View reports about DLP policy detections

  • Article

 

Applies to: Exchange Online

If you subscribe to Microsoft Exchange Online, you can use the Office 365 admin center to view information about the number of messages that are detected by your data loss prevention (DLP) policies. You can view the following four types of datasets in either graphical chart or table format:

  1. DLP policy matches for sent mail

  2. DLP policy matches for received mail

  3. DLP rule matches for sent mail

  4. DLP rule matches for received mail

You can also view the number of matches, overrides, and false positives for each policy within only the past 24 hours in the Exchange admin center. However, this data is not available as a chart. Furthermore, if you download a Microsoft Excel report, you can view even more detail such as who sent which message on what day that was detected by which policy.

Warning

The reports that are described here are only available to Exchange Online customers and not Exchange Server 2013 customers.

For additional management tasks related to DLP, see DLP procedures.

For additional management tasks related to reports in the Office 365 admin center, see Mail Protection Reports for Office 365 or Exchange auditing reports.

What do you need to know before you begin?

  • Estimated time to complete: 15-60 minutes

  • You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Data loss prevention (DLP)" entry in the Messaging policy and compliance permissions topic.

  • Keep in mind that the charts will be empty if:

    1. Your Office 365 subscription does not include data loss prevention (DLP) features.

    2. You have no DLP policies saved.

    3. No users sent or received mail that matched rules within your DLP policies.

    4. The time range that you have selected below your report does not include a period when messages were detected.

  • Before you can install the Microsoft Excel plugin for Exchange Online Reporting, your system must meet the requirements listed on the Mail Protection Reports download site.

  • For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.

Tip

Having problems? Ask for help in the Exchange forums. Visit the forums at: Exchange Server, Exchange Online, or Exchange Online Protection.

What do you want to do?

Use the Office 365 admin center to view DLP reports

  1. In the Office 365 admin center, navigate to Reports > DLP.

    The title above the graph explains the information presented.

  2. To show only data related to a single policy, if you have more than one policy, select it in dropdown box above the chart.

  3. To show data for a different time period, select it below the chart.

  4. To switch between reports, select one of the smaller graphs on the page.

How do you know this worked?

You have successfully found DLP reports if your admin center page shows a graph of the number of messages over time. If the graph does not contain any data points, it is possible that none of your DLP policies has detected a message within the selected time.

Use the EAC to view DLP reports

  1. In the EAC, navigate to Compliance management > Data loss prevention, and click Reports Reports Icon for a list of all DLP reports available.

For a quick view of the DLP policy detections during only the past 24 hours, follow these steps. In the EAC, navigate to Compliance Management > Data Loss Prevention. Here you’ll see a list of all of your saved DLP policies along with data about the number of matches, overrides, and false positives for each policy.

How do you know this worked?

Two different formats for data are available with the procedures here. The latter method will show only a text-style listing of your policies and any related detections for the past 24 hours. If you clicked Reports, as described in the former method, then you’ll know you successfully found DLP reports if your admin center page shows a graph of the number of messages over time. If the graph does not contain any data points, it is possible that none of your DLP policies has detected a message within the selected time.

Use the Office 365 admin center to download the Microsoft Office 365 Excel Plugin for Exchange Online Reporting

Follow these steps to find detailed information about how DLP policies are affecting messages by using the Microsoft Office 365 Excel Plugin for Exchange Online Reporting. This reporting workbook is a tool that you can download and use along with Excel for more detailed analysis.

  1. In the Office 365 admin center and navigate to Reports.

  2. Under Download your reports, click Mail protection reports (Excel).

  3. Follow the prompts on the Microsoft Download Center to install the reporting workbook.

  4. Load summary data by using the web service calls that are a part of the workbook.

How do you know this worked?

During the download and installation process, you’ll need to answer several questions in order to install the workbook and fill it with your DLP policy data. If you successfully install the tools, you’ll be able to use the features of Excel to isolate the data that you want.