AzureFeeds

Feature Support and Compatibility

Q: Which Outlook clients support DLP Policy Tips?

A: DLP policy tips are supported across several Outlook clients, but the experience and capabilities vary depending on the end user’s client version and the Microsoft 365 license (E3 vs. E5). For detailed guidance on policy tip support across Microsoft apps, read more here.

Below is a breakdown of policy tip support across Outlook clients:

Figure 1: Breakdown of policy tip support across Outlook clients

Glossary:

• Basic Policy Tip Support: Display of simple warnings or notifications based on DLP rules.


• Top 10 Predicates: Most commonly used conditions in DLP rules.
  
  
  
  1. Content is shared from M365
  
  
  2. Content contains SITs
  
  
  3. Content contains sensitivity label
  
  
  4. Subject or Body contains words or phrases
  
  
  5. Sender is
  
  
  6. Sender is a member of
  
  
  7. Sender domain is
  
  
  8. Recipient is
  
  
  9. Recipient domain is
  
  
  10. Recipient is a member of
  
  
  
  

• Default Oversharing Dialog: A built-in popup warning users about potential data oversharing.


• Custom Oversharing Dialog: A tailored version of the oversharing warning.


• Wait on Send: A delay mechanism that gives users time to review sensitive content before sending.


• Out-of-box SITs: Out-of-box sensitive information types (SITs), like SSNs or credit card numbers.


• Custom SITs: User-defined sensitive data patterns.


• Exact Data Match: Used for precise detection of structured sensitive data.

Important considerations:

• Client version matters: Even within the same client (e.g., Outlook Win32), the version must be recent enough to support the latest DLP features.


• Older builds may lack support for newer DLP features.


• Policy tip visibility: Policy tips may not appear if the DLP rule uses unsupported predicates or if the client is offline.


• Licensing: E5 licenses unlock advanced features like oversharing dialogs and support for custom sensitive information types (SITs).

Q: Why don’t Policy tips appear for some users or rules?

A: While the underlying DLP rules are always enforced, policy tips may not appear for some users due to several factors:

1. Outlook Client Version: Policy yips are only supported in specific versions of Outlook. For example, older builds of Outlook Win32 may not support the latest DLP capabilities. To ensure the Outlook client version you’re using supports the latest capabilities, read more.


2. Licensing: Users with E3 licenses may only see basic policy tips, and some features may not be available at all, while E5 licenses unlock advanced DLP capabilities such as the custom oversharing dialog. For more information on licensing, read more.


3. Unsupported Conditions or Predicates: If a DLP rule uses unsupported predicates, the policy tip will not be displayed even though the rule is enforced. To ensure compatibility, refer to our documentation for a list of supported conditions by client version.


4. Offline Mode: Policy tips rely on real-time evaluation of message content against Data Loss Prevention (DLP) rules by Microsoft 365 services. When a user is offline, their Outlook client cannot communicate with these services, which affects the visibility of policy tips.
   
   
   
   • What about offline E5 users?
     
     
     
     • Even if a user has an E5 license, which includes advanced DLP features, the client must be online to evaluate and display these advanced policy tips. While the message may still be blocked or logged according to the DLP rule, the user won’t see any tip or warning until they reconnect.
     
     
     
     
   
   
   
   

Q: Are trainable classifiers supported in policy tips?

A: Yes, but with specific limitations. Trainable classifiers are supported in DLP policy tips, but only under specific conditions related to licensing, client version, and connectivity:

• Licensing: The user must have a Microsoft 365 E5 license. Trainable classifiers are part of Microsoft Purview’s advanced classification capabilities, which are only available with E5 or equivalent add-ons.


• Client Support: Only certain Outlook clients support policy tips triggered by trainable classifiers. These include:
  
  
  
  1. Outlook Classic (Win32)
  
  
  2. New Outlook for Windows (Monarch)
  
  
  3. Other clients (such as Outlook Web App (OWA), Outlook for Mac, and Outlook Mobile) do not currently support this feature.
  
  
  
  

• Connectivity: The Outlook client must be online. Trainable classifiers rely on the Microsoft 365 Data Classification Service (DCS), which performs real-time content evaluation in the cloud. If the client is offline, policy tips based on trainable classifiers will not appear, even though the DLP rule may still be enforced when the message is sent.

Q: Is OCR supported in Policy Tips?

A: No, there is currently no support for OCR in policy tips. However, our goal is to support OCR in policy tips in the future.

Setup & Configuration

Q: What are the prerequisites for enabling DLP policy tips?

A: DLP policy tips notify users in real time when their actions may violate data protection policies. To enable and use them effectively, the following prerequisites must be met:

1. Licensing Considerations
   
   
   
   • Microsoft 365 E5 is required for full feature access, including real-time policy tips, trainable classifiers, and connected experiences.
   
   
   • Connected Experiences must be enabled in the tenant for real-time tips to appear.
   
