DLP reporting and alerting capabilities
There are a number of reporting and alerting capabilities for DLP that are available within the Microsoft 365 Security and Compliance Center. Regularly reviewing these will give Microsoft 365 administrators valuable insights into how effectively DLP is configured and working. The reports that are available are as follows:
- DLP policy matches
- DLP incidents
- DLP false positives and overrides
You can view the available DLP reports from the Security and Compliance Center by navigating to Reports | Dashboard and choosing DLP policy matches, as shown in the following screenshot:
Figure 13.33 – DLP policy matches
The DLP policy matches section shows a count of recent policy matches, all of which you can filter by date, location, policy, or action.
Clicking into the tile will give you a broader view of the DLP policy match activity, along with related reports on DLP incidents and DLP false positives...
