A new DLP policy was created to detect a Microsoft Sensitivity Label in an email, but it is not triggering as expected

Products

• Data Loss Prevention Enterprise Suite
• Data Loss Prevention
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Network Prevent for Email

Issue/Introduction

The MIP label in the email header is not being detected.
MIP is not configured in DLP.
Outlook is the mail system.
The voice mail system is using Microsoft Teams to send an email to the recipient with the voice message attached.
When that email is sent from Teams, a MIP label is added to the header and the label verbiage is added to the body of the email.
The goal is to detect the MIP label when the recipient forwards that email to an external address.
A keyword policy was created to detect the MIP label.
That policy is only detecting the label verbiage in the body of the email.
If the label verbiage is removed from the body of the email, detection fails.

Resolution

The test was invalid.
The mail was created in the QA system.
Then that message was saved as an .msg file.
That .msg file was then transferred to the test system.
The .msg file was then attached to an outbound message.

When saving the message as an .msg file, the email header was stripped.
Thus the MIP label was no longer in the email header.
Only the label verbiage in the email body was included in the .msg file.

This is outside of DLP.