Troubleshoot Microsoft 365 DLP Policies Not Enforcing
Question details
Users are experiencing issues where Microsoft 365 Data Loss Prevention (DLP) policies detect sensitive information but fail to block message delivery or correctly process business justification prompts.
- Product
- Microsoft Purview
- Device & OS
- not provided
- Scenario
- Enforcing Data Loss Prevention policies with business justification requirements for outgoing emails.
- Observed behavior
- DLP policies send alerts but still allow restricted messages or attachments to be delivered because required metadata and business justification headers are missing or altered.
Ensure you have administrative access to the Microsoft Purview compliance portal and a complete list of any third-party email routing or signature integrations currently active in your Exchange environment.
Check Third-Party Email Integrations and Signature Software
Verify if third-party email processing tools are stripping out the DLP headers necessary for business justifications and enforcement.
Third-party software that appends signatures or processes outgoing messages often rewrites email headers. If the software removes the header containing the DLP business justification, the Microsoft 365 DLP workflow breaks, allowing the message to bypass restrictions.
Open the Exchange Admin Center and check your mail flow rules for any connectors that route outbound mail through third-party signature or encryption tools.
Perform a message trace on an affected email to determine if the business justification header was removed after passing through the third-party service.
Configure your third-party software to bypass or preserve Microsoft Purview DLP headers. Alternatively, adjust mail flow rules to ensure emails are routed through the DLP engine only after the external signature is applied.
Verify DLP Policy Configuration Status
Ensure the DLP policy is actively enforcing actions rather than just operating in test mode.
Looking for a Reliable and Lightweight Office Suite? Try WPS Office
While managing enterprise DLP environments requires Microsoft 365 admin tools, everyday document creation doesn't have to be complicated or expensive. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office, perfect for teams looking to streamline their workflow.
- 1. Download the software: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install WPS Office: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
- 3. Open your files: Launch WPS Writer, Spreadsheet, or Presentation to immediately open, edit, and save your existing Microsoft Office documents.
Frequently Asked Questions
Why is my Microsoft 365 DLP policy only generating alerts but not blocking emails?
If a policy is set to 'Test it out' (simulation mode), it will only monitor and generate alerts without actively blocking emails or enforcing business justification prompts. You must edit the policy in the Purview portal and change the status to 'Turn it on right away'.
What is a business justification in Microsoft Purview DLP?
A business justification is a prompt that allows end-users to override a soft DLP block by providing a valid business reason (such as 'Manager approved'). This reason is logged in a specific email header for compliance tracking and auditing.
Can I use third-party email signatures alongside Microsoft 365 DLP?
Yes, but you must ensure that your Exchange mail flow rules route messages correctly. If the third-party signature service processes the email and strips out the DLP headers before Exchange finalizes the delivery, the DLP enforcement will fail.
