Incident reconciliation - inconsistent behavior for MS Purview encrypted emails incidents.
It has been identified that the incident reconciliation feature does not reconcile all the incidents for MS Purview encrypted emails in a particular scenario.
Release: 15.8, 16.x
This behavior is observed when a keyword match is detected in the header space of an email by DLP email prevent.
DLP incident reconciliation feature is not able to reconcile all the incidents into a single incident due to the variation in the match positions, which is observed in emails that are encrypted using the MS Purview solution.
This issue is still under investigation and a fix is yet to be determined.