Forum Discussion
DLP Alert Received, but no report.
Hi,
I have received the following alert, but I am unable to locate the report in Compliance Centre. Can anyone give me guidance on where to look specifically? I only have default policies applied, but would like to look into this alert in more detail to understand what is happening and check it's legitimate.
Many thanks, Pete
A match of one or more of your organization’s policy rules has been detected.
Report Id: xxxxxxx-0906-4c2e-887b-85cd0e68e117
Person who last modified document:
Severity: High
False positive: No
Override: No
Condition matched: External recipients
Condition matched: Contains sensitive information
2 Replies
I have the same issue over 4 years later. I searched Defender, Purview, Exchange, etc. for the responsible policy. Thank you for posting your solution. I agree, it's an inconvenient way to report a rule violation. Microsoft has all the information - give me a link to the offending email.
I had to run message message trace between that period and found postmaster@domain.com sending alert to user who send the emails . Its the same postmaster email which send report. Its lame way to find.
Other methods are audit logs search and ediscovery - didnt try though.
