Data Lineage connects file activity into a graph. Some connections are certain, because the same file was tracked directly from one place to another. Others are inferred, because two files look like the same content in two different places and no single event ties them together. Lineage Mode controls how much inference Data Lineage is allowed to do. It is a tenant-level setting and applies to every graph in your tenant.
From any lineage graph, open Data Lineage Settings and select the Lineage Mode tab. Changes take effect when you click Save.
Choosing a Mode
Choose how much Data Lineage infers when it can’t find a direct connection between files. You can show only confirmed activity, or include likely connections when an intermediate event is missing.
-
Strict: Shows a connection only when an event directly links the files. Data Lineage draws a connection when it can prove the same file moved. This produces the most accurate graph that can be leveraged for incident investigation. This is the default Data Lineage mode.
-
Balanced: Connects files with identical content that appear in a different app within a time window. The common case is a file downloaded from one cloud application and uploaded to another a few minutes later through potentially unlicensed channels or esoteric activities.
-
Discovery: Connects files with identical content across any time gap, and files that share a name. Name matching ignores extension differences and copy suffixes such as (1). This surfaces the most connections and will sometimes link files that may not be actually related.
How Inferred Connections Appear in the Graph
Inferred connections render as dotted lines, so you can always tell them apart from confirmed activity. Hovering a dotted connection tells you which rule produced it. Everything downstream of an inferred connection is drawn with solid lines, because those activities are by themselves confirmed. Confirmed activity chains are never affected. Raising or lowering the mode never removes a connection that Data Lineage observed directly.
Lineage Mode applies to new lineage queries. Existing lineage is preserved exactly. Because the mode is applied when a graph is drawn rather than when activity is recorded, changing it reshapes every graph in your tenant, including graphs of past activity, the next time you open one. Inferred connections are capped per graph. Once the limit is reached, Data Lineage stops adding them and does not offer a “show more” control.
Excluded Files
Files matching a hash below are never tracked by Data Lineage, in any mode. Use this for installers, templates, or test files you don’t want in lineage. Enter one MD5 hash per line, up to 1,000 per tenant. The counter below the list shows how many are in use at the moment.
Unlike Lineage Mode, excluded files apply to new activity only. Files already recorded stay visible in existing graphs, and removing a hash does not retroactively pull in activity that was skipped while it was listed.