Is it possible to set up email notification to admins if a user chooses to override a DLP policy?

Question

We have set up a DLP policy in Microsoft Purview that screens for SSNs in Exchange, as well as other locations. We're still sort of testing it out before rolling it out to the entire organization.

Is the following functionality possible? It's been requested that when a user receives the policy tip in their Outlook message that says "To send this message without removing the information, you must first click override" and they choose to click override and proceed to override the block, is there a way to have an email notification sent to select accounts (our security admins)?

As it functions now, we only see the justification in the alerts list and it is difficult to locate. It would be very helpful to be notified via email instead.

Answer 1

Hello Callie Hagedorn

Good day and thanks for reaching out

By default, DLP policies send alerts based on the conditions defined in the policy, but they may not differentiate actions like "User override" in a way that allows for targeted notifications. Please keep in mind as of now, there is no built-in feature that sends a separate email specifically focused on user overrides that includes the business justification directly in the notification.

Hope this helps. Please feel free to reach out if you need further assistance with the issue.

Sincerely,

Bertrand

Answer 2

Thank you for the feedback. The steps you sent allows me to set up email alerts if the DLP policy is matched and triggered, but it doesn't send an email for the specific action of the user clicking Override and then sending the email with the SIT.

What we get right now is an email alert that says "DLP policy matched for email with subject 'Test'. In the email body the Policy Details are listed, and this does include User override policy (Yes or No). However, it does not include the business justification.

What we're looking for is an email that is specifically focused on User override. So, if the value of User override policy is No, then no email is triggered. If the value is Yes, then an email with a subject like "Confirmed User override of DLP policy" is sent to admins, and it includes the business justification of the user override either in the body of the email or there is a link to that information.

Is that possible? We don't see anything out of the box, and we couldn't make it work using Power Automate or PowerShell, either.

Answer 3

Hello Callie Hagedorn

Good day and thanks for posting in Microsoft community.

From the description, it appears you want to set up email notification to admins if a user chooses to override a DLP policy. It is possible to set up email notifications to security admins when a user overrides a Data Loss Prevention (DLP) policy in Microsoft Purview, particularly when policy tips are configured to allow overrides. Send email notifications and show policy tips for DLP policies | Microsoft Learn

However, you will have to ensure that your DLP policy is configured to show policy tips allowing users to override. When a user is prompted with the policy tip in Outlook, they will have the option to click "override" and enter a business justification.

You can create alert policies that trigger email notifications to specific accounts when an override occurs. This involves configuring the alert settings within the Microsoft Purview interface. Here, you can specify the conditions for which alerts should be sent, including overrides of DLP policies.

• Navigate to the Microsoft Purview compliance portal.
• Go to Solutions > Data loss prevention.
• Configure your existing DLP policy to include the override option.
• Create an alert policy under Alerts > Manage alert policies.
• Specify conditions related to DLP policy overrides and designate the security admins' email addresses as recipients for notifications.

Hope this helps! Please feel free to repost if you need further assistance with the issue. We will be happy to help!

Sincerely,

Bertrand