Data loss prevention policy tip reference for Outlook for Microsoft 365

  • Article

Tip

If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview compliance portal trials hub. Learn details about signing up and trial terms.

Note

Microsoft Purview data loss prevention (DLP) will only process the first 4 MB on message content for policy tip in Outlook for Microsoft 365 and only classify up to 2 MB of attachments.

Important

Mailboxes must be hosted in Exchange Online. For more information, see: Learn about data loss prevention.

Licensing

See the tables below for the policy tip support details for various licenses and Outlook versions. For advanced DLP policy tip support, which makes additional DLP conditions, advanced classifiers, oversharing dialog, and more available, these licenses are required for each scoped user:

  • E5 or equivalent license
  • Information Protection for Office 365 - Premium" license (MIP_S_CLP2 or efb0351d-3b08-4503-993d-383af8de41e3) must be enabled.

Conditions that support policy tips for Outlook perpetual users

For Outlook perpetual versions and users These conditions apply
-E3 users
-E5 users		 - For email and unencrypted Microsoft 365 files Content contains sensitive information types
- Content is shared from Microsoft 365

Conditions that support policy tips for Outlook for Microsoft 365 users

For Outlook for Microsoft versions and users These conditions apply
- All E3 users
- All offline E5 users
- All E5 users with connected experience disabled
- All online E5 users with production version builds lower than 2303 (Build 16.0.16216.10000)
- All online E5 users with semi-annual channel version builds lower than 2302 (Build 16.0.16130.20478)		 - Content contains sensitive information types
- Content is shared from Microsoft 365
- All online E5 users with connected experience enabled in WW commercial and GCC/GCC-H/DoD clouds
- production version 2303 & Build 16.0 16216.10000 or higher
- semi-annual channel version 2302 & Build 16.0.16130.20478 or higher		 - Content contains Sensitive Info Types (Works for email and unencrypted Microsoft 365 and PDF files)
- Message (includes email subject) contains sensitive information types (Preview)
- Attachment contains sensitive information types (Preview)
- Content contains sensitivity labels (Works for email and Office & PDF file types)
- Content is shared
- Sender is
- Sender is member of (Only Distribution lists, Azure-based Dynamic Distribution groups, and email-enabled Security groups are supported.)
- Sender domain is
- Recipient is
- Recipient is a member of (Only Distribution lists, Azure-based Dynamic Distribution groups, and email-enabled Security groups are supported.)
- Recipient domain is
- Subject contains words
- Content is not labeled (Preview)
- Message is not labeled (Preview)
- Attachment is not labeled (Preview)
- File extension is (Preview)

Actions that support policy tips

All Exchange actions support policy tips

  • Restrict access or encrypt the content in Microsoft 365 locations
  • Set headers
  • Remove header
  • Redirect the message to specific users
  • Forward the message for approval to sender's manager
  • Forward the message for approval to specific approvers
  • Add recipient to the To box
  • Add recipient to the Cc box
  • Add recipient to the Bcc box
  • Add the sender's manager as recipient
  • Removed O365 Message Encryption and rights protection
  • Prepend Email Subject
  • Add HTML Disclaimer
  • Modify Email Subject
  • Deliver the message to the hosted quarantine

Sensitive information types that support policy tips for Outlook perpetual users

For Outlook perpetual version E3 and E5 users these sensitive information types support policy tips:

Sensitive information types that support policy tips for Outlook for Microsoft 365 users

For these Outlook versions and users:

  • All Microsoft 365 for Enterprise E3 users
  • All Microsoft 365 for Enterprise offline E5 users
  • All Microsoft 365 for Enterprise E5 users with connected experience disabled
  • All Microsoft 365 for Enterprise online E5 users with production version lower than 2303 (Build 16.0.16216.10000)
  • All Microsoft 365 for Enterprise online E5 users with semi-annual channel version lower than 2302 (Build 16.0.16130.20478)

These sensitive information types support policy tips:

For these Outlook versions and users:

  • Online E5 users with connected experience enabled.
  • Production version 2303 (Build 16.0.16216.10000) or higher.
  • Semi-annual channel version 2302 (Build 16.0.16130.20478) or higher.

These sensitive information types support policy tips:

Exact Data Match sensitive information types that support policy tips Outlook for Microsoft 365

Yes.

Applies to:

  • Online E5 users with connected experience enabled
  • Production version 2303 (Build 16.0.16216.10000) or higher.
  • Semi-annual channel version 2302 (Build 16.0.16130.20478) or higher.

For more information on exact data match based SITs, see Learn about exact data match based sensitive information types.

Trainable classifiers support for Outlook for Microsoft 365

Yes.

Important

Trainable classifiers are not supported for the following conditions:

  • For new conditions:

  • Message contains

  • Attachment contains

  • For the existing Content contains condition when used in combination with Evaluate rule per component condition. (Preview limitation)

Applies to:

For more information on trainable classifiers, see Learn about trainable classifiers.

Sensitivity label support for Outlook for Microsoft 365

Applies to:

  • Online E5 users with connected experience enabled
  • Production version 2303 (Build 16.0.16216.10000) or higher.
  • Semi-annual channel version 2302 (Build 16.0.16130.20478) or higher.

For more information on sensitivity labels, see Learn about sensitivity labels.