File and folder filters removed from session and activity policies

[What and Why:]

As part of the retirement of Microsoft Defender for Cloud Apps file policies on January 6, 2027, Microsoft is removing file and folder filters from session policies and activity policies. File-based data protection is moving to Microsoft Purview, consolidating data loss prevention controls into Microsoft's enterprise compliance and data protection platform.

[Rollout Schedule:]

Global: We will begin rolling out in early November 2026 and expect to complete by early January 2027.

[Impact on Your Organization:]

Who is affected: Your organization is affected if you have one or more Defender for Cloud Apps session policies or activity policies that use file or folder filters.

Platforms/Services: Microsoft Defender for Cloud Apps and Microsoft Purview Data Loss Prevention.

What will happen:

• File and folder filters will be removed from the session policy and activity policy rule builders and can no longer be added or edited.
• Existing policies that contain these filters will remain visible, but their file and folder conditions will no longer be evaluated.
• File and folder information will no longer be stored or displayed in these policies.
• Existing alerts and events previously generated by these policies will not be deleted.
• If you rely on file-based data loss prevention, evaluate moving the applicable protection to Microsoft Purview DLP.
• Some file policy conditions don't have an exact equivalent in Microsoft Purview. Review your policy configuration and migration guidance before making changes.

[Action Required/Recommendations:]

Action is required if your session or activity policies depend on file or folder filters.

• Review your policies in the Microsoft Defender portal under Cloud Apps > Policies > Policy management.
• Identify session and activity policies that use file or folder filters.
• Update or disable policies that depend on these filters before the rollout completes.
• If you require file-based data loss prevention, evaluate and migrate the applicable protection to Microsoft Purview DLP or auto-labeling.
• Validate replacement policies before enabling enforcement and decommissioning the applicable Defender for Cloud Apps policies.
• Learn more: Migrate file policies to Microsoft Purview - Microsoft Defender for Cloud Apps | Microsoft Learn.

[Compliance considerations:]

• This change affects DLP policy functionality because affected file and folder conditions will no longer be evaluated.
• File and folder information will no longer be stored or displayed in the affected policies.
• Organizations using affected controls should evaluate corresponding Microsoft Purview DLP or auto-labeling policies and validate replacement protection before decommissioning existing policies.