Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint

task brazil Updated Sep 10, 2026 1 min read download-file-dlp-microsoft.md

Download files or email that violates the DLP policy on Microsoft Purview. Download this file or email on to your local machine from the DLP IR Incident view. You can download the files for DLP IR incidents of type Scan source Exchange Online, OneDrive, and SharePoint.

Before you begin

Role required:

sn_dlir.admin, sn_dlir.analyst
Any valid approver

Procedure

Navigate to All > DLP Incident Management > DLP Analyst Workspace.
Open a DLP incident record of type Scan source Exchange Online or OneDrive or SharePoint which is ingested from Microsoft source.
Click Download File.

The file or email that violated the DLP policy on the Microsoft Purview side will be downloaded to the user’s local machine.

Note: DLP admin can control the access of Download File action by disabling the Should downloading the violating file of the reported incident be allowed setting from the Advanced Settings page. For more information, see Configure advanced settings.

Parent Topic:Data Loss Prevention Incident Response with Microsoft

41 lines · 2.3 KB Wrap lines

---
title: Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
description: Download files or email that violates the DLP policy on Microsoft Purview. Download this file or email on to your local machine from the DLP IR Incident view. You can download the files for DLP IR incidents of type Scan source Exchange Online, OneDrive, and SharePoint.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/data-loss-prevention/download-file-dlp-microsoft.html
release: brazil
product: Data Loss Prevention
classification: data-loss-prevention
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Data Loss Prevention Incident Response with Microsoft, Integrate, Data Loss Prevention Incident Response, Security Operations]
---

# Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint

## Before you begin

Role required:

- sn\_dlir.admin, sn\_dlir.analyst
- Any valid approver

## Procedure

1. Navigate to **All** &gt; **DLP Incident Management** &gt; **DLP Analyst Workspace**.

2. Open a DLP incident record of type Scan source Exchange Online or OneDrive or SharePoint which is ingested from Microsoft source.

3. Click **Download File**.

The file or email that violated the DLP policy on the Microsoft Purview side will be downloaded to the user’s local machine.

**Note:** DLP admin can control the access of **Download File** action by disabling the **Should downloading the violating file of the reported incident be allowed** setting from the Advanced Settings page. For more information, see [Configure advanced settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/data-loss-prevention/configure-advanced-settings-dlp.md).

**Parent Topic:**[Data Loss Prevention Incident Response with Microsoft](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/data-loss-prevention/dlp-integration-microsoft.md)