Migrate file policies to Microsoft Purview

Defender for Cloud Apps continues to provide SaaS app discovery, posture management, and threat detection. File-based data protection is moving to Microsoft Purview.

Prerequisites

Before you begin, confirm you have:

• Microsoft Purview roles: One of the following role group memberships in the Microsoft Purview compliance portal:
  • Compliance Administrator
  • Compliance Data Administrator
• Defender for Cloud Apps roles: Cloud App Security Administrator to review your existing file policies.
• A Microsoft 365 E5 or Microsoft 365 E5 Compliance license (or an equivalent standalone Microsoft Purview DLP license).

Migrate policies with the DLP to Purview migration tool

Use the DLP to Purview migration tool to move eligible file policies to Microsoft Purview without recreating them by hand. The tool reads your existing policies, groups them by migration readiness, shows you the Purview payload it plans to create, and then creates the policies in Purview for you.

Prerequisites for the migration tool

Before you begin, confirm you meet the following requirements:

• Supported environment: You're a commercial cloud customer using a Production environment. The tool isn't available for government or sovereign clouds.
• Permissions: You have Security Administrator permissions to view your Defender for Cloud Apps DLP policies, and Compliance Administrator permissions to create DLP policies in Microsoft Purview.
• Existing policies: You have one or more Defender for Cloud Apps DLP file policies that you want to migrate.
• Licensing: You have the required E5 or Information Protection and Governance (IP&G) licensing for the Purview products.
• Purview access: You can sign in to the Microsoft Purview portal with the Compliance Administrator role to review the migrated policies.
• Browser and session: You use a current, supported browser and keep your session active so migration isn't interrupted.

What the tool supports

The migration tool supports SharePoint and OneDrive DLP file policies only. The following aren't supported yet:

• Auto-labeling policy migration for Microsoft workloads.
• DLP and auto-labeling policy migration for non-Microsoft apps, including Google Workspace, Box, Dropbox, and Salesforce.

The wizard shows these unsupported scenarios in a Coming soon callout in Step 1, so you can see what's planned for future releases.

Open the migration tool

1. In the Microsoft Defender portal, go to Cloud apps > Policies > Policy management.
2. Select the All policies tab. A banner states that file policies in Defender for Cloud Apps are retired on January 6, 2027, and that you should migrate your existing policies to Microsoft Purview to maintain coverage.
3. Select Migrate on the banner. The DLP to Purview migration wizard opens and guides you through four steps.

Step 1 of 4: Select policies

1. Review your policies, which are grouped under the Can migrate, Partial migration, and Cannot migrate tabs. Each tab shows the number of policies it contains.
2. Expand a policy's Notes to see why it's in that group, such as Target apps supported in Purview DLP or Content inspection can be mapped to Purview SITs.
3. Use the checkboxes to select the policies you want to migrate. You can select more than one. Policies already marked Migrated can't be selected again.
4. Use the Search policies box to find a specific policy by name.
5. Review the Coming soon callout to see capabilities planned for future releases.
6. Confirm the count at the bottom of the pane, such as 1 policy ready to migrate, then select Next.

Step 2 of 4: Review payload

1. Review the Purview payloads that the tool creates for each selected policy. Warnings call out fields that need manual attention.
2. Check the Verdict for each policy, such as Fully migratable.
3. Select Show payload to expand the full payload, and use the copy icon to copy it for your records.
4. You don't need to enter a policy name. The tool generates the Purview policy name automatically.
5. Select Migrate to start creating the policies in Purview.

Step 3 of 4: Migration in progress

The tool creates your policies and shows a running count, such as 0 of 1 policies processed. Wait for the process to finish. This screen advances to Step 4 automatically when migration completes.

Step 4 of 4: Migration complete

1. Review the results table, which lists each policy in three columns: MDA Policy, Purview Policy, and Status. The MDA Policy column also shows the policy GUID and rule GUID for each source policy.
2. Check the status for each row. A successful row shows Created in Purview.
3. Open the Microsoft Purview DLP policies page to review the policies created in Purview.
4. Select Done to close the wizard.

Review the migrated policies in Purview

Migrated policies appear on the Data loss prevention > Policies page in the Microsoft Purview portal, with these characteristics:

• Naming: The tool names each policy [Migrated] <original policy name> (1P DLP). A source policy that targets both SharePoint and OneDrive produces two Purview policies, one for each location.
• Mode: New policies are created in Test with notifications mode, so they don't enforce actions until you turn enforcement on.
• Policy sync status: Newly created policies show Sync in progress until the policy finishes deploying.

Validate each policy in test mode before you turn on enforcement and disable the original file policy.

Frequently asked questions about the migration tool

Which environments does the tool support?

The migration tool is available for commercial cloud customers in all Production environments. Government and sovereign clouds aren't in scope at this time.

How do I open the migration tool?

