Send email notifications and show policy tips for DLP policies

You can use a Microsoft Purview Data Loss Prevention (DLP) policy to identify, monitor, and protect sensitive information across Office 365. You want people in your organization who work with this sensitive information to stay compliant with your DLP policies, but you don't want to block them unnecessarily from getting their work done. This is where email notifications and policy tips can help.

Message bar shows policy tip in Excel 2016

When you create a DLP policy, you can configure the user notifications to:

  • Send an email notification to the people you choose that describes the issue.

  • Display a policy tip for content that conflicts with the DLP policy:

    • For email in Outlook on the web and Outlook 2013 and later, the policy tip appears at the top of a message above the recipients while the message is being composed.

    • For documents in a OneDrive for Business account or SharePoint Online site, the policy tip is indicated by a warning icon that appears on the item. To view more information, you can select an item and then choose Information Information pane icon. in the upper-right corner of the page to open the details pane.

    • For Excel, PowerPoint, and Word documents that are stored on a OneDrive for Business site or SharePoint Online site that's included in the DLP policy, the policy tip appears on the Message Bar and the Backstage view (File menu > Info).

Tip

If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview compliance portal trials hub. Learn details about signing up and trial terms.

Add user notifications to a DLP policy

When you create a DLP policy, you can enable User notifications. When user notifications are enabled, Microsoft 365 sends out both email notifications and policy tips. You can customize who notification emails are sent to, the email text and the policy tip text.

  1. Go to the Microsoft Purview compliance portal.

  2. Sign in using your work or school account.

  3. In the Microsoft Purview compliance portal > left navigation > Data loss prevention > Policies > + Create policy.

  4. Choose the DLP policy template that protects the types of sensitive information you want to protect > Next.

    To start with an empty template, choose Custom > Custom policy > Next.

  5. Name the policy > Next.

  6. Assign admin units, as appropriate. > Next.

  7. To choose the locations that you want the DLP policy to protect, do one of the following:

    • Choose All locations in Office 365 > Next.

      OR

    • Choose Let me choose specific locations > Next.

    To include or exclude an entire location such as all Exchange email or all OneDrive accounts, switch the Status of that location on or off.

    To include only specific SharePoint sites or OneDrive accounts, switch the Status to on, and then click the links under Include to choose specific sites or accounts.

  8. Define your policy settings > Next.

  9. On the Info to protect screen, choose Edit.

  10. Choose the types of content to protect. > Save.

  11. Choose Next.

  12. On the Protection actions page, select the notification options you want to apply to the policy.

This screenshot displays the Protection actions User Notification setting.

  1. Choose Next.

  2. Customize the access and override settings for the policy. > Next.

  3. Select whether you want to turn the policy on right away or test it out first. > Next.

  4. Review your policy details, and edit as necessary > Submit.

Note

Notification emails are sent unprotected.

Options for configuring email notifications

For each rule in a DLP policy, you can:

  • Send the notification to the people you choose. These people can include the owner of the content, the person who last modified the content, the owner of the site where the content is stored, or a specific user.

  • Customize the text that's included in the notification by using HTML or tokens. See the section below for more information.

Note

  • Email notifications can be sent only to individual recipients, not groups or distribution lists.
  • Only new content will trigger an email notification. Editing existing content will trigger policy tips, but not email notifications.
  • External senders receive only a templatized notification without full details to prevent any unintended loss of information about the policy configuration.

Email notification options.

Default email notification

Notifications have a Subject line that begins with the action taken, such as "Notification", "Message Blocked" for email, or "Access Blocked" for documents. If the notification is about a document, the notification message body includes a link that takes you to the site where the document's stored and opens the policy tip for the document, where you can resolve any issues (see the section below about policy tips). If the notification is about a message, the notification includes as an attachment the message that matches a DLP policy.

Notification message.

By default, notifications display text similar to the following for an item on a site. The notification text is configured separately for each rule, so the text that's displayed differs depending on which rule is matched.

If the DLP policy rule does this... Then the default notification for SharePoint or OneDrive for Business documents says this... Then the default notification for Outlook messages says this...
Sends a notification but doesn't allow override This item conflicts with a policy in your organization. Your email message conflicts with a policy in your organization.
Blocks access, sends a notification, and allows override This item conflicts with a policy in your organization. If you don't resolve this conflict, access to this file might be blocked. Your email message conflicts with a policy in your organization. The message wasn't delivered to all recipients.
Blocks access and sends a notification This item conflicts with a policy in your organization. Access to this item is blocked for everyone except its owner, last modifier, and the primary site collection administrator. Your email message conflicts with a policy in your organization. The message wasn't delivered to all recipients.

