Hey everyone! I'm encountering some weird behavior with our Data Loss Prevention (DLP) policy that displays tips when users enter Social Security Numbers (SSNs) in their emails. We've set it up so that it should trigger a warning, but here's the twist:
- User A sees the policy tip in Outlook Classic but not in the New Outlook or Outlook Web App (OWA).
- User B, on the other hand, sees the tip in both Outlook Classic and the New Outlook.
Both users belong to the same group where the policy applies, and they used the same SSN for testing. I'm a bit puzzled here—could it be that they're applying different policies somehow? Where should I start looking to troubleshoot this? Any tips would be appreciated!
1 Answer
My first suggestion would be to check the activity explorer—it can show you what actions are triggering the policy tips. That might give you some insight into why User A and User B are experiencing different behaviors with the policy.
Thanks for the tip! I didn't find any logs for Exchange, but I came across some for OneDrive and Teams where I also tested SSNs. Just to clarify, if an email is never sent, should I expect to see any activity logs? And how can I figure out why the DLP rule was triggered in Outlook?