A data loss prevention (DLP) policy tip is delayed in Exchange Online

Applies to: Exchange Online

Symptoms


In Microsoft Exchange Online, you may experience one of the following symptoms: 

  • A data loss prevention (DLP) policy tip appears to be delayed. 
  • After you send a message, you receive a non-delivery report (NDR) that informs you that you are violating the DLP policy. 

Cause


This behavior is by design. The DLP function to evaluate the message isn't triggered immediately. When a message is created, it doesn't yet meet the DLP policy conditions. The DLP policy tip is called and the content is evaluated after data is added to the message

More Information


Wait about 30-50 seconds to let the function be called. You can also expect the function to occur automatically when one of the following actions occurs: 

  • An attachment is added or removed.
  • AutoSave runs (one time every minute).
  • You click Save (to manually save a message).
  • You open a draft.

After the function is triggered, you receive a message that resembles the following if the message violates the DLP policies.

A screenshot of the Policy tip