Cannot Add Non-Mail-Enabled Security Group to DLP Policy in Microsoft Purview
Question details
The user is unable to select or add a standard non-mail-enabled security group when configuring a Data Loss Prevention (DLP) policy.
- Product
- Microsoft Purview
- Device & OS
- not provided
- Scenario
- Configuring Data Loss Prevention (DLP) policies and assigning security groups for compliance management.
- Observed behavior
- The system permits the selection of mail-enabled security groups and distribution groups, but restricts the use of standard non-mail-enabled security groups in this DLP policy location.
Ensure you have administrative access to the Microsoft 365 admin center and the appropriate permissions to manage groups and Microsoft Purview DLP policies.
Create and Apply a Mail-Enabled Security Group
Since non-mail-enabled security groups are unsupported for this policy location, you must create a mail-enabled security group to manage your DLP policy assignments.
Microsoft Purview Data Loss Prevention policies specifically require mail-enabled security groups or distribution groups to function correctly in certain policy configurations. Standard security groups without an associated email address cannot be selected.
Log in to the Microsoft 365 admin center using your global or Exchange administrator credentials.
On the left navigation menu, expand 'Teams & groups' and click on 'Active teams and groups'.
Click on the 'Mail-enabled security' tab and select the 'Add a group' button to launch the setup wizard.
Follow the prompts to name the group, assign an owner, add the necessary members, and provide a valid group email address.
Return to the Microsoft Purview compliance portal, navigate back to your DLP policy configuration, and search for your newly created mail-enabled security group.
Looking for a Lightweight Office Suite Alternative?
While Microsoft Purview handles complex enterprise data loss prevention, if you need a straightforward, free, and highly capable office suite for everyday document management, WPS Office is an excellent choice. It offers powerful features without the heavy enterprise overhead.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation file for your operating system.
- 2. Install WPS Office: Run the downloaded executable and follow the quick on-screen instructions to complete the setup.
- 3. Start Creating: Launch WPS Office and easily open your existing Microsoft Office documents, spreadsheets, and presentations.
Frequently Asked Questions
Why doesn't my security group show up in the Microsoft Purview DLP policy search?
Microsoft Purview DLP policies often require mail-enabled security groups or distribution groups. If your security group does not have an associated email address (non-mail-enabled), it will be filtered out and will not populate in the selection list.
Can I convert an existing non-mail-enabled security group to a mail-enabled one?
No, Microsoft 365 does not allow you to directly convert a standard security group to a mail-enabled security group. You must create a new mail-enabled security group and add your existing users to it.
Are distribution groups supported in Microsoft Purview DLP policies?
Yes, Microsoft Purview Data Loss Prevention policies generally support standard distribution groups alongside mail-enabled security groups for policy assignment purposes.
Where do I manage the membership of my mail-enabled security group?
Mail-enabled security groups can be managed directly within the Microsoft 365 admin center under the 'Teams & groups' section, or through the Exchange admin center.
