Unable to select Encryption method for DLP policy
Mitch Silberstein
40
Reputation points
I am editing a DLP policy in Purview. I cannot change the encryption option by clicking on the dropdown menu - it is greyed out. If I create a new policy, I cannot select an encryption method at all. I have the Compliance Administrator role activated.
Things I have tried:
- Refreshing my screen
- Using an in private window
- Deleting the rule and readding
- Checking to make sure the Rights Management service (RMS) is activated
Microsoft Security | Microsoft Purview
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 8%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EST%3C/text%3E%3C/svg%3E)
Smaran Thoomu 29,335 Reputation points Microsoft External Staff Moderator2025-08-25T20:49:01.79+00:00 Hi Mitch Silberstein
Thanks for sharing the details and what you have already tried. The behavior you’re seeing is expected in certain cases:- Some rule types in DLP don’t allow encryption, only actions like audit or block.
- To use encryption, your account needs the right license (Microsoft 365 E5, or E3 with the Information Protection add-on). Even if RMS is active, the option won’t appear without this license.
- The Compliance Administrator role by itself isn’t enough. You’ll also need either the Information Protection Administrator or Security Administrator role.
What you can do:
- Make sure you’re creating or editing a rule type that supports encryption.
- Check that your account has the right license assigned.
- If those are set, try creating a sensitivity label with encryption enabled and then use that label in your DLP policy.
That should enable the dropdown.
I hope this information helps. Please do let us know if you have any further queries.Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 47%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAM%3C/text%3E%3C/svg%3E)
Abhisek Mishra 85 Reputation points Microsoft External Staff Moderator2025-08-28T03:55:14.5766667+00:00 Hello @Mitch Silberstein ,
I hope you had a chance to review the earlier response. If it addressed your query, please do let us know. -
Mitch Silberstein 40 Reputation points
2025-08-28T20:48:41.81+00:00 Do you have documentation/links to support your answers?
- Some rule types in DLP don’t allow encryption, only actions like audit or block.
- The DLP rules are not setup to block, otherwise I wouldn't have that encryption option. Plus, you can still setup a policy in simulation mode (audit) with encryption settings set they just wouldn't apply.
- To use encryption, your account needs the right license (Microsoft 365 E5, or E3 with the Information Protection add-on). Even if RMS is active, the option won’t appear without this license.
- My account has the proper licensing and RMS is enabled.
- The Compliance Administrator role by itself isn’t enough. You’ll also need either the Information Protection Administrator or Security Administrator role.
- I've never had issues with the Compliance Administrator role. Do you have documentation that supports this claim?
- Some rule types in DLP don’t allow encryption, only actions like audit or block.
Sign in to comment
Sign in to answer