   
   
   

 

2. Client Compatibility: DLP policy tips are supported across several Outlook clients, but the experience and capabilities vary depending on the client version, licensing, and configuration. Refer to the comprehensive compatibility matrix (provided at the beginning of this guide) to learn about policy tip support across Outlook clients.


3. Permissions
   
   
   
   • To configure and manage DLP policy tips in Microsoft Purview, specific roles and permissions are required. These permissions ensure that only authorized personnel can create, deploy, and monitor DLP policies and their associated tips.
   
   
   • Required Roles:
   
   
   
   

Q: How do I configure a custom policy tip message using JSON?

A: You can configure a custom policy tip dialog in DLP policies using a JSON file. This allows you to tailor the message shown to users when a policy is triggered, such as for oversharing or sensitive content detection.

JSON must follow the schema outlined in Microsoft’s documentation and internal engineering guidance.

Applies to:

• Microsoft 365 online E5 users with connected experience enabled.


• This feature is supported in Outlook Classic (Win32) and Monarch.


• JSON-based dialogs are not supported in Outlook on the Web (OWA), Mac, or Mobile clients.

Q: Can I localize policy tips for different languages?

A: Localization of DLP policy tips allows users to see messages in their preferred language, improving clarity and compliance across global teams. Microsoft Purview supports localization through JSON-based configuration, but support varies by client.

Supported clients:

• Outlook Classic (Win32)

How to configure:

• Use the LocalizationData block in your custom Policy Tip JSON.


• Example: 

Figure 2: Example of using LocalizationData block in your custom Policy Tip JSON

• Upload this JSON using PowerShell with the NotifyPolicyTipCustomDialog parameter.

Q: What roles and permissions are required to manage DLP policy tips?

A: To manage Data Loss Prevention (DLP) policies and policy tips in Microsoft Purview, you only need to be assigned one of the following roles. Each role provides different levels of access depending on your responsibilities.

Note:

• Microsoft recommends assigning the least privileged role necessary to perform the required tasks to enhance security.


• These roles are assigned in the Microsoft Purview portal under Roles and Scopes. Administrative Unit–scoped roles are also supported for organizations that segment access by department or geography.

Troubleshooting & Known Issues

Q: Why are policy tips delayed or not appearing at all?

A: If you’re not seeing policy tips, follow this checklist to find out why:

1. Outlook Client Compatibility and Licensing

• 
  
  
  
  • Check if your Outlook client supports policy tips. Policy tips are not supported on all Outlook clients. Refer to Q: Which Outlook clients support DLP Policy Tips?
  
  
  • Confirm your license. Advanced policy tips (e.g., those using trainable classifiers or oversharing dialogs) require a Microsoft 365 E5 license. Refer to Q: What are the prerequisites for enabling DLP Policy Tips?
  
  
  
  

2. Policy Configuration Issues

• 
  
  
  
  • Review your DLP policy configuration and check for unsupported conditions. Refer to Q: What predicates are supported across different Outlook clients?
  
  
  
  

3. Watch for message size limits

• 
  
  
  
  • Only the first 4 MB of the email body and subject, and 2 MB per attachment, are scanned for real-time tips.
  
  
  
  

4. Use Microsoft’s diagnostic tool

• 
  
  
  
  • Run a built-in diagnostic to test your DLP policy setup. Run the diagnostic.
  
  
  
  

Q: What logs or data should I collect for support escalation?

A: To ensure a smooth and complete escalation to Microsoft support or engineering, collect the following logs and metadata depending on the client type. This helps accelerate triage and resolution.

• Fiddler trace
  
  
  
  • Must include:
    
    
    
    • Timestamp of issue
    
    
    • Correlation ID (found as updateGuid in the DLP response)
    
    
    • Tenant ID
    
    
    • User ID / SMTP address
    
    
    • Tenant DLP Policies and Rules
    
    
    • Expected rule match conditions and Rule IDs
    
    
    • (Optional): Draft email or data input (sender, recipient, subject, message body)
    
    
    
    
  
  
  
  


• ETL logs from %temp%Outlook Logging


• PNR logs (Problem Steps Recorder or screenshots)


• Tenant ID


• Tenant DLP Policies and Rules


• Expected rule match conditions and Rule IDs

Q: Are there known limitations with policy tips?

1. Unable to detect sensitivity labels in compressed files.


2. Unable to detect CCSI (SITs/Trainable SITs) in encrypted files.

Q: What are the limitations of the custom dialog?

1. The title and the body and override justifications options can be customized using the JSON file. Basic text formatting is allowed: bold, underline, italic and line break. Justification options can be up to 3 plus an option for free-text input.


2. The text for false positive and acknowledgment is not customizable.


3. Below is the required structure of the JSON files that admins will create to customize the dialog for matched rules. The keys are all case-sensitive. Formatting and dynamic tokens for matched conditions can only be used in the Body key.