I've started doing some testing with our Office 365 Tenant and the DLP policies. I have a couple (PII and Credit Card) running in test mode and when I look at the policy matches report, the Item and Last modified by are encoded (all start with PII:H101 prefix). Is there any way to actually determine what user/item are in violation? I would like to determine if we're getting valid results.


Office 365 DLP policies creation template provide different options to trigger emails to both the owner of the content as well as to the site collection administration with pre-defined or customized email content.

Once you configure those settings, you will be receiving emails with direct links to the documents or list items where the rule is matched.

  • True, but it doesn't help if I'm trying to see it from the macro level. I did send an email to a contact at Microsoft and it appears that I should be seeing the user and document path/name instead of the encoded placeholder. If I get a resolution from him, I'll post it on this thread.
    – FolcoTook
    Feb 24 '17 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.