1

Hi,

I’ve set up a DLP policy where, if a user tries to send any PII or PCI data outside the organization, they must provide a mandatory justification to override the restriction. I’ve also added an exemption: if a document or email is labeled with a specific sensitivity label called “DLP External/DLP-EXCLUSION” (used by management), users can send sensitive data externally without needing to justify or override.

I’ve deployed the exact same policy for two customers: one using Microsoft 365 E5 licenses, and another using Microsoft 365 Business Premium. In the E5 tenant, everything works as expected—applying the “DLP External/DLP-EXCLUSION” label lets users send the data outside without mandatory justification. However, in the Business Premium tenant, even after applying the excluded label, users are still prevented from sending PII/PCI data externally.

DLP Policy and Error attachment = DLP.pdf (128.2 KB)

What might be causing this difference? Is it related to the license type?

Thank you,
Rugved Vaidya.

6 Spice ups
2

Sounds like a licensing issue to me…

3 Spice ups
3

The Microsoft 365 Business Premium plan does not support automatic label-based DLP policy exemptions

E5 includes Microsoft Purview Information Protection and DLP Premium capabilities, which allow for advanced DLP conditions, including sensitivity label-based policy exemptions.
Business Premium lacks these advanced DLP features, even if you can create and assign sensitivity labels. The enforcement of label-based exemptions in DLP policies is not fully supported.
This means that while the label “DLP External/DLP-EXCLUSION” can be applied in the Business Premium tenant, the DLP engine doesn’t honor it as an exemption trigger.

4 Spice ups