DLP overrides, reports and justification

Shim Kwan 281 Reputation points
2022-09-20T22:11:05.577+00:00

Hi,

So with DLP comes this ability to "Report an issue" and "Override" as per screenshot.
243100-dlp1.jpg

When we click the "Report an issue" option, it simply comes back with a "Thanks, your response was recorded".

  • Does this actually generate an email to someone? where do you configure that?
  • or does this simply land up in the 'DLP false positives and overrides' Report in the Compliance Portal (where the most recent data can take up to 24 hours to appear! Wow, that's a long time to wait when someone reports an issue)
  • Is there a way to create an alert when this event happens?

When we click the 'Override' option, it allows me to write a justification for the Override.

  • Is the justification in the 'DLP false positives and overrides' Report in the Compliance Portal?
  • it seems intermittent though - sometimes the justification comments appear, sometimes they dont - this may require a support call.

Related MS article: https://learn.microsoft.com/en-us/microsoft-365/compliance/view-the-dlp-reports?redirectSourcePath=%252fen-us%252farticle%252fview-the-reports-for-data-loss-prevention-41eb4324-c513-4fa5-91c8-8fbd8aaba83b&view=o365-worldwide

Look forward to hearing from someone around this :)

Thanks,
SK

Azure Information Protection
Azure Information Protection
An Azure service that is used to control and help secure email, documents, and sensitive data that are shared outside the company.
515 questions
Microsoft Purview
Microsoft Purview
A Microsoft data governance service that helps manage and govern on-premises, multicloud, and software-as-a-service data. Previously known as Azure Purview.
920 questions
{count} votes