DLP rules for External File Share notification

Vishnu Anand 250

I have configured a DLP rule to identify external file sharing from OneDrive and SharePoint. It is generating many emails, which is fine, but it does not show details like the domain or email ID where the file was shared in the file activity section. Is there a better way to configure it and get enough details to ensure our data is protected? User's image

Ganesh Gurram 4,965 Reputation points Microsoft External Staff

2025-03-12T09:27:48.83+00:00
Hi @Vishnu Anand

To enhance the visibility of external file-sharing activities in your Microsoft Purview Data Loss Prevention (DLP) policies, you can configure detailed notifications and utilize policy tips. This approach ensures that both administrators and users are informed about sharing actions, including details about recipients and domains.

Here's how you can achieve this:

Set up your DLP policies to send detailed email notifications when a sharing event matches the policy conditions:

Access the Microsoft Purview Compliance Portal - Navigate to the Microsoft Purview Compliance Portal.

Modify or Create a DLP Policy - Go to Data Loss Prevention > Policies. Select an existing policy to edit or create a new one.

Set Up Notifications:

Within the policy settings, locate the User notifications section.

Enable Send an email notification to the user who sent, shared, or last modified the content.

Customize the notification message to include relevant details.

For more information on configuring email notifications, refer to Microsoft's documentation:

https://learn.microsoft.com/en-us/purview/dlp-use-notifications-and-policy-tips

Policy tips provide real-time feedback to users attempting to share sensitive information:

Enable Policy Tips - In the DLP policy settings, navigate to the User notifications section. Enable Show policy tips to users and send them an email notification.

Customize Policy Tips - Tailor the policy tip message to inform users about the potential risks of sharing the content externally and provide guidance on appropriate actions.

Detailed guidance on setting up policy tips can be found here:

https://learn.microsoft.com/en-us/purview/dlp-microsoft-teams?tabs=purview#prevent-external-access-to-sensitive-documents

To gain insights into sharing activities:

Access Activity Explorer - Navigate to Microsoft Purview Compliance Portal > Data Classification > Activity Explorer.

Filter Activities - Use filters to view activities related to external sharing, which can help identify patterns and potential policy adjustments.

By implementing these configurations, you can enhance the monitoring and management of external file-sharing activities within your organization, ensuring that sensitive data remains protected.

Hope this helps. Do let us know if you have any further queries.

Share via

DLP rules for External File Share notification

Your answer