A file in SharePoint or OneDrive suddenly shows a blocked icon, guests can't open it, and the owner wants to know who broke sharing. Usually nobody did: a Microsoft Purview data loss prevention (DLP) rule found sensitive content and restricted access. In this post I'll explain what users see, why DLP blocks a file (sometimes well after upload), how to unblock it properly and how to prove what happened.
Errors this guide fixes
This item conflicts with a policy in your organization. If you don't resolve this conflict, access to this file might be blocked.SharePoint / OneDrive policy tipAccess to this item is blocked for everyone except its owner, last modifier, and the primary site admin.SharePoint / OneDrive policy tip+1 more guideThis item conflicts with a policy in your organization.SharePoint / OneDrive policy tip+1 more guideThis file conflicts with a policy in your organization. If you don't resolve this conflict, access to this file might be blocked.Word, Excel, PowerPoint (Message Bar)Access BlockedDLP email notification (subject)
Symptoms#
- In the document library the file shows a warning icon (the rule only notifies) or a blocked icon (the rule restricts access).
- The policy tip in the details pane shows one of the default texts below. Custom tips replace them with plain text of up to 256 characters, so your tenant may show different wording.
This item conflicts with a policy in your organization.
This item conflicts with a policy in your organization. If you don't resolve this conflict, access to this file might be blocked.
This item conflicts with a policy in your organization. Access to this item is blocked for everyone except its owner, last modifier, and the primary site admin.- Word, Excel or PowerPoint on the desktop shows on the Message Bar:
This file conflicts with a policy in your organization. If you don't resolve this conflict, access to this file might be blocked.with a pointer to the File menu. - The owner or last modifier receives a DLP email notification whose subject starts with
Access Blocked. - Guests, or people who received an "Anyone" link, can't open a file that worked yesterday, while the owner still can.
Why it happens#
DLP in SharePoint and OneDrive isn't a gate at upload time. Policies sync to sites, and files are evaluated periodically and asynchronously after they've been crawled. That design explains most tickets:
- Delayed blocks. A new file can be uploaded and shared, then blocked shortly afterward when evaluation catches up. Editing existing content also triggers policy tips (though not new email notifications), so a clean file can become blocked after someone pastes in a list of card numbers.
- Access restriction, not deletion. The action Restrict access or encrypt the content in Microsoft 365 locations can block everyone except the owner, last modifier and primary site admin, block only people outside your organization, or block only people who got access through an "Anyone" link. The file stays put; sharing simply stops working for the blocked audience.
- Who counts as external. Users whose user type is Member are internal; Guest accounts are external.
- The most restrictive rule wins. When a file matches several rules or policies, users see only the tip from the most restrictive, highest-priority rule, and Microsoft notes this includes policies in simulation mode. The tip a user reads may therefore come from a policy you didn't expect.
How to fix it#
1. Identify the policy and rule#
Ask the owner to select the file, choose Information in the upper-right corner to open the details pane, and select View policy tip. The tip lists the issues found. As an admin, open Activity explorer from the Data loss prevention solution in the Microsoft Purview portal, apply the DLP policies that detected activities filter set and filter by user or location. The event details name the policy and rule that matched and what was detected.
Activity explorer isn't real time: allow 60 to 90 minutes for SharePoint and OneDrive events to appear, and remember it reports on 30 days of data.
2. Decide whether the match is real#
- Real sensitive data: the owner removes the sensitive content, or removes the sharing with the blocked audience (for example the guest or the "Anyone" link). DLP re-evaluates the file, and the icon clears after a delay similar to the one that set it.
- False positive: the owner selects Resolve in the policy tip and then Report a false positive, if the rule allows it. Collect the matched info type from the event so you can tune the rule.
3. Let users override where the business allows it#
If the rule offers it, the owner selects Resolve, then Override the policy tip, and enters a business justification when one is required. Override is per rule and overrides every action in that rule, plus any other rules the file matched. It's only offered when the rule both blocks access and allows override; a notify-only rule never shows it. If users say the override option is missing, check the rule in Security & Compliance PowerShell:
Connect-IPPSSession
Get-DlpComplianceRule -Policy "DLP - Customer data" |
Format-List Name,BlockAccess,BlockAccessScope,NotifyAllowOverrideMicrosoft's guidance: when NotifyAllowOverride is set to WithoutJustification, WithJustification or FalsePositives, BlockAccess must be True and BlockAccessScope must have a suitable value; otherwise the tip appears without an override option.
4. Tune the rule instead of excluding the site#
If one info type keeps misfiring, raise its confidence level or minimum instance count, or add a targeted exception, rather than removing the site or OneDrive from the policy. The detailed process is in tuning Purview DLP false positives. A useful pattern from Microsoft's examples: notify only for internal sharing, block with override for larger internal volumes, and block without override for external sharing.
5. Rule out non-DLP causes#
No policy tip and no DLP event, but guests still can't open the file? Then check sharing instead: Access Denied and sharing link errors and external sharing settings explained.
Verify the fix#
- The icon on the file is gone and the policy tip no longer appears (allow for the asynchronous delay).
- A test guest or a fresh "Anyone" link opens the file, if that's what the policy now permits.
- In Activity explorer the newest event for the file reflects the change. In Audit, overrides and false-positive reports are logged under the
ComplianceDLPSharePointrecord type; see searching the audit log in Purview. - A test file with real-looking dummy data elsewhere in scope is still blocked, so the policy wasn't weakened.
Prevent it next time#
- Close the window for new files. Because evaluation lags behind uploads, a guest could open a sensitive file before DLP processes it.
Set-SPOTenant -MarkNewFilesSensitiveByDefault BlockExternalSharing(SharePoint Online Management Shell) blocks guest access to new files until they're scanned, and guests are told the file is being scanned. It can take up to 60 minutes to apply, and files in locations no DLP policy covers then can't be accessed externally at all, so plan coverage first. - Simulate before enforcing, with policy tips on: see from simulation mode to enforcement.
- Write useful custom tips that say what was found and who to contact.
- Use labels as conditions where classification matters more than patterns; see rolling out sensitivity labels.
- Related messages from Teams and other locations are covered in Purview DLP in Microsoft Teams and the DLP messages quick reference.
