Create an Email DLP Sender Alert Policy

Table of Contents

Create Microsoft Exchange Transport Rules

Obtain Your Microsoft Exchange Domain and Relay Host

Create an Email DLP Sender Alert Policy

Create a DLP policy on Microsoft Exchange to alert senders when an email is sent to hosted quarantine for review.

On May 7, 2025, Palo Alto Networks is introducing new Evidence Storage and Syslog Forwarding service IP addresses to improve performance and expand availability for these services globally.

You must allow these new service IP addresses on your network to avoid disruptions for these services. Review the Enterprise DLP Release Notes for more information.

Where Can I Use This?	What Do I Need?
Data Security	One of the following licenses that include the Enterprise DLP license Review the Supported Platforms for details on the required license for each enforcement point. Prisma Access CASB license Next-Generation CASB for Prisma Access and NGFW (CASB-X) license Data Security license Email DLP license

Create an Email DLP sender alert policy on Microsoft Exchange Online to send an email alert when a sender's email is sent to hosted quarantine for review.

Log in to the Microsoft Exchange Online Compliance portal.
Select PoliciesData loss preventionPolicies and Create policy.
Create a custom DLP policy.
1. For Categories, select Custom.
2. For Templates, select Custom policy.
3. Click Next.
Enter a Name and Description, and click Next.
For the Assign admin units, leave the default Full directory and click Next.
When you Choose location to apply the policy, verify that the Exchange email Status is On.

Set the Status to Off for all other locations and click Next.
To Define policy settings, select Create or customize advanced DLP rules and click Next.

You are redirected to the Customize advanced DLP rules to a sender alert policy rules for the hosted quarantine transport rule.
Create the Email DLP sender alert policy rule when an email is sent to hosted quarantine.
1. Create rule.
2. Enter a Name and Description.
3. In Conditions, select Add conditionHeader contains words or phrases.
4. In the Enter header name field, enter x-panw-action.
5. In the Enter words and then click 'Add' field, enter quarantine.
6. Add.
7. Turn On (enable) User notifications.
8. Verify Notify the user who sent, shared, or last modified the content is enabled.
9. (Optional) Check (enable) Customize the email text to provide a custom response to the sender when an email is sent to hosted quarantine for review.
10. (Optional) Check (enable) Policy Types to provide customized data compliance tips.
11. Turn Off (disable) Incident reports.
12. Save.
13. Verify the policy rule Status is On.
14. Click Next.
For the Policy mode, select Turn it on right away and click Next.
Review the Email DLP sender alert policy and Submit.

Click Done when prompted that the new policy was successfully created.
Back in the Policies, verify that the Email DLP sender alert policy is displayed and that the Status is On.