Sep 14 2018 10:53 AM
I have a customer that is considering replacing a third party spam filter with EOP. Currently, if an email is blocked due to DLP policies, an admin can log into the admin center, review the message, and release it if it was a false positive, allowing the message to be delivered to the intended recipient. Is this possible with O365? I know I can block emails for DLP policies, I know that admins can be notified that an email was blocked due to DLP policies, but I don't know that an admin can then release that message if it is, indeed, a false positive.
Sep 14 2018 12:41 PM
There is no quarantine for DLP-flagged messages. You can however allow users to override the block action.
Sep 14 2018 01:26 PM
Vasil is correct, no quarantine. There are a couple of options for alerts and actions, which can be found here.
Sep 17 2018 03:17 AM
Sep 17 2018 12:14 PM
Overriding is an *optional* feature you as the admin can enable.
Aug 12 2020 11:51 PM