Custom email notifications

You can create a custom email notification template for end user email notifications for each rule. Then send it instead of sending the default email notification. This is available for policies scoped to the Exchange, SharePoint and OneDrive locations.

User notification and policy tip configuration options that are available for Exchange, SharePoint, OneDrive, Teams Chat and Channel, and Defender for Cloud Apps

Select Preview and edit notification email to create a customized template when you edit or create a rule in a policy.

The custom email notification supports HTML and customization of these fields:

  • Sender display name: Define a custom value that suits your organization's needs. There's a 70 character limit. Setting this doesn't change the senders email address.
  • Email subject: Define a custom value to make the email subject more meaningful to your end users. There's a 256 character limit.
  • Email body: Define a custom value that has greater impact for your users. There's a 5120 character limit. You can use HTML to include images, formatting, and other branding in the notification. Custom definition for the email body supports the use of inline styling.

You can also use the following tokens to help customize the body of the email. Tokens are variables that are replaced by specific information when the notification is sent. For example, the %%ContentURL%% token is replaced by the URL of the document on the SharePoint Online site or OneDrive for Business site.

Token Description Available for Exchange Available for SharePoint Available for OneDrive for Business
%%MatchedConditions%% The conditions that were matched by the content. Use this token to inform people of possible issues with the content. Yes Yes Yes
%%ContentURL%% The URL of the document on the SharePoint Online site or OneDrive for Business site. No Yes Yes
%%AppliedActions%% The actions applied to the content. Yes Yes Yes
%%BlockedMessageInfo%% The details of the message that was blocked. Use this token to inform people of the details of the message that was blocked. Yes No No
%%ContentId%% (preview) The unique identifier of the message. Yes No No
%%TimestampForIncidentOccurrence%% (preview) Timestamp in UTC of when the DLP policy conditions were matched. Yes Yes Yes
%%MatchedConditionsAndValues%% (preview) The matched DLP condition and values. This token doesn’t cover the content contains sensitive info condition. For matched SITs and redacted values, see %%MatchedSITAndSurroundingcontext%% Yes Yes Yes
%%Filename%% (preview) For SharePoint Online and OneDrive for Business matches, this token shows the document name. For Exchange, it shows the email subject or attachment name. Yes Yes Yes
%%PolicyName%% (preview) The matched DLP policy name. Yes Yes Yes
%%PolicyRule%% (preview) The matched DLP rule name. Yes Yes Yes
%%Workload%% (preview) The workload name where the match occurred. Yes Yes Yes
%%MatchedSITAndSurroundingcontext%% (preview) The matched SITs and the redacted values. Yes Yes Yes
%%UserEmail%% (preview) The email address of the end user associated with the matched content. Yes Yes Yes
%%SiteAdmin%% (preview) For SharePoint sites, this token shows the email address of the site administrator. No Yes No

Notification message showing where tokens appear.

Options for configuring policy tips

For each rule in a DLP policy, you can configure policy tips to:

  • Simply notify the person that the content conflicts with a DLP policy, so that they can take action to resolve the conflict. You can use the default text (see the tables below) or enter custom text about your organization's specific policies.

  • Allow the person to override the DLP policy. Optionally, you can:

    • Require the person to enter a business justification for overriding the policy. This information is logged and you can view it in the DLP reports in the Reports section of the portal.

    • Allow the person to report a false positive and override the DLP policy. This information is also logged for reporting, so that you can use false positives to fine tune your rules.

Policy tip options.

For example, you may have a DLP policy applied to OneDrive for Business sites that detects personal data, and this policy has three rules:

  1. First rule: If fewer than five instances of this sensitive information are detected in a document, and the document is shared with people inside the organization, the Send a notification action displays a policy tip. For policy tips, no override options are necessary because this rule is simply notifying people and not blocking access.

  2. Second rule: If greater than five instances of this sensitive information are detected in a document, and the document is shared with people inside the organization, the Block access to content action restricts the permissions for the file, and the Send a notification action allows people to override the actions in this rule by providing a business justification. Your organization's business sometimes requires internal people to share personal data, and you don't want your DLP policy to block this work.

