Scope Email DLP Policies by Both Senders and Recipients

Until now, Email DLP policies could only be scoped based on the protected side of the communication – senders for outgoing policies and recipients for incoming policies. With this release, administrators can define both sides of the communication to create more targeted DLP policies.

This capability is available for outgoing Microsoft 365 Email and Gmail Email DLP policies, as well as incoming Microsoft 365 Email DLP policies. Administrators can scope policies based on specific users, groups, email addresses, or domains on both sides of an email conversation.

This additional granularity helps organizations fine-tune robust Email DLP policies around specific communication flows. For example, stricter controls can be applied when selected departments communicate with particular external partners, reducing unnecessary policy matches while aligning enforcement with business and compliance requirements.

To configure the policy:

1. Edit an existing Email DLP policy or create a new one.
2. Under Scope, navigate to Recipients for outgoing policies or Senders for incoming policies.
3. Select Specific recipients or domains or Specific senders or domains.
4. Enter the email addresses or domains that should be included in the policy scope.

This feature is being gradually deployed and should be available in customer portals over the next 7 days