://graph.microsoft.com/beta/informationProtection/policies?\$expand=appliesTo' -ErrorAction Stop
    $policies += $response.value
    while ($null -ne $response.'@odata.nextLink') {
        $page++
        $response = Invoke-MgGraphRequest -Method GET -Uri $response.'@odata.nextLink' -ErrorAction Stop
        $policies += $response.value
    }
    foreach ($policy in $policies) {
        Write-Output ("Policy: {0}\nStatus: {1}\nLocations: {2}\n" -f $policy.displayName, $policy.status, ($policy.appliesTo -join ", "))
    }
} catch {
    Write-Error "Failed to enumerate DLP policies: $_"
}

Notes: This script uses the beta endpoint as of June 2024; endpoint paths may change at GA. For production automation, always monitor for schema changes and review the policy location types to distinguish Microsoft-native vs. connected apps.

REMEDIATE SAFELY: Enabling DLP on Connected Apps (Dry-Run Approach)

To extend an existing DLP policy to a new connected app, always perform a dry-run. First, enumerate current policies and locations as above. Next, create or update a policy using the -WhatIf flag to preview changes:

# Example: Add Google Drive as a location to an existing policy (dry run)
$policyId = ''
$googleDriveLocation = 'googleDrive'

Set-MgInformationProtectionPolicy -InformationProtectionPolicyId $policyId -LocationsToAdd $googleDriveLocation -WhatIf

Important: The -WhatIf parameter ensures no live change is made. Always review intended changes, validate with stakeholders, and test on pilot user groups before production rollout. Never bulk-modify policies or enable new locations without explicit review and change control.

PORTAL EQUIVALENT: Where to Configure in Purview and Entra

• Microsoft Purview portal: Data loss prevention > Policy > Create or Edit Policy. The policy location picker now lists connected apps alongside Exchange, SharePoint, and Teams.
• Microsoft Entra admin center: Applications > Enterprise applications. Each third-party app must be onboarded as a connector with correct permissions before it appears in Purview’s policy scope.
• Activity Explorer: Use the Microsoft Purview portal > Data loss prevention > Activity explorer to monitor DLP matches, incidents, and auto-label actions across all connected locations.

THE UPGRADE: Tangible Benefits Over Previous Approaches

• Unified Governance: Centralize DLP and labeling—no more fragmented policies across multiple security portals.
• Reduced Risk: Close compliance and data leakage gaps as users move data between platforms outside Microsoft 365.
• Operational Efficiency: Admins can audit, enforce, and report on data security posture across all SaaS locations from a single pane of glass.
• Cost Control: Avoid duplicate spend on third-party DLP tools or siloed platform-specific policies.

WHAT’S COMING IN THE NEXT 90 DAYS

• Purview Insider Risk Management (IRM) integration for connected apps—enabling policy triggers based on risky behavior in Box, Google Workspace, and Salesforce (Preview expected August 2026).
• Auto-labeling enhancements with AI-driven contextual awareness across all supported apps, announced at Ignite 2026, rolling out in October 2026.
• Expanded coverage: New connectors for Atlassian Confluence and Slack are in private preview; expect public roadmap confirmation by end of Q4 2026.
• Microsoft Graph API updates: New endpoints to automate onboarding of connected apps and manage bulk policy assignments programmatically.

RECOMMENDATION

Immediate priorities: Review your organization’s SaaS landscape, audit current DLP policy scope using the PowerShell above, and identify unprotected third-party data stores. Pilot the new DLP connectors with strict change control and stakeholder buy-in. Plan for rapid adoption as GA approaches to close critical compliance gaps.