  3. Third rule: If greater than five instances of this sensitive information are detected in a document, and the document is shared with people outside the organization, the Block access to content action restricts the permissions for the file, and the Send a notification action doesn't allow people to override the actions in this rule because the information is shared externally. Under no circumstances should people in your organization be allowed to share personal data outside the organization.

User Override support

The option to override is per rule, and it overrides all of the actions in the rule (except sending a notification, which can't be overridden).

It's possible for content to match several rules in a DLP policy or several different DLP policies, but only the policy tip from the most restrictive, highest-priority rule is shown (including policies in Test mode). For example, a policy tip from a rule that blocks access to content will be shown over a policy tip from a rule that simply sends a notification. This prevents people from seeing a cascade of policy tips.

If the policy tips in the most restrictive rule allow people to override the rule, then overriding this rule also overrides any other rules that the content matched.

If NotifyAllowOverride action is set with WithoutJustification or WithJustification or FalsePositives, make sure BlockAccess is set to true and BlockAccessScope has appropriate value. Otherwise policy tip comes up but the user won't find an option to override the email with justification.

To see overrides in policy tips in Outlook on the web, the policy must be set to the Turn it on state. The policy action must also be configured to block with override.

Availability of Override

Notification Rule Notify/Block action Override available Require Justification
Notify only Notify No No
Notify + AllowOverride Notify No No
Notify + AllowOverride + False positive Notify No No
Notify + AllowOverride + With justification Notify No No
Notify + AllowOverride + False positive + Without justification Notify No No
Notify + AllowOverride + False positive + With justification Notify No No
Notify + Block Block No No
Notify + Block + AllowOverride Block Yes No
Notify + Block + AllowOverride + False positive Block Yes No
Notify + Block + AllowOverride + With justification Block Yes Yes
Notify + Block + AllowOverride + False positive + Without justification Block Yes No
Notify + Block + AllowOverride + False positive + With justification Block Yes Yes

Policy tips on OneDrive for Business sites and SharePoint Online sites

When a document on a OneDrive for Business site or SharePoint Online site matches a rule in a DLP policy, and that rule uses policy tips, the policy tips display special icons on the document:

  1. If the rule sends a notification about the file, the warning icon appears.

  2. If the rule blocks access to the document, the blocked icon appears.

    Policy tip icons on documents in a OneDrive account.

To take action on a document, you can select an item > choose Information Information pane icon. in the upper-right corner of the page to open the details pane > View policy tip.

The policy tip lists the issues with the content, and if the policy tips are configured with these options, you can choose Resolve, and then Override the policy tip or Report a false positive.

Information pane showing policy tip.

Policy tip with option to override.

DLP policies are synced to sites and contented is evaluated against them periodically and asynchronously, so there may be a short delay between the time you create the DLP policy and the time you begin to see policy tips. There may be a similar delay from when you resolve or override a policy tip to when the icon on the document on the site goes away.

Default text for policy tips on sites

By default, policy tips display text similar to the following for an item on a site. The notification text is configured separately for each rule, so the text that's displayed differs depending on which rule is matched.

If the DLP policy rule does this... Then the default policy tip says this...
Sends a notification but doesn't allow override This item conflicts with a policy in your organization.
Blocks access, sends a notification, and allows override This item conflicts with a policy in your organization. If you don't resolve this conflict, access to this file might be blocked.
Blocks access and sends a notification This item conflicts with a policy in your organization. Access to this item is blocked for everyone except its owner, last modifier, and the primary site collection administrator.

Custom text for policy tips on sites

You can customize the text for policy tips separately from the email notification. Unlike custom text for email notifications (see above section), custom text for policy tips doesn't accept HTML or tokens. Instead, custom text for policy tips is plain text only with a 256-character limit.

Policy tips in Outlook on the web and Outlook 2013 and later

When you compose a new email in Outlook on the web and Outlook 2013 and later, you see a policy tip if you add content that matches a rule in a DLP policy, and that rule uses policy tips. The policy tip appears at the top of the message, above the recipients, while the message is being composed.

Policy tip at the top of a message being composed.

Policy tips work whether the sensitive information appears in the message body, subject line, or even a message attachment as shown here.

Policy tip showing that an attachment conflicts with a DLP policy.

