You have deployed a policy to the endpoint agent that includes rules or exceptions based on recipients. However the rules do not trigger as expected when sending e-mail via Outlook Web Access (OWA).
DLP 15.X, 16.X
On the endpoint level, e-mails sent via OWA are been send via HTTP/HTTPS traffic.
HTTP request looks next ( info in log about example mail sent via OWA) :
Request Id #87
Detection Request Details :
Session Command : Session Continue Request
Session Id : {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
Request Type : Data In Motion Request
Dim Detection Request Details :
Process Id : 10944
Process Path : C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Application Name : Microsoft Internet Explorer
User : 0036800
Domain : example.com
Time Stamp : 06/17/2019 11:56:52
Dim Event Type : HTTP(S)
HTTP(S) Details :
URL : https://webmail.example.com/owa/ev.owa?oeh=1&ns=MailTips&ev=Get
Network Info Details :
Source IP :
Source Port : 0
Source Domain :
Destination IP :
Destination Port : 0
Destination Host Name : webmail.example.com
Note that the request details don't contain recipient information which is usually provided in the normal SMTP traffic. For OWA it's in the body of HTTPs post. Thus it can be recognized by keyword rule but not by recipient rule.
Implement network prevent for mail.
If you implement network prevent for email ( making sure traffic from OWA goes via DLP detection server ) - MTA will transfer information containing e-mail details as normal SMTP communication thus rules/exceptions will work fine.