Published: July 2026. Source: Microsoft 365 Message Center MC1338823 / Microsoft Learn: Purview DLP for SharePoint and OneDrive
SharePoint admins get a scalpel instead of a sledgehammer this month. Microsoft has begun a worldwide rollout, starting mid-July 2026 and expected to finish by the end of the month, of a new Microsoft Purview Data Loss Prevention action that blocks external access to sensitive SharePoint Online and OneDrive for Business content by a specific partner domain or an individual guest email address.
What changes under MC1338823
Until now, DLP policies targeting external sharing in SharePoint largely worked at the level of the whole tenant's sharing settings, or by quarantining an individual file after a violation. The new action sits in between those two extremes. A compliance administrator builds a DLP rule that matches content classified as sensitive, then attaches a block condition scoped to a named domain (contoso-partner.com, for example) or a specific external mailbox.
The setting is not enabled automatically, so tenants will see no change until an administrator adds it to a Purview DLP rule.
That single sentence in Microsoft's own guidance matters more than it looks. Nothing changes in your tenant on rollout day unless someone in your compliance team deliberately configures the rule. External sharing that already works today keeps working until the action is added.
Why this pairs with permission and shared-link audits
A domain-level block is only as good as the list of domains and guest addresses it targets, and most tenants don't have that list ready. Building it means knowing which external domains actually hold live SharePoint access today, not which ones were invited two years ago and never followed up.
| Before configuring the block | What it requires |
|---|---|
| Know every external domain with current access | A tenant-wide external user export, not a per-site check |
| Distinguish active partners from stale guests | Last sign-in and last-activity data per guest account |
| Avoid blocking a domain still in active use | Cross-reference against current projects before the rule ships |
ShareMaster's Report Master generates that tenant-wide external user export in one pass, and the Shared Links & Permissions tool surfaces every shared link and unique permission grant tied to a given domain or address, so the compliance team isn't guessing at what a new block rule will actually affect.
What to do before your Purview admin flips the switch
Three things are worth doing ahead of any DLP block rule targeting external domains. First, pull a full list of external domains and guest accounts with live SharePoint access, not a spot check of one or two sites. Second, flag any domain still tied to an active engagement so nobody blocks a live partner by accident. Third, revoke the shared links and permissions for domains that are clearly stale before the block rule goes in, so the rule is enforcing a decision your team already made rather than making it for you.
Frequently Asked Questions
What is MC1338823?
MC1338823 is a Microsoft 365 message centre post describing a new Purview DLP action that blocks external access to sensitive SharePoint Online and OneDrive content by specific domain or individual email address.
Will this action turn on automatically in my tenant?
No. It must be added deliberately to a DLP policy by a Purview compliance administrator. Existing external sharing is unaffected until that happens.
How is this different from the File Quarantine DLP action?
File Quarantine isolates one violating file. The domain or user block instead closes off an external identity, a partner domain or a guest address, while leaving the file itself untouched.
Sources: Microsoft 365 Message Center MC1338823 (merill.net archive); Microsoft Learn: DLP for SharePoint and OneDrive.