oeltayeb.com · Purview Toolkit

Checklist

Purview DLP policy tips not showing in Outlook: versions, conditions and how to test

Based on the article: Purview DLP policy tips not showing in Outlook: versions, conditions and how to test · 5 min read

A DLP policy that blocks mail without warning the sender first generates help desk calls, not compliance. When the policy tip doesn't show in Outlook, the policy usually works fine; the client, the license, the scope or a condition is the problem. In this post I'll show which Outlook clients show tips for which conditions, how to find the reason in your tenant, and how to test it properly.

Symptoms to confirm

When it works, the default tip for email reads:

  • A user pastes test data into a new message and no tip appears above the recipients, although the message is then blocked or the user receives a DLP notification email.
  • The tip shows in Outlook on the web but not in classic Outlook, or not at all in Outlook for iOS, Android or Mac.
  • The tip shows but there's no way to override.
Your email conflicts with a policy in your organization.

Likely causes

Policy tips depend on the client evaluating the rule while the user types, and each client supports a different subset of DLP:

ClientWhat shows a tip
Outlook for Microsoft 365 (classic): E3 users, offline or connected experiences off, or builds older than 2303 (Semi-Annual Enterprise Channel 2302)Only Content contains sensitive information types (SITs) and Content is shared from Microsoft 365
Classic Outlook for online E5 users with connected experiences on, 2303 or later (Semi-Annual Enterprise Channel 2302 or later)Also sensitivity labels, sender and recipient conditions, subject words, "isn't labeled", file extension, exact data match SITs and trainable classifiers
Perpetual (non-subscription) OutlookOnly SITs and Content is shared from Microsoft 365
Outlook on the web and new Outlook for WindowsTen common conditions: content shared, SITs, sensitivity label, subject or body words, sender is / member of / domain, recipient is / member of / domain
Outlook for iOS, Android and macOSTip UI is off until you enable it
  • Old Outlook builds. Microsoft's matrix lists classic Outlook version 2105 (build 14026.20000), or 2102 (build 13801.20862) on Semi-Annual Enterprise Channel, as the baseline for tips.
  • Licensing. For the E5-level tip support in classic Outlook, users without Microsoft 365 E5 need a license that includes the Information Protection for Office 365 - Premium service plan.
  • Scoping by non-mail-enabled security groups. Classic Outlook shows no tips for those policies, although the actions are still enforced.
  • The tip is switched off. The rule has no policy tip, or the policy runs in simulation without notifications (TestWithoutNotifications).
  • Another rule wins. Only the tip from the most restrictive, highest-priority matching rule is shown, and that includes policies in simulation.

+3 more causes in the full article.

Checklist

  1. 1

    Prove the policy side first

    powershell
    Connect-IPPSSession
Get-DlpCompliancePolicy -Identity "DLP - Customer data" -DistributionDetail | Format-List Name,Mode,DistributionStatus
Get-DlpComplianceRule -Policy "DLP - Customer data" | Format-List Name,Priority,NotifyUser,NotifyPolicyTipCustomText,NotifyAllowOverride,BlockAccess

    Mode should be Enable or TestWithNotifications, distribution should be Success (if not, see policy distribution errors), and the rule must have user notifications with policy tips. The mailbox must be in Exchange Online.

  2. 2

    Match the client to the conditions

    Check the build under File › Office Account › About Outlook and the user's license. If the rule uses labels, sender or recipient conditions for an E3 user, the action applies but no tip appears.

  3. 3

    Fix the scope

    Replace non-mail-enabled security groups in the Exchange location with mail-enabled security groups or distribution groups, and make sure the sender is in scope: Exchange scoping is effectively sender-based (see designing DLP policies).

  4. 4

    Turn on tips for mobile and Mac

    In the Microsoft 365 Apps admin center, under Customization › Policy Management, create a policy that sets Enable Purview Data Loss Prevention (DLP) policy tips in Outlook to enabled, targeted at a pilot group first.

  5. 5

    Make overrides appear

    An override option needs a rule that blocks (BlockAccess set to true, with a scope) and allows overrides; otherwise the tip appears without one. In Outlook on the web, the policy must also be turned on, not in simulation.

  6. 6

    Remove leftover Exchange tips

    If old Exchange DLP policies or mail flow rules with policy tips still exist in the Exchange admin center, retire them so Purview tips can take over.

Verify

  • Sign in as a pilot user on a supported build, start a message to an external test address and paste dummy data that matches the rule. The tip should appear above the recipients after a short delay.
  • Repeat in Outlook on the web. Tips in the web but not in classic Outlook point to build, license or conditions; no tips anywhere point to the policy.
  • If overrides are allowed, choose Show Details › Override, enter a justification or report a false positive, and send.
  • Check that the match and the override reach DLP reports and activity explorer (see investigating DLP alerts).

Prevent it next time

  • Keep warning rules within the ten conditions every Outlook client supports, and use mail-enabled groups for scoping.
  • Custom tip text is plain text with a 256-character limit; say what to do, not just what's wrong.
  • For E5 users on classic Outlook who get the oversharing dialog, the dlpwaitonsendtimeout registry value (Wait on send) holds a message for a set time after Send so evaluation can finish.
  • When the tip isn't the issue but the block is, see email blocked by Purview DLP.

Microsoft Learn references