DLP incident report trigger

%3CLINGO-SUB%20id%3D%22lingo-sub-2704838%22%20slang%3D%22en-US%22%3EDLP%20incident%20report%20trigger%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2704838%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20team%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDoes%20anyone%20know%20if%20making%20changes%20to%20a%20DLP%20rule%20will%20trigger%20already%20received%20incident%20report%20notifications%20to%20admins%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20making%20changes%20on%20a%20DLP%20rule%20but%20we%20notice%20we%20are%20getting%20already%20received%20incident%20reports%20emails.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2704838%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Frequent Visitor

Hi team,

 

Does anyone know if making changes to a DLP rule will trigger already received incident report notifications to admins?

 

We are making changes on a DLP rule but we notice we are getting already received incident reports emails.

1 Reply
Depends. It will likely trigger it for any files stored in SPO/ODFB that violate the policy, because of the way DLP works there. For items in Exchange, it will not.