DLP Exceptions issues

Hi,

We are trying to setup a DLP Policy that does the following:

- If an email contains more than 10 credit card numbers and is being sent to an external email address, notify the DLPAdmin user, except if the source of the email is "customerservice@ourcompany.com".

@ourcompany.com is our Azure Tenant (in this example).

So, we have created a new DLP Policy, as follows:

• choose locations to apply the policy: Exchange email (all included, none excluded). No other Location is selected

Customized DLP Rule:

• Sensitive info type: Credit Card Number (High Confidence 10 to Any) AND
• Content is shared from M365 "with people outside my organization"
• Except if sender is: "customerservice@ourcompany.com"
• User notification on: notify these people / send the email to these additional people: DLPAdmin@ourcompany.com

Turn the Policy on right away.

------------

IMHO the above should work...however, DLPAdmin@ourcompany.com always gets notified when the customerservice@ourcompany.com account send an email externally (and contains 10 or more credit cards). I thought the idea of the 'exceptions' was for the DLP rule to work, except when the exclusion = true.

What are we doing wrong?

Thank you,

SK