Email blocked by Purview DLP: notifications, NDRs, overrides and incident reports

Symptoms to confirm

The default notification text for a blocked email is:

• The sender gets a notification whose subject starts with Message Blocked, often with the original message attached.
• Internal recipients received the message but external ones didn't.
• Message trace shows the message as Failed or Quarantined, with a DLP rule event in its details.
• Before sending, Outlook showed a policy tip (if it didn't, see policy tips not showing in Outlook).

Your email message conflicts with a policy in your organization. The message wasn't delivered to all recipients.

Likely causes

Each Exchange action produces a different experience:

• Unexpected blocks usually trace back to a sensitive information type matching too loosely, a rule scoped wider than intended, a stricter rule winning on priority, or a simulation that was set to switch itself on (see how DLP rule priority works).

Checklist

1. 1

   Prove DLP acted

   Trace the message in the Exchange admin center (Mail flow › Message trace) or with the V2 cmdlets, and look for the DLP rule event:

   powershell

   Connect-ExchangeOnline
   $t = Get-MessageTraceV2 -SenderAddress anna@contoso.com -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date)
   $t | Where-Object Subject -like "*Q3 payroll*" | Get-MessageTraceDetailV2 | Format-List Date,Event,Detail

2. 2

   Find the policy, rule and match

   Open the DLP alert in the Microsoft Purview portal or Defender XDR, or filter activity explorer for DLP rule match events from the sender. Both show the policy, the rule and the matched sensitive information types (see investigating DLP alerts).

3. 3

   Decide: real leak or false positive

   If the match is real, explain the policy and offer an approved route, such as sending encrypted. If it's a false positive, tune the rule: raise the confidence level or instance count, add a narrow exception such as ExceptIfRecipientDomainIs for one partner, or downgrade the rule to block with override:

   powershell

   Connect-IPPSSession
   Set-DlpComplianceRule -Identity "Block external customer data" -BlockAccess $true -BlockAccessScope PerUser -NotifyAllowOverride WithJustification

4. 4

   Let users override properly

   In Outlook and Outlook on the web, the sender chooses Show Details › Override, enters a business justification or reports a false positive, and sends again. An override applies per rule and overrides all of that rule's actions; the justification is logged for DLP reports.

5. 5

   Release or resend

   Quarantined messages can be released on the Quarantine page of the Microsoft Defender portal by members of the Quarantine Administrator, Security Administrator or Organization Management role groups.

Verify

• Send the same dummy test data again from a pilot account. The outcome should match the rule you intended: delivered, tip with override, or blocked.
• Message trace shows Delivered for the resent or released message.
• Overrides and false-positive reports appear in the DLP reports with the justification text.
• Run the policy check: Get-DlpComplianceRule -Policy "DLP - Customer data" | Format-List Name,BlockAccess,BlockAccessScope,NotifyAllowOverride.

Prevent it next time

• Write useful notifications. Custom email notifications support tokens such as %%PolicyName%%, %%PolicyRule%%, %%MatchedConditions%% and %%BlockedMessageInfo%%. Notification emails are sent unprotected, and external senders only get a templated version.
• Route evidence. Set GenerateIncidentReport with IncidentReportContent to send incident reports to a compliance mailbox, and use ReportSeverityLevel and GenerateAlert so high-severity rules raise alerts.
• Simulate first and tier your rules; see from simulation mode to enforcement and tuning DLP false positives.
• For other DLP messages, see the Purview DLP messages quick reference.