I've started doing some testing with our Office 365 Tenant and the DLP policies. I have a couple (PII and Credit Card) running in test mode and when I look at the policy matches report, the Item and Last modified by are encoded (all start with PII:H101 prefix). Is there any way to actually determine what user/item are in violation? I would like to determine if we're getting valid results.
Office 365 DLP policies creation template provide different options to trigger emails to both the owner of the content as well as to the site collection administration with pre-defined or customized email content.
Once you configure those settings, you will be receiving emails with direct links to the documents or list items where the rule is matched.