Data Protection Issues

Fix OneDrive DLP AND Condition Not Working in Microsoft Purview

Chanuka Geekiyanage Oct 14, 2026 868 views

Question details

The user needs to resolve an issue where a Microsoft Purview DLP policy fails to trigger when combining external sharing and sensitivity label conditions using an AND relationship.

How to Fix OneDrive DLP AND Condition Not Working in Microsoft Purview

Product: Microsoft Purview / OneDrive
Device & OS: not provided
Scenario: Configuring Data Loss Prevention policies in Microsoft 365 to restrict external file sharing based on specific sensitivity labels applied to the documents.
Observed behavior: The policy successfully triggers when the conditions use an OR relationship, but fails to evaluate or trigger correctly when an AND relationship is applied.

Before you start

Ensure you are logged into the Microsoft 365 admin center with Compliance Administrator or Global Administrator privileges to view, modify, and manage Data Loss Prevention policies.

Solution 1

Recreate and Toggle the DLP Policy

Refresh the backend synchronization by completely rebuilding the policy rule and toggling its active status.

Sometimes, complex policy rules involving multiple conditions (like sensitivity labels combined with sharing scopes) fail to synchronize correctly on the backend. Recreating the policy can force Microsoft Purview to generate a fresh rule evaluation path.

Navigate to DLP policies

Log in to the Microsoft Purview compliance portal and select 'Data loss prevention' from the left-hand menu, then go to the 'Policies' tab.

Delete and rebuild

Delete the existing problematic policy. Create a new policy from scratch, carefully adding the condition for 'Content is shared from Microsoft 365' (External) AND 'Content contains sensitivity labels'.

Toggle the policy status

Save the policy and initially set it to 'Turn off'. Wait approximately 10 to 15 minutes, then edit the policy again and toggle it to 'Turn on' to force a fresh backend sync.

Solution 2Recommended

Open a Microsoft 365 Support Request

If recreating the policy fails, escalate the issue to Microsoft Support to inspect backend processing logs.

Free Microsoft Office alternative

Experience a Lightweight and Secure Office Alternative with WPS

While configuring enterprise DLP policies in Microsoft Purview requires backend administrative support, protecting your everyday personal and business documents shouldn't be complicated. WPS Office provides a free, lightweight, and highly compatible suite equipped with built-in document encryption to keep your files secure without the heavy enterprise overhead.

1. Download WPS Office: Visit the official WPS website to download and install the free WPS Office suite on your device.
2. Open Your Files: Seamlessly open your existing Microsoft Word, Excel, and PowerPoint files without worrying about formatting issues.
3. Apply Local Security: Go to the 'Menu' and select 'Document Encryption' to securely password-protect your sensitive files locally before sharing.

Fully compatible with Microsoft Office formats including DOCX, XLSX, and PPTX.Built-in document encryption and password protection for local data security.Free and lightweight suite for everyday document editing and sharing.Familiar user interface ensuring seamless migration and zero learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

Why does the OR condition work but not the AND condition in a Purview DLP policy?

The OR condition evaluates each rule independently, triggering if any single parameter is met. An AND condition requires all parameters (such as a specific sensitivity label AND external sharing scope) to match simultaneously. If the file's metadata isn't passing both flags to the DLP evaluation engine at the exact time of the sharing action, the AND condition fails to trigger.

How long does it take for a new DLP policy to take effect in Microsoft 365?

After creating or modifying a Data Loss Prevention policy in Microsoft Purview, it typically takes up to 1 hour to sync, but it can occasionally take up to 24 hours for the policy to be fully enforced across all Exchange, SharePoint, and OneDrive environments.

How can I track why a DLP policy didn't trigger correctly?

Administrators can use the Activity explorer in the Microsoft Purview compliance portal. By filtering for specific files or users, you can review audit logs to see exactly how files are being labeled, shared, and which DLP rules were evaluated or bypassed during the action.

Microsoft Office Security Issues