Forum Discussion

Raechel Moermond's avatar
Raechel Moermond
Copper Contributor
Sep 14, 2018

Release email from quarantine blocked by DLP

I have a customer that is considering replacing a third party spam filter with EOP.  Currently, if an email is blocked due to DLP policies, an admin can log into the admin center, review the message, and release it if it was a false positive, allowing the message to be delivered to the intended recipient.  Is this possible with O365?  I know I can block emails for DLP policies, I know that admins can be notified that an email was blocked due to DLP policies, but I don't know that an admin can then release that message if it is, indeed, a false positive.

admin
compliance
office 365
security

5 Replies

  • VasilMichev's avatar
    VasilMichev
    MVP
    Sep 14, 2018

    There is no quarantine for DLP-flagged messages. You can however allow users to override the block action.

    • Giulian Garruba's avatar
      Giulian Garruba
      Former Employee
      Sep 14, 2018

      Vasil is correct, no quarantine. There are a couple of options for alerts and actions, which can be found here.

      • Raechel Moermond's avatar
        Raechel Moermond
        Copper Contributor
        Sep 17, 2018
        So, a blocked message cannot be released by an admin. It can only be overridden by a user. Defeats the purpose of the DLP to prevent users from sending out protected information maliciously if they can override the DLP. Might be a feature Microsoft should consider.

Resources