A DLP policy that blocks mail without warning the sender first generates help desk calls, not compliance. When the policy tip doesn't show in Outlook, the policy usually works fine; the client, the license, the scope or a condition is the problem. In this post I'll show which Outlook clients show tips for which conditions, how to find the reason in your tenant, and how to test it properly.
Errors this guide fixes
Your email conflicts with a policy in your organization.Outlook (DLP policy tip)+1 more guide
Symptoms#
- A user pastes test data into a new message and no tip appears above the recipients, although the message is then blocked or the user receives a DLP notification email.
- The tip shows in Outlook on the web but not in classic Outlook, or not at all in Outlook for iOS, Android or Mac.
- The tip shows but there's no way to override.
When it works, the default tip for email reads:
Your email conflicts with a policy in your organization.Why it happens#
Policy tips depend on the client evaluating the rule while the user types, and each client supports a different subset of DLP:
| Client | What shows a tip |
|---|---|
| Outlook for Microsoft 365 (classic): E3 users, offline or connected experiences off, or builds older than 2303 (Semi-Annual Enterprise Channel 2302) | Only Content contains sensitive information types (SITs) and Content is shared from Microsoft 365 |
| Classic Outlook for online E5 users with connected experiences on, 2303 or later (Semi-Annual Enterprise Channel 2302 or later) | Also sensitivity labels, sender and recipient conditions, subject words, "isn't labeled", file extension, exact data match SITs and trainable classifiers |
| Perpetual (non-subscription) Outlook | Only SITs and Content is shared from Microsoft 365 |
| Outlook on the web and new Outlook for Windows | Ten common conditions: content shared, SITs, sensitivity label, subject or body words, sender is / member of / domain, recipient is / member of / domain |
| Outlook for iOS, Android and macOS | Tip UI is off until you enable it |
The other usual causes:
- Old Outlook builds. Microsoft's matrix lists classic Outlook version 2105 (build 14026.20000), or 2102 (build 13801.20862) on Semi-Annual Enterprise Channel, as the baseline for tips.
- Licensing. For the E5-level tip support in classic Outlook, users without Microsoft 365 E5 need a license that includes the Information Protection for Office 365 - Premium service plan.
- Scoping by non-mail-enabled security groups. Classic Outlook shows no tips for those policies, although the actions are still enforced.
- The tip is switched off. The rule has no policy tip, or the policy runs in simulation without notifications (
TestWithoutNotifications). - Another rule wins. Only the tip from the most restrictive, highest-priority matching rule is shown, and that includes policies in simulation.
- Size limits. For tips in classic Outlook, DLP processes only the first 4 MB of message content and classifies up to 2 MB of attachments.
- Exceptions by design. No tips for meeting invitations, or for mail encrypted with Microsoft Purview Message Encryption when the rule uses the encryption condition.
- Legacy Exchange tips. While policy tips are configured in the Exchange admin center, Purview tips don't appear in Outlook.
How to fix it#
1. Prove the policy side first#
Connect-IPPSSession
Get-DlpCompliancePolicy -Identity "DLP - Customer data" -DistributionDetail | Format-List Name,Mode,DistributionStatus
Get-DlpComplianceRule -Policy "DLP - Customer data" | Format-List Name,Priority,NotifyUser,NotifyPolicyTipCustomText,NotifyAllowOverride,BlockAccessMode should be Enable or TestWithNotifications, distribution should be Success (if not, see policy distribution errors), and the rule must have user notifications with policy tips. The mailbox must be in Exchange Online.
2. Match the client to the conditions#
Check the build under File › Office Account › About Outlook and the user's license. If the rule uses labels, sender or recipient conditions for an E3 user, the action applies but no tip appears. For rules that must warn everyone, keep the conditions to SITs plus Content is shared from Microsoft 365, and put extra logic in a separate rule.
3. Fix the scope#
Replace non-mail-enabled security groups in the Exchange location with mail-enabled security groups or distribution groups, and make sure the sender is in scope: Exchange scoping is effectively sender-based (see designing DLP policies).
4. Turn on tips for mobile and Mac#
In the Microsoft 365 Apps admin center, under Customization › Policy Management, create a policy that sets Enable Purview Data Loss Prevention (DLP) policy tips in Outlook to enabled, targeted at a pilot group first.
5. Make overrides appear#
An override option needs a rule that blocks (BlockAccess set to true, with a scope) and allows overrides; otherwise the tip appears without one. In Outlook on the web, the policy must also be turned on, not in simulation.
6. Remove leftover Exchange tips#
If old Exchange DLP policies or mail flow rules with policy tips still exist in the Exchange admin center, retire them so Purview tips can take over.
Verify the fix#
- Sign in as a pilot user on a supported build, start a message to an external test address and paste dummy data that matches the rule. The tip should appear above the recipients after a short delay.
- Repeat in Outlook on the web. Tips in the web but not in classic Outlook point to build, license or conditions; no tips anywhere point to the policy.
- If overrides are allowed, choose Show Details › Override, enter a justification or report a false positive, and send.
- Check that the match and the override reach DLP reports and activity explorer (see investigating DLP alerts).
Prevent it next time#
- Keep warning rules within the ten conditions every Outlook client supports, and use mail-enabled groups for scoping.
- Custom tip text is plain text with a 256-character limit; say what to do, not just what's wrong.
- For E5 users on classic Outlook who get the oversharing dialog, the
dlpwaitonsendtimeoutregistry value (Wait on send) holds a message for a set time after Send so evaluation can finish. - When the tip isn't the issue but the block is, see email blocked by Purview DLP.
