How to Use PowerShell to Audit Who Changed a DLP Policy
Question details
The user needs to identify who modified or enabled a specific Data Loss Prevention (DLP) rule and when the change occurred.
- Product
- Microsoft Purview
- Device & OS
- not provided
- Scenario
- Auditing administrator actions and changes made to DLP compliance rules.
- Observed behavior
- The Microsoft Purview portal and the Get-DlpCompliancePolicy cmdlet only display the most recent DLP policy modification, obscuring previous changes and their authors.
Ensure you have the necessary administrator permissions (such as View-Only Audit Logs) in Microsoft Purview and that you are connected to the Exchange Online PowerShell module.
Use Search-UnifiedAuditLog to Audit Policy Changes
Run the Search-UnifiedAuditLog cmdlet to retrieve detailed historical records of DLP policy changes within a specific date range.
Because standard cmdlets like Get-DlpCompliancePolicy only show the latest state, the unified audit log is the best source for investigating historical changes to compliance rules.
Open your PowerShell terminal as an administrator and connect to Exchange Online using the Connect-ExchangeOnline cmdlet.
Run the Search-UnifiedAuditLog cmdlet, specifying 'Set-DlpComplianceRule' as the operation and providing your required -StartDate and -EndDate parameters.
Pipe the results of your search into the Export-Csv cmdlet to save the output to a CSV file on your local machine.
Open the exported CSV file and examine the audit records to identify the specific user, timestamp, and detailed parameters of the policy change.
Analyze Your CSV Audit Logs with WPS Office
While auditing DLP policies requires Microsoft PowerShell, reviewing the exported CSV data is much easier with a dedicated spreadsheet tool. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for all your data analysis needs.
- 1. Install WPS Office: Download and install WPS Office from the official website.
- 2. Open your audit log: Launch WPS Spreadsheet and select 'Open' to browse for the CSV file you exported from PowerShell.
- 3. Analyze the data: Use filters, freeze panes, and formatting tools in WPS Spreadsheet to easily review the user timestamps and policy changes.
Frequently Asked Questions
Why does the Purview portal only show the latest modification?
To optimize performance, standard policy views and the Get-DlpCompliancePolicy cmdlet are designed to show only the current active state and the most recent modification timestamp rather than the entire historical log.
Do I need special permissions to run Search-UnifiedAuditLog?
Yes, you must be assigned the 'View-Only Audit Logs' or 'Audit Logs' role in Microsoft Purview or Exchange Online to search the unified audit log.
How long are DLP audit logs retained in Microsoft 365?
Audit log retention depends on your Microsoft 365 subscription tier. Standard retention is typically 180 days, but organizations with premium add-on licenses can retain logs for up to one year or longer.
