Published: 18 August 2026. Microsoft has confirmed via Message Center notification MC1417993 that file policies in Microsoft Defender for Cloud Apps will stop being enforced on January 6, 2027. Here is what the change covers and what SharePoint admins need to do before the deadline.
Source: Migrate file policies to Microsoft Purview - Microsoft Learn | Message Center ID: MC1417993
| Detail | What It Means |
|---|---|
| Announcement | MC1417993 - File policies in Microsoft Defender for Cloud Apps are retiring |
| Retirement date | January 6, 2027. Policies not migrated by that date stop being enforced with no warning. |
| Platforms affected | SharePoint Online, OneDrive for Business, and non-Microsoft SaaS apps connected via Defender (including Box, Google Drive, and others) |
| Migration target | Microsoft Purview DLP policies or auto-labeling policies, which now support the same file scanning capabilities |
| What stays in Defender | App discovery, cloud app posture management, threat detection, and session/access controls remain in Defender for Cloud Apps. Only file policies are retiring. |
What Is Changing for SharePoint Admins
Organizations that use Microsoft Defender for Cloud Apps to scan files stored in SharePoint Online or OneDrive for Business currently rely on Defender file policies to detect sensitive content, apply labels, or block specific file types. From January 6, 2027, those file policies will no longer run or generate alerts.
This affects tenants that have explicitly configured file policies in the Defender for Cloud Apps portal to scan Microsoft 365 content. Purview DLP policies you have already configured in the compliance portal are not in scope - if that is where your SharePoint DLP runs, nothing changes. Not sure if you have Defender file policies? Check the Policies page under Cloud Apps in the Defender portal before working through the steps below.
The retirement also covers file policies that scan content in non-Microsoft SaaS apps connected through Defender. If your organization uses Defender to monitor Box or Google Drive through a connector, those scanning policies are in scope as well.
For context on how Microsoft Purview DLP now applies to SharePoint, see the alerts on SharePoint file DLP quarantine reaching general availability and Purview DLP blocking external access to SharePoint files. These two announcements show how Purview has expanded to cover the same scenarios that Defender file policies previously handled.
How to Migrate File Policies to Purview Before January 2027
Microsoft provides a migration guide that walks through recreating Defender file policies as Purview DLP policies. The key steps for SharePoint admins are:
- Audit your existing file policies. Log in to the Microsoft Defender for Cloud Apps portal (security.microsoft.com, then Cloud Apps) and review every file policy currently active. Export the list with the policy name, conditions, and actions. This becomes your migration checklist.
- Identify the Purview equivalent. Most Defender file policy conditions (sensitive information types, file extensions, content matches) have direct counterparts in Purview DLP. Auto-labeling policies in Purview cover scenarios where Defender was applying sensitivity labels. Work through the checklist to map each Defender policy to the right Purview policy type.
- Create replacement policies in Purview. Build the equivalent policies in the Microsoft Purview compliance portal (compliance.microsoft.com). Target SharePoint Online and OneDrive for Business as the workloads. Test each policy in simulation mode before enabling enforcement to confirm it captures what the original Defender policy was designed to detect.
- Verify coverage, then remove the Defender policies. Run both the old Defender policy and the new Purview policy in parallel for at least a week to confirm they flag the same files. Once you have confirmed the Purview policy is working correctly, turn off the Defender file policy and document the change for your audit trail.
- Complete all migrations before January 6, 2027. Policies that are not migrated by the deadline will stop enforcing on that date. There is no grace period and no phased rollout; the cutoff is a hard date.