How to fix a Purview Data Loss Prevention Solution Which Tracks PII Data When Emailing Outside Organization with Acknowledgement and Policy Tips

DoveLamb 0 Reputation points
2026-09-10T22:43:10.4833333+00:00

Having challenges designing a Purview Data Loss Prevention solution which tracks PII Data (ex: SSN) when end-users are emailing outside organization. Rule setup includes 'test' SSN and action user notification 'Policy Tip' and user override to 'acknowledge' before sending. Performed several tests in Outlook Web and no policy tip or acknowledgement appears. Are there additional settings to look for in Outlook Web as it is the latest version. Thanks for your response.

Microsoft Security | Microsoft Purview
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-10T22:43:28.05+00:00

    For Outlook on the web, there are no extra MailTips client settings to enable like there are for Outlook desktop. Focus on the DLP policy configuration and where policy tips are configured.

    Check these items in order:

    1. Configure policy tips in only one place If policy tips were configured in the Exchange admin center, tips configured in the Purview portal won’t appear in Outlook on the web until the Exchange admin center tips are turned off. Email notifications can still be sent, but policy tips in OWA draw from only a single location.
    2. Verify the policy isn’t still in test mode A policy configuration error can occur when user notifications are configured but the policy status doesn’t match the rule settings, such as the policy being turned on while the status shows Test it out first. Make sure the policy is actually enabled as intended.
    3. Simplify overlapping rules If two or more rules detect the same sensitive data type with the same instance count and confidence level, policy tip behavior can be problematic. Use only one rule for the same sensitive data type and detection parameters.
    4. Confirm the rule uses supported conditions Outlook on the web supports policy tips, but unsupported rule designs can prevent the expected experience. If the rule was built with conditions or exceptions that aren’t supported for Outlook policy tips, the tip may not appear.
    5. If the policy came from Exchange Online, migrate it For DLP policies created in Exchange Online, unexpected results can occur, including no display of policy tips. Migrating those policies to the Microsoft Purview compliance portal is recommended.
    6. Run the built-in diagnostic In the Microsoft 365 admin center, run the automated diagnostic for DLP policy tips. It checks the DLP policy and rule configuration, identifies issues, and suggests resolutions. The diagnostic requires a Microsoft 365 global administrator and asks for:
      • User principal name or email address
      • DLP rule name or GUID
      • Outlook or OWA
    7. Check for rule/content limitations Policy tips aren’t generated if the sensitivity label is in a compressed file, and DLP can have difficulty generating policy tips for encrypted files.
    8. Validate expected OWA behavior Outlook on the web does support DLP policy tips. If the rule action sends a notification and allows override, the default policy tip text for email is that the email conflicts with a policy in the organization.

    If testing is specifically with SSN content and no tip appears in OWA, the highest-value checks are:

    • ensure policy tips are not also configured in Exchange admin center
    • ensure the policy is not effectively still in Test it out first
    • remove duplicate SSN detection rules
    • run the DLP policy tips diagnostic against OWA
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.