DLP Policy not generating alerts

Question

DLP Policy not generating alerts

Ben Lewis 0

I created a DLP policy to force encrypt emails containing specific information (credit card #, SSN etc.). I based it on the Gramm-Leach-Billy Act template but added a couple additional Sensitive info types (US Passport and Drivers License #). Policy is in simulation mode with notifications. I have sent mock data via email that would match the policy but get absolutely zero alerts. It's almost like something is not turned on or enabled but I don't know what. Another odd thing is that from the DLP Overview page under Policy status it has a "No Policies created yet" but I quite clearly have two policies created. One enabled and the other off. We are a M365 Business Premium customer so should have DLP. Any ideas on what I'm missing?

1 answer

Your answer

Answer 1

Venkat Reddy Navari 5,810 Microsoft External Staff Moderator

Hi Ben Lewis Since your policy is still in simulation mode, it won’t trigger any real actions or alert that’s expected. But you should still see policy matches in Content Explorer. If nothing shows up there, it might be that your test content isn’t hitting the match thresholds especially with sensitive info types like US Passport or Driver’s License, which can require multiple instances or higher confidence levels.

That "No Policies created yet" message is often just a UI issue or location filter mismatch. Try refreshing or checking under the correct workload (Exchange, SharePoint, etc.).

Also, make sure audit logging is enabled, and if you're expecting email notifications, you’ll need to create a separate alert policy in Microsoft Defender, since DLP policies don’t trigger alerts by default.

Lastly, M365 Business Premium does support core DLP features across Exchange, SharePoint, OneDrive, and Teams.
You can refer to this Microsoft doc for a clear breakdown of what’s included: Microsoft 365 Business Premium – Compliance Capabilities

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Ben Lewis 0 Reputation points

2025-08-15T15:45:46.5466667+00:00

Thanks for the pointers. As far as Content Explorer is concerned, I just get a message that I need to upgrade my license to use it :-( I have changed my policy to active (as I have a very small test group that it applies to) and dropped confidence levels and number of instances. So, far, still no alerts and emails containing sensitive info are NOT being encrypted. Within my DLP rule, I did enable email alerts but went ahead and created an alert policy in Defender. Not sure what you mean about making sure audit logging is enabled or where that's located. I'll keep you posted as I just made those changes today and it may take awhile for them to go into effect.
Venkat Reddy Navari 5,810 Reputation points Microsoft External Staff Moderator

2025-08-18T11:31:55.6133333+00:00
Ben Lewis Thanks for the update, sounds like you're narrowing it down step by step.

The Content Explorer message confirms you're hitting a licensing limitation that feature needs Microsoft 365 E5 Compliance or an equivalent add-on, so no worries there.

Good call on switching the policy to active and lowering the match thresholds. Just keep in mind that even in enforce mode, encryption actions in Exchange DLP can sometimes take a bit of time to apply, and in rare cases, may require transport rule support behind the scenes.

On audit logging that’s a one-time switch you can check in the Microsoft Purview compliance portal. Here’s how:

Go to compliance.microsoft.com

Under Solutions, select Audit

If audit logging isn’t already turned on, you’ll see a banner to enable it. Just follow the prompt.

This ensures DLP activity (like matches and actions) gets captured across Microsoft 365 and is visible for alerting and investigation.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Ben Lewis 0 Reputation points

2025-08-19T13:43:39.8266667+00:00

Confirmed that audit logging is on. I did stumble across something that I found odd as I still have had zero luck triggering an alert or action based upon my DLP rule. In the Purview portal under settings->account the account type shows as Free. If I click the Upgrade account I get a message that "Your current access does not include permissions to view any subscriptions." I would think this would have been set up by our vendor that we purchased our 365 Business Premium licenses from correct? Or is this normal and not the cause of my DLP rules not working? Thanks again!

Purview.png

Purview2.png
Venkat Reddy Navari 5,810 Reputation points Microsoft External Staff Moderator

2025-08-22T10:36:40.2066667+00:00

Ben Lewis The “Free” account type you see in Purview is normal that relates to optional pay-as-you-go add-on features and doesn’t impact the core DLP capabilities you get with Business Premium. So that’s not the reason your policy isn’t working.

Since audit logging is already on, I’d focus on confirming the policy is scoped to Exchange email, testing with a simple known pattern (like a plain 16-digit credit card number), and giving the policy some time to propagate. If it still doesn’t trigger after that, it may be a backend sync issue worth opening a support case for.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

DLP Policy not generating alerts

1 answer

Your answer