Forum Discussion
Overrides and false positives in DLP policy end user experience
- No I'm not able to; I don't think you can.
If someone does put down it's a false positive and it's not, I usually go and speak to the individual or email them. There's no way that I know of to reclassify it.
I also have alerts turned on to me when people do it so when I get the email, it shows the override reason and false positive answers. If anyone puts anything that we don't agree with as being an acceptable answer, then we raise this with them/their line manager.
Should be in the DLP reports as detailed here: https://support.office.com/en-us/article/view-the-reports-for-data-loss-prevention-41eb4324-c513-4fa5-91c8-8fbd8aaba83b
Are you saying you don't see the events, or the DLP reports altogether?
Found it ( I think) - im missing DLP Insights. I have the DLP report but I'm not seeing the warning triangles / insight icon.
The insights are fairly new addition, I don't have them in my tenant either.
VasilMichevdo you know if there was an announcement about this new feature? I don't remember seeing one.
Maybe I'm looking at the wrong thing? This isn't a new feature.
I get a policy tip for a DLP rule
I have the option to "report" my content as a false positive
where the dickens does that report button end up?
I am expecting if there's a report button that somewhere I can go as a sec admin, view that report and either dismiss it and reply to the data owner or opt to reclassify and allow sharing.
There seems no information anywhere about this and no one at Microsoft seems to have a clue about it from what I can see.
If you have a report button then it must go somewhere or why have the button?
