Data Protection Issues

How to Release or Allow a Message Blocked by Microsoft 365 DLP

Anum Mushtaq Oct 14, 2026 868 views

Question details

The administrator wants to release an outgoing email that was blocked by a Data Loss Prevention (DLP) policy because it contained sensitive information, such as a credit-card number.

How to Release or Allow a Message Blocked by Microsoft 365 DLP

Product: Microsoft 365
Device & OS: not provided
Scenario: A legitimate business communication was blocked by DLP, and the administrator needs to find a way to allow the email to be delivered to the recipient.
Observed behavior: The blocked message does not appear in the standard email quarantine, leaving the administrator without a direct option to approve or release it.

Before you start

Ensure you have the necessary administrative privileges, such as Global Administrator or Compliance Administrator roles, to access and modify policies in the Microsoft Purview compliance portal.

Solution 1Recommended

Configure the DLP Rule to Permit User Overrides

Allow the original sender to bypass the DLP block by providing a legitimate business justification.

Messages blocked by a DLP policy generally cannot be released from quarantine by administrators. The standard best practice is to empower senders to override the policy for legitimate business reasons.

Access the compliance portal

Locate the DLP policy

Navigate to 'Data loss prevention' and select 'Policies'. Find the policy that triggered the block and click 'Edit policy'.

Edit user notifications

Proceed to the specific rule settings and locate the 'User notifications' or 'Incident reports' section.

Enable overrides

Turn on policy tips and check the option to 'Allow overrides from M365 services'. Select the requirement to demand a business justification from the user.

Save and resend

Save your changes to the policy. Instruct the sender to attempt sending the email again, at which point they can provide their justification to bypass the block.

Configure the DLP Rule to Permit User Overrides

Audit Tracking: All user overrides and justifications are recorded in the Microsoft 365 audit logs, allowing administrators to review them for compliance later.

Solution 2

Create a Narrowly Scoped Policy Exception

Modify the existing DLP policy to exclude specific senders, recipients, or domains from the rule.

Free Microsoft Office alternative

Looking for a Free, Lightweight Office Suite?

If you are looking for an easy-to-use alternative for creating and editing business documents without dealing with complex administrative policies, WPS Office is an excellent choice. It provides seamless compatibility with Microsoft Office formats in a lightweight, secure environment.

High compatibility with Microsoft Word, Excel, and PowerPoint filesLightweight application that runs smoothly on all major operating systemsFamiliar user interface ensuring zero learning curve and seamless migrationBuilt-in PDF editing capabilities and secure document encryptionFree to use for everyday individual and business document needs

microsoft office alternative - wps office

Frequently Asked Questions

Why can't I find the DLP-blocked message in my Microsoft 365 email quarantine?

Unlike spam or malware protections, Microsoft 365 Data Loss Prevention (DLP) policies are designed to block sensitive transmissions outright at the transport layer. Therefore, these messages are not held in a quarantine queue for administrator release.

Is there a direct 'Approve' button for administrators when receiving a DLP alert?

No. While administrators receive incident notifications that a policy was violated, there is no direct approve-or-release action embedded in the alert. The policy must either allow sender overrides or be modified to include an exception.

How can I track who is overriding the DLP policies?

When you configure a DLP policy to allow overrides, you can require users to submit a business justification. These justifications, along with the user's details, are logged and can be reviewed in the Microsoft Purview compliance portal under the Activity explorer or Audit logs.

Microsoft Office Security Issues