Purview DLP messages and errors: policy tips, notifications, Teams, devices and PowerShell

Purview DLP talks to people in many places: policy tips in Outlook and Office apps, notification emails, icons in SharePoint and OneDrive, flags in Teams, notifications on devices, and the results of Microsoft's own diagnostics. This page lists the default texts and statuses Microsoft documents, with what each one means, the usual cause and the first thing to check. Press Ctrl+F, type the words you see and follow the guide link.

How to read these messages#

• Text belongs to the rule. Every DLP rule can carry custom policy tip and email text, so the defaults below appear only where the admin kept them. Microsoft describes its defaults as text "similar to" what it lists, and clients differ slightly: Outlook on the web, for example, can show Your email message conflicts... as a tip.
• One tip at a time. When content matches several rules or policies, users see only the tip from the most restrictive, highest-priority rule, and that includes policies still in simulation mode.
• Where each kind appears. In Outlook, policy tips sit above the recipients while you compose. On sites, a warning icon (notify) or blocked icon (block) is shown on the item. Office desktop apps use the Message Bar and File › Info. Notification email subjects start with the action, such as Notification, Message Blocked or Access Blocked. Teams uses message flags and never sends DLP notification emails.
• The rule name lives on the admin side. DLP alerts, activity explorer and the audit log name the policy and rule (investigation guide). Users only see it if a custom email uses the %%PolicyName%% or %%PolicyRule%% tokens.

Outlook and Exchange email#

A blocked sender also gets an NDR. Its wording depends on the rule, because you can add your own text to the rule's NDR response. Microsoft suggests this for Outlook clients that can't show policy tips, so those users know to resend from Outlook on the web. Read the admin section of the NDR and the message trace (NDR code reference).

SharePoint, OneDrive and Office apps#

SharePoint and OneDrive#

Word, Excel and PowerPoint (desktop)#

Office desktop tips need the file to be stored in SharePoint or OneDrive, and the Office mobile apps show no DLP policy tips. Sites are evaluated asynchronously, so expect a delay before an icon appears, or clears after you resolve or override it.

Microsoft Teams#

Files shared in Teams are protected through SharePoint and OneDrive, so the policy must include those locations. Teams shows no tips for files; a recipient might simply get access denied. In chats with external organizations, the tenant that started the chat enforces its policies. Allow about an hour after a policy change.

Devices (endpoint DLP)#

On Windows and macOS, a restricted activity shows a notification when the rule's user notifications for devices are on. The rule's Customize the notification option sets the title and content. Just-in-time (JIT) protection adds its own events while a file is still being evaluated (endpoint settings guide).

If devices show nothing at all, check onboarding first (onboarding guide).

Diagnostics, PowerShell and policy status#

The HAR diagnostic in the Microsoft Purview portal reads a browser trace from Outlook on the web. Start recording before you trigger the tip, and keep the file under 100 MB.

When the message you expect doesn't appear#

• Exchange admin center tips win. If mail flow rules in the Exchange admin center have policy tips configured, Purview tips don't show in Outlook until you turn those off.
• No Override button: with NotifyAllowOverride, BlockAccess must be $true and BlockAccessScope set, or the tip appears without an override option.
• Outlook desktop: under File › Options › Mail › MailTips Options, Policy tip notification and Display automatically when MailTips apply must be selected. Microsoft documents minimum Outlook for Microsoft 365 builds.
• Encrypted mail: messages encrypted with Purview Message Encryption show no tips when the policy detects them with the encryption condition.
• External sharing: SharePoint marks content as shared externally only after an outside user first opens it, so a sharing condition can lag.
• Notification emails go only to individuals, not groups. They're triggered by new content only (edits raise tips), go out unprotected, and external senders get a cut-down template.
• Custom text limits: policy tips take 256 characters of plain text. Notification emails allow a 256-character subject, a 70-character sender name and a 5,120-character body.

How to verify a fix#

1. Re-run the HAR diagnostic. Good is Policy tip evaluation for the OWA client completed successfully, followed by Expected Policy Tip to be shown: '...' from the rule '...' naming your rule.
2. Run the admin center test. Run Tests: DLP policy tips in the Microsoft 365 admin center needs a Global Administrator and takes the user, the rule name or GUID, and Outlook or Outlook on the web.
3. Check the policy from PowerShell (connection help):
   PowerShell

   Connect-IPPSSession
   Get-DlpCompliancePolicy -Identity "Finance data - external" -DistributionDetail |
       Format-List Name, Mode, DistributionStatus, DistributionResults

   Good is Mode : Enable and DistributionStatus : Success.
4. Repeat the action with a test user and confirm the rule match, override or block in activity explorer. Endpoint and Teams changes can take a while to sync.

References#

• Send email notifications and show policy tips for DLP policies (Microsoft Learn), the source of the default texts
• Diagnose DLP policy tip issues by using the HAR diagnostic (Microsoft Learn)
• Resolve issues that affect DLP policy tips (Microsoft Learn)
• Data loss prevention and Microsoft Teams (Microsoft Learn) and Data loss prevention policy tips reference (Microsoft Learn)
• Learn about Endpoint DLP just-in-time protection (Microsoft Learn)