Using Purview DLP external email, U.S. Physical Address, need to ignore corporate address in email signature

Question

Using Purview DLP external email, U.S. Physical Address, need to ignore corporate address in email signature

Jeff Streelman 40

Our company is using Microsoft Purview DLP for external email detection. When I add a rule for U.S. Physical Address (any confidence, but prefer Med or High), how do I add an exclusion for the companies address which is found in everyone's email signature?

Example:
(email body)
John Smith
Company Z
**123 Main Street, Anywhere, FL, 12345

** User's image

Jeff Streelman 40 Reputation points

2026-07-30T15:41:52.53+00:00

Note that Claude references the following . . . but there is no way to add exceptions through the UI. I hope you don't have to use JSON (that would be a pain to maintain).

*Once you're in the rule editor, scroll to the Conditions section where you'll see your existing "Content contains > Sensitive info types > U.S. Physical Address" condition already listed. Below that, you want to add a second condition, and this is the key part: instead of adding it as another "Content contains" line under the same group, click "Add condition" and choose "Content doesn't contain" (if the rule editor doesn't show an inverse option directly, you can add "Content contains" and there should be a way to negate it with an "Except if" toggle — the modern rule builder shows this as a dropdown letting you pick between the standard condition group and an "Except if" group at the bottom of the conditions list, so use the "Add exception" or "Except if" button rather than "Add condition").

Under that except-if / doesn't-contain condition, select "Content contains > Keywords" (not Sensitive info types) and enter the address string as a keyword phrase: 2680 Horizon Dr. SE, Grand Rapids, MI 49546. You can add it as one single keyword entry containing the whole phrase with spaces and punctuation, since Purview's keyword condition matches on exact phrase text including spacing (it doesn't require wildcards for a fixed multi-word string).*

2 answers

Your answer

Jeff Streelman 40 Reputation points

2026-07-30T15:41:52.53+00:00

Note that Claude references the following . . . but there is no way to add exceptions through the UI. I hope you don't have to use JSON (that would be a pain to maintain).

*Once you're in the rule editor, scroll to the Conditions section where you'll see your existing "Content contains > Sensitive info types > U.S. Physical Address" condition already listed. Below that, you want to add a second condition, and this is the key part: instead of adding it as another "Content contains" line under the same group, click "Add condition" and choose "Content doesn't contain" (if the rule editor doesn't show an inverse option directly, you can add "Content contains" and there should be a way to negate it with an "Except if" toggle — the modern rule builder shows this as a dropdown letting you pick between the standard condition group and an "Except if" group at the bottom of the conditions list, so use the "Add exception" or "Except if" button rather than "Add condition").

Under that except-if / doesn't-contain condition, select "Content contains > Keywords" (not Sensitive info types) and enter the address string as a keyword phrase: 2680 Horizon Dr. SE, Grand Rapids, MI 49546. You can add it as one single keyword entry containing the whole phrase with spaces and punctuation, since Purview's keyword condition matches on exact phrase text including spacing (it doesn't require wildcards for a fixed multi-word string).*

Answer 1

Hi @Jeff Streelman , Hope you are doing well.

You're right — and your pushback identifies exactly why the simple NOT group doesn't fit your rule.

Why it doesn't work in your case

NOT groups in Purview DLP are joined at the rule level. They can't be scoped to a single SIT inside a group. So adding a fourth group to your PHI rule gives you:

(SSN or Tax ID or DEA) AND (US Physical Address or DOB)
AND shared externally
AND NOT subject contains "secure"
AND NOT body contains "123 Main Street, Anywhere, FL 12345"

Because your corporate address is in every signature, that last group would evaluate true on nearly all outbound mail — suppressing the entire rule, including your SSN and DEA detection. That's a much worse outcome than the false positives you're trying to fix. So this isn't just awkward; it's actively unsafe here.

Option 1 — Split into two rules (try this first)

A DLP policy can hold multiple rules, and NOT groups are safe when the rule they suppress is narrow enough:

Rule A — high-confidence identifiers. (SSN or Tax ID or DEA) AND shared externally AND NOT subject contains "secure". No address exclusion; nothing to break.
Rule B — address/DOB only. (US Physical Address or DOB) AND shared externally AND NOT subject contains "secure" AND NOT (Subject or body contains "123 Main Street, Anywhere, FL 12345").

Now the corporate-address exclusion only suppresses the rule where a signature match is genuinely a false positive. Set each rule's actions and priority independently.

Option 2 — Custom SIT (the robust fix)

If splitting doesn't work for your policy design, build a custom sensitive information type for U.S. addresses that excludes your corporate address, and use that in place of the built-in SIT. This binds the exclusion to the classifier itself rather than the rule, which is what you actually want. Vasil's linked TechCommunity thread walks through the pattern.

On the JSON concern

You don't need JSON. Both options are fully configurable in the Purview UI — and if you'd rather script or version-control them, Security & Compliance PowerShell exposes the same exceptions as named parameters, e.g. New-DlpComplianceRule -ExceptIfSubjectOrBodyContainsWords. That's PowerShell, not hand-edited JSON.

Practical tips either way

Match on a short, distinctive fragment of the signature (e.g. "123 Main Street") rather than the full formatted string — punctuation, line breaks, and HTML rendering vary and will break exact-phrase matches.
If you have multiple office locations, add each as a separate phrase.
Run the rule in Test mode with policy tips first and check Activity Explorer before enforcing, so you can see the real match rate before it affects users.

References

Try the two-rule split first — it's the lowest-effort path and stays entirely in the UI.

Kind Regards,
Microsoft Support Team.

Answer 2

Vasil Michev 127.5K MVP Volunteer Moderator

If your DLP policy is scoped to Exchange only, you can add an exception. But it needs to be in a separate group. In your example/screenshot above, remove the second group. Then create a separate one by clicking Add group (next to Add condition), with the NOT toggle, as shown below:

User's image (again, the available options will depend on the workload selection for the policy)

For a more robust solution, or when using multi-workload policies, you can create a custom SIT. See this thread for more details: https://techcommunity.microsoft.com/discussions/data-security/dlp-policy-rule-u-s-physical-address-exclusion/4413475

Jeff Streelman 40 Reputation points

2026-07-31T14:14:56.98+00:00

Thanks for your quick response but I don't think that works. Here's the example . . . when trying to detect PHI

Group 1: ANY -- SIT for US SSN, US Tax Payer, DEA

AND
ANY -- SIT for US Physical Address or Custom DOB
AND
Group 2: Content is shared from Microsoft 365 outside my organization
AND NOT
Group 3: Subject doesn't contain "secure"

You cannot just add a Group 4 with AND NOT for the US Address "111 5th Ave bla bla"

What I am trying to do is set a condition as follows:

Group: SIT for US Physical Address

AND NOT Subject or Body Contains "111 5th Ave bla bla"

I don't see how that's possible. Help!
Vasil Michev 127.5K Reputation points MVP Volunteer Moderator

2026-07-31T14:28:12.4566667+00:00

Well you didn't mention the need for additional conditions. If it is not possible to break your scenario to simpler rules, a custom SIT will be the only solution. Refer to the thread I linked to above for details on that.