SOLVED

Change the sender address for DLP notifications

%3CLINGO-SUB%20id%3D%22lingo-sub-632329%22%20slang%3D%22en-US%22%3ERe%3A%20Change%20the%20sender%20address%20for%20DLP%20notifications%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-632329%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20notifications%20should%20be%20coming%20from%26nbsp%3B%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3EOffice365Alerts%40microsoft.com%3C%2FFONT%3E.%20There's%20another%20set%20of%20DLP-related%20email%20that%20will%20be%20generated%20from%20the%20%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3Epostmaster%40yourdomain.com%20address%20-%20are%20those%20the%20ones%20you%20are%20referring%20to%3F%20Once%20you%20have%20removed%20the%20postmaster%20alias%2C%20they%20should%20be%20displayed%20as%20%22Microsoft%20Exchange%22%20or%20similar.%20Make%20sure%20you%20update%20your%20OAB%20and%20clear%20any%20contacts%2Fcached%20info.%3C%2FFONT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-638228%22%20slang%3D%22en-US%22%3ERe%3A%20Change%20the%20sender%20address%20for%20DLP%20notifications%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-638228%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%20-%20Thank%20you%20for%20the%20response.%26nbsp%3B%20It%20was%20a%20DLP%20notification%20and%20a%20consultant%20had%20postmaster%40%20aliased%20to%20their%20account%20in%20our%20tenant.%26nbsp%3B%20This%20is%20now%20fixed%20and%20we%20have%20customized%20our%20mail%20tip%20and%20email%20to%20end%20user%20for%20the%20sharing%20of%20sensitive%20info%20(PII)%20via%20email.%26nbsp%3B%20We%20also%20have%20all%20alerts%20going%20to%20a%20Teams%20channel%20rather%20than%20to%20all%20tenant%20admins.%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20saved%20me%20a%20TON%20of%20time%20giving%20me%20these%20directions.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-629147%22%20slang%3D%22en-US%22%3EChange%20the%20sender%20address%20for%20DLP%20notifications%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-629147%22%20slang%3D%22en-US%22%3E%3CP%3EOur%20DLP%20email%20messages%20that%20go%20back%20to%20the%20user%2Fsender%26nbsp%3B%20with%20our%20policy%20for%20sensitive%20information%20are%20using%20a%20sender%20address%20that%20we%20do%20not%20want%20used.%20%26nbsp%3B%20I%20cannot%20seem%20to%20find%20where%20to%20change%20the%20sender%20email%20address.%26nbsp%3B%20The%20current%20address%20used%20was%20listed%20in%20our%20tenant%20Organization%20Technical%20contact%20field%20but%20I%20changed%20it%20there%20and%20it%20still%20has%20not%20changed%20the%20SENDER%20address%20of%20the%20notification.%26nbsp%3B%20HELP%20PLEASE%3C%2FP%3E%3CDIV%20class%3D%22section-description%22%3E%3CSPAN%3EUse%20Notifications%20to%20inform%20your%20users%20and%20help%20educate%20them%20on%20the%20proper%20use%20of%20sensitive%20info.%3C%2FSPAN%3E%3CDIV%3E%3CSPAN%3EPlease%20note%3A%20Notifications%20for%20teams%20will%20be%20displayed%20in%20the%20chat%20client%20itself.%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22section-content%22%3E%3CDIV%20class%3D%22leftFloat%22%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%3CSPAN%20class%3D%22paddingLeft10%20ng-binding%22%3EOn%3C%2FSPAN%3E%3C%2FP%3E%3CDIV%20class%3D%22user-notification-details%22%3E%3CDIV%20class%3D%22dlpPolicyWizard%20ng-scope%22%3E%3CDIV%3E%3CH5%20id%3D%22toc-hId-1171673494%22%20id%3D%22toc-hId-1171673492%22%3EEmail%20notifications%3C%2FH5%3E%3CSPAN%20class%3D%22labelText%20ng-binding%22%3ENotify%20the%20user%20who%20sent%2C%20shared%2C%20or%20last%20modified%20the%20content.%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22labelText%20ng-binding%22%3ENotify%20these%20people%3A%3C%2FSPAN%3E%3CDIV%20class%3D%22marginLeft30%22%3E%3CSPAN%20class%3D%22checkboxOption%20ng-binding%22%3EThe%20person%20who%20sent%2C%20shared%2C%20or%20modified%20the%20content%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22checkboxOption%20ng-binding%22%3EOwner%20of%20the%20SharePoint%20site%20or%20OneDrive%20account%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22checkboxOption%20ng-binding%22%3EOwner%20of%20the%20SharePoint%20or%20OneDrive%20content%3C%2FSPAN%3E%3CDIV%20class%3D%22marginTop20%22%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22marginTop20%22%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-629147%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EData%20Loss%20Prevention%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Frequent Contributor

Our DLP email messages that go back to the user/sender  with our policy for sensitive information are using a sender address that we do not want used.   I cannot seem to find where to change the sender email address.  The current address used was listed in our tenant Organization Technical contact field but I changed it there and it still has not changed the SENDER address of the notification.  HELP PLEASE

Use Notifications to inform your users and help educate them on the proper use of sensitive info.
Please note: Notifications for teams will be displayed in the chat client itself.
 

On

Email notifications
Notify the user who sent, shared, or last modified the content. Notify these people:
The person who sent, shared, or modified the content Owner of the SharePoint site or OneDrive account Owner of the SharePoint or OneDrive content
 
 
2 Replies
best response confirmed by Christine Stack (Frequent Contributor)
Solution

The notifications should be coming from Office365Alerts@microsoft.com. There's another set of DLP-related email that will be generated from the postmaster@yourdomain.com address - are those the ones you are referring to? Once you have removed the postmaster alias, they should be displayed as "Microsoft Exchange" or similar. Make sure you update your OAB and clear any contacts/cached info.

@Vasil Michev  - Thank you for the response.  It was a DLP notification and a consultant had postmaster@ aliased to their account in our tenant.  This is now fixed and we have customized our mail tip and email to end user for the sharing of sensitive info (PII) via email.  We also have all alerts going to a Teams channel rather than to all tenant admins.  

 

You saved me a TON of time giving me these directions.

 

Thank you.