Select Migrate on the retirement banner shown on the Policies page in the Microsoft Defender portal. The migration wizard opens directly from the banner.

Do I need to name the new Purview policy?

No. The tool generates the Purview policy name automatically, using the format [Migrated] <original policy name> (1P DLP).

What do "Can migrate," "Partial migration," and "Cannot migrate" mean?

Your existing policies are grouped by how completely they can be moved. Can migrate policies transfer fully, Partial migration policies transfer with some settings that might need manual review, and Cannot migrate policies aren't supported for migration.

Can I select more than one policy at a time?

Yes. Step 1 supports multi-select with checkboxes, so you can migrate several eligible policies in a single run.

Where can I see the policies after migration?

After migration completes, open the Microsoft Purview DLP policies page to review the policies that were created in Purview.

Does migrating remove my original file policies?

No. Migration creates new equivalent policies in Purview. Review your source and target policies in the Purview portal before you decommission any original policy.

What is the "Coming soon" section in Step 1?

It highlights migration capabilities planned for upcoming releases, including auto-labeling policy migration for Microsoft workloads and policy migration for Google Workspace, Box, Dropbox, and Salesforce.

Known issues with the migration tool

If an issue persists after you try the workaround, contact your support channel and include the policy names and the status shown in the Step 4 results table.

Review existing file policies

1. In the Microsoft Defender portal, go to Cloud Apps > Policies > Policy management.
2. Set the Type filter to File policy.
3. For each file policy, document the following:
   • Policy name and description
   • Target apps (for example, SharePoint, OneDrive, Box, Dropbox)
   • Content inspection method (Data Classification Service, regular expressions, or other)
   • Sensitive information types or labels that the policy detects
   • Context filters (sharing level, file type, user groups)
   • Governance actions (quarantine, remove sharing, apply label)
4. Categorize each policy by its purpose:
   • DLP detection and response: Policies that detect sensitive content and take protective action. Migrate these to Microsoft Purview DLP policies.
   • Auto-labeling: Policies that apply sensitivity labels based on content. Migrate these to Microsoft Purview auto-labeling policies.

Feature comparison

The following table compares file policy capabilities with their Microsoft Purview equivalents. Use it to confirm where protection stays the same and to plan alternatives for capabilities that don't have a direct equivalent.

File policy condition mapping

The following table maps specific Defender for Cloud Apps file policy conditions to their Purview equivalents.

Microsoft app support

Non-Microsoft app support

Microsoft Purview DLP extends to non-Microsoft connected apps, so you can detect, monitor, and protect sensitive data at rest in non-Microsoft SaaS applications. These policies use the same classification engine and policy framework as Microsoft 365 locations.

Keep the following requirements in mind when you plan this part of your migration:

• App connector required: Connect each app to Defender for Cloud Apps with an app connector before you apply a Purview DLP policy to it. Purview uses the existing Defender for Cloud Apps connectors to reach the app. For more information, see Connect apps.
• Custom policy template only: Create these policies with the Custom policy template. The predefined Financial, Medical and health, and Privacy templates don't support non-Microsoft app locations.
• Separate policies per location type: You can select several non-Microsoft apps in one policy, but you can't combine them with SharePoint, OneDrive, Exchange, Fabric, or Devices locations in the same policy.
• Advanced DLP rules only: Configure these policies with advanced DLP rules. Available conditions and actions vary by app.
• Notification limits: Policy tips and user overrides aren't supported for non-Microsoft apps.

The DLP to Purview migration tool doesn't migrate non-Microsoft app policies yet, so recreate these policies manually in Purview for now.

Migrate Defender DLP detection and response policies to Microsoft Purview DLP policies

Create equivalent DLP policies in Microsoft Purview for each file policy you categorized as "DLP detection and response."

1. Go to the Microsoft Purview portal.

2. Select Data loss prevention > Policies > Create policy.

3. Choose the policy template that best matches your file policy, or select Custom policy to define conditions manually.

4. Set the policy scope to the same locations as your file policy. For SharePoint and OneDrive, select SharePoint sites and OneDrive accounts.

5. Define content conditions that match your file policy:

   • Select the same sensitive information types in Purview.
   • If your file policy used DCS (Data Classification Service) for content inspection, Purview DLP uses the same detection engine.
   • If your file policy used regular expression patterns, recreate them as custom sensitive information types in Purview.

