Skip to content

Commit c6da221

Browse files
Cloud-WriterCloud-Writer
authored
Merge pull request #10634 from MicrosoftDocs/Meera-SupportArticles-Working
A new article about the HAR diagnostic in the Purview portal
2 parents b9e8655 + e781332 commit c6da221

2 files changed

Lines changed: 152 additions & 0 deletions

File tree

‎Microsoft365/purview/purview/data-loss-prevention/diagnose-dlp-policy-tip-display-issues.md‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
---
2+
title: Diagnose DLP policy tip issues by using the HAR diagnostic
3+
description: Describes the process to troubleshoot the issue when the confiured DLP policy tips don't appear.
4+
author: cloud-writer
5+
ms.author: meerak
6+
manager: dcscontentpm
7+
search.appverid:
8+
- MET150
9+
audience: ITPro
10+
ms.topic: troubleshooting
11+
ms.reviewer: pramkum, meerak
12+
ms.custom:
13+
- sap:Data loss prevention (DLP)
14+
- CSSTroubleshoot
15+
- CI 8652
16+
appliesto:
17+
- Microsoft Purview Data Loss Prevention
18+
ms.date: 01/29/2026
19+
---
20+
21+
# Diagnose DLP policy tip issues by using the HAR diagnostic
22+
23+
## Summary
24+
25+
This article describes how to diagnose an issue that occurs if the DLP policy tips that you configure either appear sporadically or never appear, or if incorrect tips appear in Outlook on the web. The article discusses how you can use the HTTP Archive (HAR) diagnostic to extract relevant information from a HAR trace and identify further checks that can help resolve the issue.
26+
27+
## The HAR diagnostic
28+
29+
When you compose or edit an email message, Outlook on the web calls the GetDlpPolicyTips service. This service checks the following information, and returns the results to Outlook on the web to display the appropriate policy tips:
30+
31+
- The text that you typed
32+
- The recipients of the email message
33+
- The DLP policies that apply to the email message
34+
35+
If the expected policy tips don’t appear, run the [HAR diagnostic](https://purview.microsoft.com/datalossprevention/diagnostics) that’s available in the Microsoft Purview portal.
36+
37+
The diagnostic helps you identify and resolve the issue by determining whether the issue occurs because:
38+
39+
- Policy tips aren’t enabled in DLP policy settings.
40+
- The content in the email message in Outlook on the web doesn’t have any of the Sensitive Information Types (SITs) that are configured in DLP policies.
41+
- Outlook on the web didn’t send a request to the GetDlpPolicyTips service to evaluate the content of the email message against the configured DLP policies.
42+
43+
### Collect a HAR trace
44+
45+
To run the HAR diagnostic, use your browser’s developer tools to collect an HAR trace. Run the trace while the issue that affects the policy tip display is occurring in Outlook on the web. For information about how to collect the trace, see [How to collect a network trace](/azure/azure-web-pubsub/howto-troubleshoot-network-trace?utm_source=chatgpt.com#microsoft-edge-chromium).
46+
47+
> [!IMPORTANT]
48+
>
49+
>- Before you try to trigger the policy tip, start recording the HAR trace.
50+
>- The size of the HAR trace must be less than 100 MB. This is the maximum file size that the HAR diagnostic accepts.
51+
52+
## Output of the HAR diagnostic
53+
54+
After you upload the HAR trace, the diagnostic checks for calls to the GetDlpPolicyTips service to extract the following information:
55+
56+
- **Sender and Recipient Info**<br/>
57+
Confirms whether the email participants are within the policy’s scope.
58+
59+
- **Policy Evaluation Result**<br/>
60+
Indicates whether the policy check succeeded or failed.
61+
62+
- **Detected Sensitive Information Types (SITs)**<br/>
63+
Lists the SITs in the email message, the number of their occurrences, and the confidence level of the SITs that matched DLP policy rules.
64+
65+
- **Evaluated Policies and Rules**<br/>
66+
Lists the DLP rules that were checked, and whether they matched.
67+
68+
The diagnostic provides an explanation of the results, and guidance for what to check next.
