I have created a block policy in Purview DLP and scoped to a security group.

The policy triggers when a scoped user sends email that matches the policy criteria but doesnt detect when the user sends the same email from a shared mailbox.

Is that a  feature of Purview DLP?

I had expected the policy to still trigger as email is sent by the scoped user ‘on behalf of’ the shared mailbox, and the outbound email appears in Exchange Admin as coming from the scoped user. 

​I have created a block policy in Purview DLP and scoped to a security group.The policy triggers when a scoped user sends email that matches the policy criteria but doesnt detect when the user sends the same email from a shared mailbox.Is that a  feature of Purview DLP? I had expected the policy to still trigger as email is sent by the scoped user ‘on behalf of’ the shared mailbox, and the outbound email appears in Exchange Admin as coming from the scoped user.   Read More

​