6. Configure protective actions that match your file policy governance actions:

   Defender for Cloud Apps governance action	Purview DLP equivalent	Equivalent support	Notes
   Notify file owner	User notifications: Notify who last modified	Equivalent
   Notify specific users	User notifications: Notify specific people	Equivalent
   Send alert	Incident reports: Send alert to admins	Equivalent
   Remove public access	Restrict access: Block everyone except owner	Equivalent
   Remove external users	Restrict access: Block people outside org	Equivalent
   Remove direct shared link	Restrict access: Remove sharing link	Equivalent
   Make private	Restrict access: Block everyone except owner	Equivalent
   Admin quarantine	File quarantine for SharePoint and OneDrive	Equivalent	Moves the file to an admin-controlled quarantine site, removes permissions and sharing links, and preserves the file for investigation
   Apply sensitivity label	Apply sensitivity label (auto-labeling policy)	Equivalent	Purview > Information Protection > Auto-labeling
   Remove sensitivity label	Auto-labeling Remove labels only policy	Equivalent	Purview > Information Protection > Auto-labeling > Remove labels
   User quarantine	File quarantine for SharePoint and OneDrive	Partial equivalent	Purview moves the file to an admin-controlled quarantine site rather than a user quarantine folder
   Trash or delete file	No direct equivalent	No equivalent	DLP restrict access and Power Automate (delete on alert)
   Remove specific collaborator	Restrict access: Block access for specific external domains or users (Preview)	Partial equivalent	Blocks access for configured external domains or users, but doesn't remove the existing sharing relationship
   Expire shared link	No direct equivalent	No equivalent	SharePoint sharing policies and Microsoft Entra Conditional Access
   Transfer file ownership	No direct equivalent	No equivalent	Manual process or Power Automate (Google Workspace specific)

7. Set up user notifications and policy tips to match your file policy's alert settings.

8. Set the policy to simulation mode to confirm it detects the same content as your file policy.

9. After confirming the results are accurate, turn the policy on.

For SharePoint and OneDrive, configure the Purview DLP file quarantine location before you use the quarantine action. When a rule triggers, Purview removes the file's permissions and sharing links, moves the file to the admin-controlled quarantine site, and leaves a notification file in the original location. For more information, see Learn about DLP file quarantine for SharePoint and OneDrive.

Migrate auto-labeling file policies to Microsoft Purview

Create auto-labeling policies in Microsoft Purview for each file policy you categorized as "Auto-labeling."

1. Go to the Microsoft Purview portal.
2. Select Information protection > Auto-labeling.
3. Select Create auto-labeling policy.
4. Choose the sensitive information types or conditions that match your file policy's content inspection rules.
5. Select the sensitivity label to apply (use the same label your file policy applied).
6. Set the scope to the same locations:
   • Select SharePoint sites and OneDrive accounts to match your file policy's target apps.
   • Add specific sites or accounts if your policy was scoped to particular groups or locations.
7. Run the policy in simulation mode to review matched files before enabling automatic labeling.
8. After confirming the results are accurate, turn on the auto-labeling policy.

Migration examples

The following examples show how common file policies map to Purview policies.

Detect externally shared files with credit card numbers

File policy: Detects files shared externally that contain credit card numbers in SharePoint and OneDrive, notifies the file owner, removes external users, and sends an alert.

Create a Purview DLP policy:

1. Set the scope to SharePoint sites and OneDrive accounts.
2. Add conditions: Content contains > Sensitive info types > Credit Card Number, and Content is shared from Microsoft 365 > with people outside my organization.
3. Add actions: Restrict access > Block only people outside your organization.
4. Set user notifications to Notify the user who last modified the content.
5. Set incident reports to send an alert to your compliance team.

Detect and label files in multiple apps

File policy: Applies a Confidential - PII label, notifies the owner, and alerts on files that contain Social Security or passport numbers in SharePoint and OneDrive.

This file policy detects and labels, so recreate it as two Purview policies:

• An auto-labeling policy that applies Confidential - PII with conditions for the Social Security and passport sensitive information types.
• A DLP policy with the same conditions that notifies the owner and sends an alert.

Roll out your Purview policies in stages

Move to enforcement in stages:

1. Run new policies in simulation mode and compare matches against your file policies.
2. Enforce for a small pilot group and confirm the actions and user experience.
3. Expand enforcement to your whole organization once the pilot is stable.

Verify your migration

After you create your Purview policies, check that your protection is complete:

1. Compare the number and scope of your new Purview policies with your file policy inventory.
2. Check that all sensitive information types and labels are included.
3. Run Purview DLP policies in simulation mode and compare results with your active file policies.

Decommission your file policies

After your Purview policies run successfully and provide equivalent protection, retire your file policies:

1. Export or take screenshots of each file policy's configuration and keep them for reference.
2. In the Microsoft Defender portal, edit each migrated file policy and set its state to Disabled. Don't delete it yet.
3. Monitor to confirm the Purview policies provide equivalent protection.
4. After validation with the file policies disabled, delete each one.

Find alerts and activity after migration

Use these locations to review policy matches and activity after migration:

Troubleshooting

Related content

• File policies in Microsoft Defender for Cloud Apps
• Learn about data loss prevention
• Learn about auto-labeling policies
• Integrate with Microsoft Purview
• Use Microsoft Purview DLP policies for non-Microsoft connected apps