You are not seeing emails in the DLP Cloud Service for Email for messages coming from M365

Products

• Data Loss Prevention Cloud Service for Email
• Data Loss Prevention

Issue/Introduction

After setting up Connectors and Transport rule for the DLP Email Service in M365, you are not seeing message counts or incidents in DLP - but the messages are delivered.

Environment

Release : 15.8 MP3+

Cause

In some cases, the "Stop processing more rules" condition is required in M365 even though the Transport Logic suggests it should NOT be required.

Resolution

Investigate your transport rules in M365, to check whether there are any other rules in place, even if they are set to a lower priority for delivery.

It may help to use a Message Header Analyzer to verify which hops your message went through on route to delivery.

If you do have another rule which seems to be determining the mailflow, try adding the "Stop Processing more rules" option to the DLP Transport rule.

Additional Information

Here are links to two 3rd party Message Header Analyzers:

Message Header Analyzer (Microsoft Azure tool)

Email Header Analyzer, RFC822 Parser - MxToolbox (MxToolbox)

Note that in most cases, the DLP "hop" will show in the "From" column as "unknown 144.49.247.126". The IP reported will be in the defined IP range for our hosted service: 149.44.247.0/21.