Create an Email DLP Sender Alert Policy

Log in to the Microsoft Exchange Online Compliance portal.

Select

Policies

Data loss prevention

Policies

and

Create policy

.

Create the a custom DLP policy.

For
Categories
, select
Custom
.
For
Templates
, select
Custom policy
.
Click
Next
.



Enter a

Name

and

Description

, and click

Next

.

For the

Assign admin units

, leave the default

Full directory

and click

Next

.

When you

Choose location to apply the policy

, verify that the Exchange email

Status

is

On

.

Set the

Status

to

Off

for all other locations and click

Next

.

To

Define policy settings

, select

Create or customize advanced DLP rules

and click

Next

.

You are redirected to the

Customize advanced DLP rules

to a sender alert policy rules for the hosted quarantine transport rule.

Create the Email DLP sender alert policy rule when an email is sent to hosted quarantine.

Create rule
.
Enter a
Name
and
Description
.
In
Conditions
, select
Add condition
Header contains words or phrases
.
In the
Enter header name
field, enter
x-panw-action
.
In the
Enter words and then click 'Add'
field, enter
quarantine
.
Add
.

Turn
On
(enable)
User notifications
.
Verify
Notify the user who sent, shared, or last modified the content
is enabled.
(
Optional
) Check (enable)
Customize the email text
to provide a custom response to the sender when an email is sent to hosted quarantine for review.
(
Optional
) Check (enable)
Policy Types
to provide customized data compliance tips.

Turn
Off
(disable)
Incident reports
.
Save
.
Verify the policy rule
Status
is
On
.

Click
Next
.

For the

Policy mode

, select

Turn it on right away

and click

Next

.

Review the Email DLP sender alert policy and

Submit.

Click

Done

when prompted that the new policy was successfully created.

Back in the

Policies

, verify that the Email DLP sender alert policy is displayed and that the

Status

is

On

.