May 10 2021 05:42 PM
Microsoft documentation states DLP does not send email alerts for existing content and are only generated for new content.
Does anyone know the criteria used to determine what's existing content and what's new? Is it something similar to all documents last modified prior to DLP policy going live are existing? E.g., if a document XYZ.docx was modified at 10/05/2021 11am and DLP policy was published at 10/05/2021 11:30am then would an email alert be generated for this document.
We are planning on implementing a DLP policy to BLOCK external sharing of all documents labelled as 'Top Secret'. We don't want the DLP policy to bombard our users with email notifications for existing confidential data stored in SharePoint and OneDrive.
May 29 2021 11:45 PM