How to Exempt Trusted Domains from Microsoft 365 DLP Policies
Question details
An organization needs to configure Microsoft 365 to exclude specific trusted domains from Data Loss Prevention (DLP) policies.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Administrators are trying to configure data loss prevention rules to allow safe communication with partner or internal domains, but standard steps are failing.
- Observed behavior
- Standard rule steps to exempt domains do not function properly when advanced DLP settings are enabled, preventing the domains from being successfully excluded.
Ensure you are logged into the Microsoft 365 Security and Compliance Center with an account that has active Compliance Administrator or Global Administrator privileges.
Configure Domain Exceptions using Advanced DLP Policy Settings
Modify your existing DLP policies or create a new policy utilizing advanced settings to successfully add the target trusted domains as exceptions.
When standard DLP policies are applied, certain simple rule sets do not inherently support complex exception logic. By accessing the advanced settings in the Security and Compliance Center, you unlock the ability to specify granular conditions and exceptions, such as exempting specific recipient domains.
Log in to the Microsoft 365 Security and Compliance Center using your administrator credentials.
On the left navigation pane, click on 'Data loss prevention' and then select 'Policy' from the dropdown menu.
Select the specific DLP policy you wish to modify and click to open the 'Policy settings'.
Within the settings, create a new rule. Look for the 'Exceptions' section and configure it to exclude the specific trusted domain.
If you are creating a completely new policy, ensure you toggle on 'Advanced settings' during the setup wizard. This is required to make the exceptions and additional conditions available for configuration.
Looking for a secure and cost-effective Office solution?
While enterprise DLP administration is handled in the Microsoft 365 admin portal, if your team needs a lightweight, secure, and free suite for daily document editing, WPS Office is an excellent choice. It provides extensive compatibility with Microsoft formats and features robust built-in local document protection.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the downloaded installer and follow the on-screen prompts to complete the installation.
- 3. Open Your Documents: Launch WPS Office and instantly open your existing Microsoft Office files without losing any formatting.
Frequently Asked Questions
Why can't I see the option to add an exception in my Microsoft 365 DLP policy?
If you are using the standard or default DLP setup wizard, the granular exception options are often hidden. You must enable 'Advanced settings' or 'Advanced DLP rules' to reveal the full conditions and exceptions fields.
Can I apply DLP exceptions to specific users instead of entire domains?
Yes, within the advanced settings of the Microsoft 365 Security and Compliance Center, you can configure DLP policy exceptions based on specific sender or recipient email addresses, security groups, or full domains.
Does disabling advanced DLP settings remove my exceptions?
Yes, if you switch a complex rule back to a standard/simple configuration, you may lose the granular exceptions (like trusted domains) that rely on the advanced rule schema. Always review rules carefully before saving changes.
