What this check looks at
Checks that the rules of enforced DLP policies notify the person sharing, with a policy tip or an email, when they match.
DLP rules can tell the person who triggered them: a policy tip shown in Outlook, in Teams and on the file in SharePoint and OneDrive, and an email notification. Notifications are set per rule (NotifyUser: the sender or last person to change the file, the owner, the site administrator, or named addresses), with optional custom text explaining what was found and what to do instead.
The check takes the switched-on rules of the enforced DLP policies and fails for each rule that notifies nobody; it also fails when the enforced policies have no switched-on rule. It passes when every such rule notifies the person sharing.
A silent block looks like a fault: the email bounces or the recipient cannot open the file, the sender does not know why, and they raise a ticket or find another way to send it, often personal email. A silent notify-only rule teaches nothing at all. Policy tips are also how people override a block with a business justification, so without them overrides are not available.
Why it matters
A block with no explanation looks like a fault and ends in a helpdesk call. A policy tip tells the person what was found and what to do instead, which is how DLP teaches good habits.
A typical case: after blocking was turned on without policy tips, an estate agency’s help desk took 40 calls in a week about "broken email". Staff started sending tenancy documents from personal accounts to get round it, moving the data to exactly the place DLP was meant to keep it from.
A good policy tip turns each match into a moment of training: what was found, why it matters and what to do instead. Over time it reduces both the matches and the tickets.
CISA SCuBA MS.DEFENDER.4.4v1 asks that the DLP policy notifies users. It supports the NCSC 10 Steps’ engagement and training step and ISO 27001 A.8.12.
How to fix it
Where: Microsoft Purview portal → Data loss prevention → Policies
Before you start
- Write the policy tip in plain words: what was found, why it matters, and what to do instead.
Step by step
- Find the silent rules. Connect to Security & Compliance PowerShell (Install-Module ExchangeOnlineManagement, then Connect-IPPSSession) as a Compliance Administrator. Run Get-DlpComplianceRule | Select-Object Name, ParentPolicyName, Disabled, NotifyUser, NotifyPolicyTipCustomText. Every enabled rule of an enforced policy with an empty NotifyUser needs changing.
- Write the policy tip. Write one or two plain sentences per rule: what was found, why it matters and what to do instead, with a contact. For example: "This message contains card numbers, which must not be sent by email. Use the payment portal instead, or contact IT if you think this is wrong."
- Turn on notifications in each rule. In the Purview portal, go to Solutions > Data loss prevention > Policies, select the policy, choose Edit policy and continue to the advanced rules page. Edit each rule: under User notifications, turn notifications on, notify the person who sent, shared or last modified the content, tick the option to customise the policy tip text and paste your text. Save the rule and submit the policy.
- Or set notifications in PowerShell. Run Set-DlpComplianceRule -Identity "<rule name>" -NotifyUser Owner,LastModifier -NotifyPolicyTipCustomText "<your text>" for each rule.
- Confirm the change. Rerun Get-DlpComplianceRule | Select-Object Name, ParentPolicyName, NotifyUser: every enabled rule of the enforced policies shows recipients. Send a test email with the words "credit card" and the test number 4111 1111 1111 1111 to an outside address: Outlook shows your policy tip before it is sent.
What users will notice
People see a policy tip in Outlook, Teams or the file’s page when they share something that matches, and may get an email.
How to confirm it worked
Get-DlpComplianceRule | Select-Object Name, NotifyUser shows recipients for every rule of the enforced policies.
Frameworks and controls
This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| NIS2 | Art. 21(2)(g) Basic cyber hygiene practices and training |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.8.12 Data leakage prevention |
| CISA SCuBA | MS.DEFENDER.4.4v1 The DLP policy notifies users |
| CIS Controls v8.1 | 3.13 Deploy a data loss prevention solution (IG3) |
| NIST CSF 2.0 | PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind |
| NCSC 10 Steps | Data securityEngagement and training |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Send email notifications and show policy tips (Microsoft Learn)