DLP agent cannot detect Titus label when sending email

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

The DLP agent cannot detect the Titus label when the user does not manually select the label before they hit "SEND" from Outlook.
If the user adds the Titus label before they hit "SEND" our policy configured to detect the Titus label as a keyword does work and prompts the user for justification.

Since we do not fully integrate with Titus, the customer configured Titus to add the label to the body of the email.
And then configured a keyword policy to detect the Titus label in the body of the email.

Cause

Microsoft calls each add-in on the order they are loaded.
When our add-in fires first, there is no Titus label to detect.
Our add-in allows the message to continue and the Titus add-in then fires.
The Titus add-in prompts the user to add a label.
Once the label is added and the user clicks OK, the message is sent to the MTA.
Since our agent add-in has already examined the message it does not rescan the message after the Titus label is added.

Resolution

Train the users to add the Titus label before clicking SEND.
Per Microsoft, the load order of the add-ins cannot be manually changed.

Or use MIP instead of Titus.

Additional Information

The PM is looking into this to see what we may be able to do to get our agent to scan the email after Titus adds its label.

This issue is described on this Microsoft page.

https://learn.microsoft.com/en-us/office/dev/add-ins/outlook/outlook-on-send-addins?tabs=classic#multiple-on-send-add-ins

That page shows that this is due to the order in which the add-ins are installed.