Microsoft Purview - DLP Alert Review

Purpose 

For submitting issues with DLP alerts that appear to be false positives or misclassified, to help improve accuracy and reduce user disruption. 

When to Submit a Service Request to ISEC 

  • You received a notification or policy tip but believe it’s a false positive. 
  • The alert blocked legitimate activity that complies with data policies. 
  • You suspect the DLP rule needs adjustment (e.g., scope, sensitivity). 

What Happens Next

  1. Notification Review: Your incident will be logged, and the content related to the alert is retained for investigation 

  2. Investigation & Triage: The ISEC team will investigate—reviewing the matched content, policy rule, and contextual details 

  3. Communication & Resolution: You will receive follow-up, including whether the rule is being fine-tuned or if the alert was valid. 

  4. Policy Tuning & Feedback Loop: Misclassifications are logged and used as feedback to adjust DLP rule thresholds or content definitions—aimed at reducing future false positives. 

 
Request Service

Related Articles (2)

Labelling Emails and Files with Microsoft Purview
This article will show you how to apply, upgrade, and troubleshoot sensitive data labels in Microsoft Outlook, Word, Excel, and PowerPoint using Microsoft Purview.
Microsoft Purview Frequently Asked Questions
This article will answer common questions about using Microsoft Purview sensitivity labels at Chico State.