Forum Discussion
maxdj2k
Nov 07, 2023Copper Contributor
What happens when a Policy Tip in Microsoft Data Loss Prevention is reported?
I'm creating documentation to explain the functions of policy tips, and I cannot find documentation for what happens when a Policy Tip is reported in Microsoft's Data Loss Prevention features. I've clicked on "Report" but nothing happens on my side. My only guesses are that 1. The reports go to the administrator that created the policy for evaluation and remediation, or 2. The report is sent to Microsoft for analysis like in MS Defender for 365.
- vicwingsingIron Contributor
When you say a policy tip is reported to the Microsoft DLP, do you mean that you want the policy tip to reflect as part of DLP alerts? If this is the case, you won't see the Policy tip in the DLP alerts but rather it would show the policy that contains the Policy tip.
Are you perhaps looking for the Email Notification? Because for email notification, there is an option to use the function "Send the email to these additional people:"
Policy tips are just text that appears on Office apps if the Office detects that it will hit a DLP Policy.
- maxdj2kCopper ContributorWithin the screenshot I provided, there is a Report button that allows you to report a Policy Tip if you believe it is applied incorrectly to a document. I'm trying to find out what happens after reporting a false positive policy tip so I can include the results of the report in my documentation. There isn't any MS documentation that explains specifically what reporting a false positive does. Whether there is record of reported false positives that the admin can view and remediate, or it gets sent to Microsoft for review and I don't see it again.
- maxdj2kCopper ContributorUpdate: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/overrides-and-false-positives-in-dlp-policy-end-user-experience/m-p/202790 This is what I found that relates to my question.