If the policy tips are configured to allow override, you can choose Show Details > Override > enter a business justification or report a false positive > Override.

Policy tip in message expanded to show Override option.

Policy tip dialog where you can override the policy tip.

When you add sensitive information to an email, there may be latency between when the sensitive information is added and when the policy tip appears. When emails are encrypted with Microsoft Purview Message Encryption and the policy used to detect them uses the detect encryption condition policy tips will not appear.

Policy tips in the Exchange admin center vs. the Microsoft Purview compliance portal

Policy tips can work either with DLP policies and mail flow rules created in the Exchange admin center, or with DLP policies created in the compliance portal, but not both. This is because these policies are stored in different locations, but policy tips can draw only from a single location.

If you've configured policy tips in the Exchange admin center, any policy tips that you configure in the compliance portal won't appear to users in Outlook on the web and Outlook 2013 and later until you turn off the tips in the Exchange admin center. This ensures that your current Exchange mail flow rules (also known as transport rules) will continue to work until you choose to switch over to the compliance portal.

Note that while policy tips can draw only from a single location, email notifications are always sent, even if you're using DLP policies in both the compliance portal and the Exchange admin center.

Default text for policy tips in email

By default, policy tips display text similar to the following for email.

If the DLP policy rule does this... Then the default policy tip says this...
Sends a notification but doesn't allow override Your email conflicts with a policy in your organization.
Blocks access, sends a notification, and allows override Your email conflicts with a policy in your organization.
Blocks access and sends a notification Your email conflicts with a policy in your organization.

Policy tips in Excel, PowerPoint, and Word

When people work with sensitive content in the desktop versions of Excel, PowerPoint, and Word, policy tips can notify them in real time that the content conflicts with a DLP policy. This requires that:

  • The Office document is stored on a OneDrive for Business site or SharePoint Online site.

  • The site is included in a DLP policy that's configured to use policy tips.

Office desktop programs automatically sync DLP policies directly from Office 365, and then scan your documents to ensure that they don't conflict with your DLP policies and display policy tips in real time.

Note

Office desktop apps scan documents themselves to determine if DLP policy tips should be shown; they do not show policy tips that SharePoint Online sites or OneDrive for Business sites have already determined should be shown on a file. As a result, you may not always see a DLP policy tip in the desktop apps that you see in the SharePoint Online sites or OneDrive for Business sites. In contrast, the Office applications on the web only show DLP policy tips that SharePoint Online sites or OneDrive for Business sites have already determined should be shown.

Depending on how you configure the policy tips in the DLP policy, people can choose to simply ignore the policy tip, override the policy with or without a business justification, or report a false positive.

Policy tips appear on the Message Bar.

Message bar shows policy tip in Excel 2016.

And policy tips also appear in the Backstage view (on the File tab).

Backstage shows policy tip in Excel 2016.

If policy tips in the DLP policy are configured with these options, you can choose Resolve to Override a policy tip or Report a false positive.

Options on policy tip in Backstage in Excel 2016.

In each of these Office desktop programs, people can choose to turn off policy tips. If turned off, policy tips that are simple notifications won't appear on the Message Bar or Backstage view (on the File tab). However, policy tips about blocking and overriding will still appear, and they'll still receive the email notification. In addition, turning off policy tips doesn't exempt the document from any DLP policies that have been applied to it.

Default text for policy tips in Excel 2016, PowerPoint 2016, and Word 2016

By default, policy tips display text similar to the following on the Message Bar and Backstage view of an open document. The notification text is configured separately for each rule, so the text that's displayed differs depending on which rule is matched.

If the DLP policy rule does this... Then the default policy tip says this...
Sends a notification but doesn't allow override This file conflicts with a policy in your organization. Go to the File menu for more information.
Blocks access, sends a notification, and allows override This file conflicts with a policy in your organization. If you don't resolve this conflict, access to this file might be blocked. Go to the File menu for more information.
Blocks access and sends a notification This file conflicts with a policy in your organization. If you don't resolve this conflict, access to this file might be blocked. Go to the File menu for more information.

Custom text for policy tips in Excel, PowerPoint, and Word

You can customize the text for policy tips separately from the email notification. Unlike custom text for email notifications (see above section), custom text for policy tips doesn't accept HTML or tokens. Instead, custom text for policy tips is plain text only with a 256-character limit.

More information