DLP Reporting - False Positive and Overrides

Question

Hello,

I am trying to create or export a report based on the DLP false positives and overrides report within the compliance center.

https://learn.microsoft.com/en-us/microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide

I am able to review the policy matches and the justification from within this report but I have yet to find a way to export the report to include the justification provided by the end user for the override. I have tried creating a scheduled report and the export of the data from this specific report does not contain the justification field.

Powershell does not seem to contain the information required:

Get-DLPDetectionsReport
Get-DLPDetailReport

Reviewing the Audit logs does not seem to contain this information.

Ideally, I create an export of polices and one of the columns contains the override justification or reported as a false positive.

Answer 1

@Jacob Ellis

Apologies for the delay in responding to this post. As I understand you are trying to get the justification information provided by the end user for the override when DLP policy applies.

Tested this in my lab, Activity explorer under Data loss prevention doesnt give the justification information which you are looking for, however if you go to Alerts section ( compliance portal - home - alerts - select the alert name - first section of the alert ( provides view activity list option ) which downloads csv file, has the justification information.

Last column values has the justification information entered by the end user, shared the snippet of the values column of the csv file.

Let me know if you have any questions.