DLP policy priority DLP policies and the rules inside them have a priority, and priority 0 at the top is evaluated first. When content matches several rules, the most restrictive action is enforced, and priority only breaks a tie. An email that matches two policies gets the stricter action, and the employee sees only one policy tip. W DATA LOSS PREVENTION · PRIORITY DLP policy priority Ada Admin Eli Employee THE SHORT ANSWER Does DLP stop at the first match? No. 1 Policies are evaluated in priority order, starting with 0. 2 Content can match rules in several policies at once. 3 The most restrictive action is enforced. Priority decides only between rules that are equally strict. Microsoft Purview Home Information Protection Sensitivity labels Data Loss Prevention Policies Sensitivity labels PRIORITYNAMEPROTECTION Move upMove downMove to bottom The label at the bottom has the highest priority. Policies › EXO-Label Rules PRIORITYRULEACTION 0Internal to externalPolicy tip 1Confidential to externalBlock, override with justification 2Strictly Confidential to externalBlock Rules get their priority in the order they're created. Each label only matches one rule here, so the order doesn't matter. EXO-Label › Confidential to external Edit rule Conditions, actions, notifications and overrides are above. ⌃ Additional options If there's a match for this rule, stop processing additional DLP policies and rules. Evaluate rule per component Off Set the order in which this rule will be selected for evaluation Priority: 1▼ Save Cancel Policies PRIORITYNAMELOCATIONMODE Priority 0 at the top is evaluated first. WHAT THE LABEL ORDER DECIDES Lower or higher is read from the list HOW ONE EMAIL IS EVALUATED All policies are evaluated, the strictest action wins ONE EMAIL, TWO POLICIES Customer contract.docx, Confidential, with an IP address POLICYRULEACTIONAPPLIED The most restrictive action wins. Block with override is stricter than a policy tip, so EXO-Label is enforced. With SIT-Awareness at priority 0, the result would be the same. Eli sees one policy tip, from the rule that is enforced. New message · Outlook Send To anna@partnerco.example External Subject Customer contract Confidential content. You can send it outside the organization only with a business justification. Customer contract.docx Confidential Hi Anna, the contract is attached. The VPN endpoint is 203.0.113.24. Not shown SIT-Awareness: IP address in content Action: policy tip only Users see one tip at a time, from the rule that is enforced. Board minutes.docx · Word Strictly Confidential Sensitivity ▾ Board minutes Justification required Your organization requires a justification to change this label to one with lower sensitivity. Previous label no longer appliesPrevious label was incorrectOther (explain) Change Cancel THE USER EXPERIENCE What Eli notices Users never see the priorities, only the result of them. Good to know 1/7 DATA LOSS PREVENTION DLP policy priority DLP policies and their rules are evaluated from the top, starting with priority 0. But when content matches several rules, the most restrictive action wins, and the user sees only one policy tip. informasjonsbeskyttelse.no