69+
70+
Here’s an example of the HAR diagnostic results.
71+
72+
Policy tip evaluation for the OWA client completed successfully
73+
74+
**There were 2 GetDlpPolicyTips calls found in the HAR trace. Please find the details of each call below.**
75+
76+
**Sender:** `[email protected]`
77+
78+
**Recipients:** `[email protected]`
79+
80+
**Evaluation Result:** Success*
81+
82+
**Detected SIT:**
83+
84+
**Summary:**<br/> None of the rules defined in the policy matched.
85+
86+
| Policy Name/Rule Name  | Is Rule Matched  |
87+
|----|----|
88+
| External sharing-Sensitive Information DLP policy|False |
89+
| Default Endpoint DLP Policy Rule-Low Volume-Default policy for devices | False  |
90+
91+
**Sender:** `[email protected]`
92+
93+
**Recipients:** `[email protected]`, `[email protected]`
94+
95+
**Evaluation Result:** Success*
96+
97+
**Detected SIT:** Credit Card Number (Unique Count: 1 Total Count: 1 Confidence: 65)
98+
99+
**Summary:** Expected Policy Tip to be shown: 'Your email message conflicts with a policy in your organization.' from the rule 'External sharing-Sensitive Information DLP policy'.
100+
101+
|Policy Name/Rule Name| Is Rule Matched |
102+
|----|----|
103+
| External sharing-Sensitive Information DLP policy  | True  |
104+
| Adaptive Protection audit rule for Teams and Exchange DLP-Adaptive Protection policy for Teams and Exchange DLP | True  |
105+
106+
## Interpret the HAR diagnostic results
107+
108+
The following examples explain the summary information that’s provided by the HAR diagnostic, and the steps that you can take to continue diagnosing the issue.
109+
110+
### Scenario 1: No DLP evaluation request found
111+
112+
**Summary:** The input file does not contain any GetDlpPolicyTips API calls.
113+
114+
**Explanation**:
115+
Outlook on the web didn’t send a request to evaluate the content of the email message against the configured DLP policies.
116+
117+
**Next steps**:
118+
Recapture the HAR trace, and contact Microsoft Support for help to resolve the issue.
119+
120+
### Scenario 2: Service error during evaluation
121+
122+
**Summary**: The GetDlpPolicyTips API returned evaluation result 8.
123+
124+
**Explanation**:
125+
The back-end service encountered an error when it processed the DLP request.
126+
127+
**Next steps**:
128+
129+
Contact Microsoft Support for help to resolve the issue.
130+
131+
### Scenario 3: No DLP rules were triggered or a policy tip was expected but not shown
132+
133+
**Summary**: No matching rules found.
134+
135+
**Explanation:**
136+
The content doesn’t meet the conditions of any active DLP policy. It might be close to matching, but it doesn’t meet one or more rule requirements.
137+
138+
**Check the settings for all applicable DLP policies:**
139+
140+
- To check the settings, go to [Microsoft Purview portal](https://purview.microsoft.com/) > **Data Loss Prevention** > **Policies** > **Edit Policy**.
141+
142+
- Check whether the SITs that are used in the policy match any that are used in the draft email message.
143+
- Check whether the confidence levels that are set for the rules in the policy are strict. If yes, then update them, as appropriate.
144+
- Check whether the threshold for a match is set to a high value. If yes, then lower it, as appropriate.
145+
146+
- Verify that the policy is correctly published and assigned.
147+
148+
**Next steps**:
149+
150+
Check whether the issue still occurs. If it does, contact Microsoft Support for help to resolve the issue.

‎Microsoft365/purview/purview/purviewtoc/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@
5757
href: ../data-loss-prevention/data-loss-prevention-policy-tips.md
5858
- name: Data loss prevention not working
5959
href: ../data-loss-prevention/data-loss-prevention-not-work.md
60+
- name: Diagnose DLP policy tip display issues
61+
href: ../data-loss-prevention/diagnose-dlp-policy-tip-display-issues.md
6062
- name: Diagnostics
6163
items:
6264
- name: Self-help diagnostics for issues in Microsoft Purview

0 commit comments

Comments
 (0)