Windows Servers not generating alerts in MS Purview portal.

Haris Rafiq 25

Dear All,

I hope everyone is doing good.

I'm facing issue with generating alerts for Windows servers in Microsoft purview. I have configured multiple policy in my organization such as upload to cloud, File Sharing platform etc. I have added the test servers, and I can see them in Microsoft Purview portal which shows configuration and policies sync complete but when to generate the alerts for different policies from the server I'm not getting any alert.

Even I have turned on the Endpoint DLP support for onboarded servers.

Account which I have been connecting to the server has full permissions. Also, the test server is windows server 2019.

Can you please suggest me how to fix it and what can be the steps which can help me to generate the alerts.

Regards,

Haris Rafiq

phemanth 12,575 Reputation points Microsoft Vendor

2024-12-13T19:08:45.1466667+00:00
@Haris Rafiq

Thanks for the question and using MS Q&A platform.

Seems like you’re having trouble with generating alerts in Microsoft Purview. Here are a steps to resolve the issue:

Verify DLP Policy Settings: Ensure that the Data Loss Prevention (DLP) policies are correctly configured and aligned with your intended settings.

Check Alert Configuration: Confirm that the alert settings are properly set up to trigger notifications for the specified policies.

Review Event and Diagnostic Logs: Look into the event logs and diagnostic logs on the servers to identify any related incidents or errors.

Recreate the Policy: Sometimes, recreating the policy from scratch can help resolve configuration issues.

Update and Patch: Ensure that your Windows Server 2019 and Microsoft Purview are up to date with the latest patches and updates. Sometimes, updates can resolve underlying issues.

Endpoint DLP Support: Double-check that Endpoint DLP support is fully enabled and correctly configured for the onboarded servers.

I hope the above steps will resolve the issue, please do let us know if issue persists. Thank you
phemanth 12,575 Reputation points Microsoft Vendor

2024-12-16T19:45:36.54+00:00
@Haris Rafiq Anim

Thanks for the information.

Additional steps you want to take to ensure that DLP is fully enabled and functioning correctly:

DLP Policy Status: Verify the status of your DLP policies in the Microsoft Purview portal. Ensure that they are active and not in a draft or inactive state.

Policy Application: Confirm that the DLP policies are correctly applied to the specific Windows servers. Sometimes, policies might not be applied uniformly across all devices.

Endpoint DLP Configuration: Double-check the Endpoint DLP settings. Ensure that the Endpoint DLP is enabled for the specific Windows servers and that the necessary agents or configurations are in place.

Policy Testing: Perform specific tests to trigger the DLP policies on the Windows servers. For example, try uploading a sensitive file to a cloud service or sharing it via a file-sharing platform to see if the alerts are generated.

Permissions and Access: Ensure that the account used to manage and monitor the DLP policies has the necessary permissions to access and generate alerts for the Windows servers.

Network and Connectivity: Verify that there are no network or connectivity issues that might be preventing the alerts from being generated or sent from the Windows servers.

I hope the above steps will resolve the issue, please do let us know if issue persists. Thank you
phemanth 12,575 Reputation points Microsoft Vendor

2024-12-17T18:47:23.02+00:00
@Haris Rafiq

I'm glad to hear that your policies are working on Windows and macOS devices. the prerequisites for a server to generate alerts in Microsoft Purview:

Ensure that Endpoint DLP is enabled for your Windows Server 2019. This can be done through the Microsoft Purview compliance portal by navigating to Data loss prevention > Endpoint settings1.

Verify that the DLP policies are correctly configured and applied to the servers. This includes setting up the conditions that trigger alerts and ensuring the policies are active.

Make sure the account used to configure and monitor the policies has the necessary permissions. This includes roles like Security Reader or Compliance Administrator in Microsoft Entra ID.

Enable advanced classification scanning and protection to allow the Microsoft Purview cloud-based data classification service to scan items and classify them.

Regularly review event logs and diagnostic logs on the servers to identify any related incidents or errors that might prevent alerts from being generated.

Ensure that Microsoft Defender is updated to version 4.18.23100 (October 2023) or later, as this is necessary for Endpoint DLP to function correctly on Windows Server 2019.

Use the Activity Explorer in the Microsoft Purview compliance portal to monitor Endpoint DLP events and verify if the DLP policies are being applied.

please refer:

: https://learn.microsoft.com/en-us/purview/alert-policies

:Microsoft 365 alert policies | Microsoft Learn

2 answers

Haris Rafiq 25 Reputation points

2024-12-16T04:24:36.38+00:00

Dear Phemanth,

Thank you so much for the answer you have provided.

I would like to mention that all the policy are configured properly, and they are working fine for Windows and MacOS devices.

Could you please suggest me if there is any other way to check it. I can try to event logs and diagnostic logs on the server. But is there anything else we can check from DLP side if that is enabled or not.

Regards,

Haris Rafiq
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Haris Rafiq 25 Reputation points

2024-12-17T04:38:17.03+00:00

Dear Phemanth,

I hope you're doing well.

Thank you so much for your response, But all the policies are turned on and working on Windows and MacOS devices.
Could you please help me with perquisites for a server to generate an alert. If you can help me with that It will be great help.

Regards,

Haris Rafiq
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Windows Servers not generating alerts in MS Purview portal.

2 answers

Your answer