Purview Endpoint DLP OCR Expansion Paused for Embedded Images

Microsoft has paused the rollout of expanded Optical Character Recognition support for Microsoft Purview Endpoint Data Loss Prevention, despite the corresponding Microsoft 365 Roadmap entry carrying a “Launched” status.
Roadmap item 381750, updated July 13, says the feature is intended to let Endpoint DLP inspect text inside images embedded in Office documents, archive containers, and hybrid PDFs. Microsoft added a status note dated May 20, 2026 stating that rollout is paused and will resume “soon.”

What the feature adds​

Purview Endpoint DLP OCR currently covers standalone image formats including JPEG, PNG, BMP, TIFF, and image-only PDFs. The planned extension would scan images placed inside:

• Office files: .docx, .xlsx, and .pptx
• Archive and container files, including .zip, .rar, and .7z
• Hybrid PDFs containing both searchable text and images

That matters because sensitive material is routinely embedded as screenshots, scanned forms, photographs of documents, or exported report pages rather than entered as selectable text. Without embedded-image OCR, a DLP rule looking for credit-card numbers, government IDs, health data, or other sensitive information can miss content that is visible to a user but unavailable to ordinary text inspection.

Why the status needs reading carefully​

The roadmap metadata lists general availability in June 2026 and preview availability in April 2026 for worldwide standard multi-tenant tenants. But Microsoft’s own release note overrides the apparent completion signal: the rollout is paused.
For admins, that means this should not yet be treated as a universally available Endpoint DLP capability. Tenants may see uneven availability, and policy testing should distinguish between image-only PDFs or standalone images—which are already covered—and embedded images within Office files, archives, and hybrid PDFs, which are the delayed portion.
Microsoft Learn documentation for Purview OCR notes that endpoint OCR sends images to Microsoft’s cloud for scanning when enabled. Endpoint OCR also has a per-device daily bandwidth allowance, with a default of 1,024 MB, and excluded Endpoint DLP paths are not scanned. OCR requires Syntex pay-as-you-go billing to be configured at the tenant level, even though admins do not need to deploy Syntex itself.

What admins should do​

Organizations already using Endpoint DLP should verify their existing OCR configuration, bandwidth limits, network allow-listing, and exclusions, but should not redesign controls around embedded-image inspection until Microsoft resumes the rollout. Test files should include screenshots embedded in Word, Excel, PowerPoint, ZIP archives, and hybrid PDFs once the feature begins appearing in the tenant.
Microsoft has not published a revised rollout date, so the next practical step is to monitor Roadmap ID 381750 and Message Center notices for resumption details.

---

References​

1. Primary source: Microsoft 365 Roadmap
   Published: 2026-07-13T23:07:14.8221961Z
   
   

   Microsoft 365 Roadmap | Microsoft 365

   The Microsoft 365 Roadmap lists updates that are currently planned for applicable subscribers. Check here for more information on the status of new features and updates.

   www.microsoft.com
2. Official source: learn.microsoft.com
   
   

   Learn about optical character recognition in Microsoft Purview | Microsoft Learn

   Learn how optical character recognition (OCR) in Microsoft Purview scans images for sensitive information across Exchange, SharePoint, OneDrive, Teams, and devices.

   learn.microsoft.com