Theory questions on DLP rules

Mikhail Firsov 1,876 Reputation points


The DLP policy created based on some built-in template contains the following (among others) rules:

These two rules are exactly the same and differs only in policy tips and audit mode:

Q1: What parameter will define which rule to be fired - "low" or "high"?

Q2: What log will contain the auditing information ("Audit this rule with severity level:")

Thank you in advance,

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,436 questions
0 comments No comments
{count} votes

Accepted answer
  1. Andy David - MVP 143.8K Reputation points MVP

    Q1. Click on the Type in the rule to view: or change the count ( The low or high volume)


    Q2: That actually refers to message tracking, High auditing means the transport rules fired will show up in message tracking.

    I recall this only works in Exchange Online.

    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Mikhail Firsov 1,876 Reputation points

    AndyDavid, thank you!

    Q2: It's looks weird to me that this feature is not working as expected - it sometimes does log the corresponding information and sometimes does not (on premises) :(


    0 comments No comments