Microsoft Stripped OldValue/NewValue From Dataverse Audit Events Going to Purview on May 1 — Anomaly Rules Now See Nothing

1. 1Check your current anomaly detection rules in Microsoft Purview
2. 2Identify which rules rely on OldValue/NewValue fields
3. 3Update rules to use alternative fields or modify logic to accommodate the change
4. 4Test and validate updated rules to ensure correct functionality
5. 5Review DLP correlation policies and adjust as necessary to account for the missing fields

Data engineers, security teams, and compliance officers who rely on Microsoft Purview for audit event analysis will be impacted by this change and need to adjust their workflows

💡 Microsoft's change to Dataverse audit events in Purview requires immediate attention to update anomaly detection rules and DLP correlation policies

🚨 Microsoft removed OldValue/NewValue from Dataverse audit events in Purview! 🚨 Update your anomaly detection rules and DLP correlation policies ASAP