DLP Reporting - False Positive and Overrides

Jacob Ellis 26 Reputation points
2022-06-02T14:42:17.957+00:00

Hello,

I am trying to create or export a report based on the DLP false positives and overrides report within the compliance center.

https://learn.microsoft.com/en-us/microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide

I am able to review the policy matches and the justification from within this report but I have yet to find a way to export the report to include the justification provided by the end user for the override. I have tried creating a scheduled report and the export of the data from this specific report does not contain the justification field.

Powershell does not seem to contain the information required:

Get-DLPDetectionsReport
Get-DLPDetailReport

Reviewing the Audit logs does not seem to contain this information.

Ideally, I create an export of polices and one of the columns contains the override justification or reported as a false positive.

Azure Information Protection
Azure Information Protection
An Azure service that is used to control and help secure email, documents, and sensitive data that are shared outside the company.
560 questions
Microsoft Security | Microsoft Purview
{count} votes

Accepted answer
  1. Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator
    2022-06-06T16:34:24.443+00:00

    @Jacob Ellis

    Apologies for the delay in responding to this post. As I understand you are trying to get the justification information provided by the end user for the override when DLP policy applies.

    Tested this in my lab, Activity explorer under Data loss prevention doesnt give the justification information which you are looking for, however if you go to Alerts section ( compliance portal - home - alerts - select the alert name - first section of the alert ( provides view activity list option ) which downloads csv file, has the justification information.

    Last column values has the justification information entered by the end user, shared the snippet of the values column of the csv file.

    208787-image.png

    208841-image.png

    Let me know if you have any questions.


0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.