Purview DLP in Teams: blocked chat and channel messages, external users and policy tips

A user pastes a customer list into a Teams chat and gets "This message was blocked." Another user expected the same protection in a channel and got nothing. Both are Microsoft Purview data loss prevention (DLP) working exactly as configured. In this post I'll decode what senders and recipients see, explain how the Teams location behaves with guests, external chats and shared channels, and work through the reasons a Teams policy doesn't fire.

Symptoms#

The sender sees one of these notices on their own message, with a What can I do? link:

This message was blocked.
This message was flagged.

• Blocked, override not allowed: What can I do? only lets the sender report the message to an admin. It stays blocked.
• Blocked, override allowed: the options can include Override and send, Report to my admin, and Override and send and report to my admin, sometimes with a justification.
• Flagged: the message was delivered but is marked as containing sensitive data.

Recipients see This message was blocked by organizational policy. with a What's this? link. In the Activity feed, a matching message shows Preview unavailable instead of its preview, and the sender gets an activity entry saying Your message has been blocked. Teams DLP doesn't send notification emails to users; the flags on the message are the notification. Separately, a file shared in a chat or channel may not open for guests.

Why it happens#

The Teams chat and channel messages location evaluates messages within seconds of sending. A few rules decide what's covered:

• Files aren't evaluated by the Teams location. Teams stores shared files in SharePoint and OneDrive, so a file only stops opening for guests if the policy also includes the SharePoint and OneDrive locations. That behavior is covered in DLP blocking SharePoint and OneDrive files.
• External access chats follow the hosting tenant. In a chat with people from another Microsoft 365 organization, DLP is enforced by the tenant that started the chat or thread. If the partner started it, your policies don't apply to your users' messages there.
• Shared channels follow the sender. Each participant's messages are evaluated against their own home tenant's policies, whichever tenant owns the channel.
• Scope by individual users excludes channels. Microsoft's scope table shows that a policy scoped to individual user accounts protects 1:1 and group chats but not standard, private or shared channel messages. Scope to security groups, distribution groups or Microsoft 365 groups and both are covered.
• Licensing. Microsoft lists DLP for Teams chat and channel messages (private channels included) with E5-level licensing: Office 365 or Microsoft 365 E5/A5/G5, or the Information Protection and Governance, Compliance and F5 Security & Compliance offerings. E3 covers Exchange, SharePoint and OneDrive, which includes files shared through Teams.

Most external-sharing policies use Content contains sensitive info types plus Content is shared from Microsoft 365 with people outside the organization, and the action Restrict access or encrypt the content in Microsoft 365 locations › Block only people outside your organization. With that design, a message in an internal-only chat never matches, which is often the "it didn't fire" answer.

How to fix it#

1. Find the policy and rule that matched#

Open Activity explorer in the Microsoft Purview portal, apply the DLP policies that detected activities filter set and filter by the sender. The event shows the policy, rule and detected info types. Allow 60 to 90 minutes for Teams events to arrive.

2. Handle a false positive#

The sender should use What can I do? and report it to the admin. In Activity explorer, a Teams false-positive report appears as DLP info with synthetic values instead of rule details, and no incident report is generated, so ask users to tell you as well. Then tune the rule; see tuning Purview DLP false positives.

3. Allow override where the business accepts it#

Edit the rule and allow overrides in its user notification settings. Once the sender overrides, recipients receive the original message. Keep external-facing rules without override if you must never send that data outside.

4. Work through "the policy doesn't fire"#

5. Check the policy from PowerShell#

Connect-IPPSSession
Get-DlpCompliancePolicy -Identity "DLP - Teams external" -DistributionDetail |
  Format-List Name,Mode,Teams*,DistributionStatus,DistributionResults

Good looks like the Teams location listing the users or groups you intended, Mode set to Enable, and DistributionStatus showing Success. If distribution is stuck, see policy distribution errors.

Verify the fix#

• From a pilot account, start a chat with a test guest and send dummy data that matches the info type: you see "This message was blocked." and the guest sees the organizational policy notice.
• Repeat in a channel of a team the policy is scoped to, then in an internal-only chat to confirm the rule only targets external sharing, if that's the intent.
• Share a matching test file with the guest: it won't open for them.
• Activity explorer shows the Teams events, and alerts arrive if the rule sends incident reports. Those come from no-reply@teams.mail.microsoft.com, so make sure your mail filtering doesn't junk them.

Key takeaways#

• Pair the Teams location with SharePoint and OneDrive, or files slip through.
• Scope with groups, not individual users, if channels matter.
• Your policies protect chats your tenant hosts; in partner-hosted chats and shared channels, each sender's own tenant decides. See external access vs guest access in Teams.
• Communication compliance and information barriers block messages too; check which feature acted before tuning DLP. Every DLP message across locations is listed in the DLP messages quick reference.

References#

• Data loss prevention and Microsoft Teams (Microsoft Learn)
• Microsoft Teams messages about DLP and communication compliance policies (Microsoft Support)
• Get started with activity explorer (Microsoft Learn)