Microsoft Purview
A Microsoft data governance service that helps manage and govern on-premises, multicloud, and software-as-a-service data. Previously known as Azure Purview.
1,545 questions
Diagnostics Tool in DLP is not working for the Teams data source
Mitch Silberstein
40
Reputation points
When I go to run the diagnostic "A DLP rule isn't enforced for a particular user. Is this user included in the DLP policy?", there are never any policies that show up when I should be seeing policies assigned.
I have tested this on multiple tenants and get the same issue where no Teams policies are shown as assigned to the user. The other data sources like Exchange, Endpoint, and OneDrive work fine. The DLP policies are scoped to Teams and are assigned to All Users. Appears to be a bug.
Microsoft Purview
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(99.2, 65%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECB%3C/text%3E%3C/svg%3E)
Chandra Boorla 12,085 Reputation points Microsoft External Staff2025-04-28T21:21:06.95+00:00 Thank you for your detailed report, your analysis is spot-on.
After reviewing the issue, the root cause appears to be that the DLP diagnostics tool currently does not correctly evaluate the AllUsers flag for Teams DLP policies. Here's a breakdown:
Root Cause
When a DLP policy is assigned to "All Users" in Teams, the backend sets AllUsers = $true.
- However, the diagnostic tool seems to check only the AssignedToUsers field and not the AllUsers property.
- As a result, DLP policies correctly assigned to all Teams users are not surfaced in the diagnostics output, even though they are enforced.
Immediate Workaround
- To properly detect these policies, the diagnostic logic should include the AllUsers check.
- Revised evaluation logic would look like this:
# Correct evaluation for DLP policy assignment ($policy.AllUsers -eq $true -or $policy.AssignedToUsers -contains $UserId)Why Other Data Sources Work
- For data sources like Exchange, OneDrive, and Endpoint, broad assignments are often reflected directly as AssignedToUsers = "All", which the current diagnostics handle properly.
- Teams' policies manage broad assignments differently by setting AllUsers = true, which the current diagnostics logic overlooks.
I hope this information helps. Please do let us know if you have any further queries.
Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.
Thank you.
-
Mitch Silberstein 40 Reputation points
2025-04-29T15:44:44.3933333+00:00 @Chandra Boorla Do you know if this something that can be addressed and fixed? Is Microsoft working to correct this currently?
-
Chandra Boorla 12,085 Reputation points Microsoft External Staff
2025-04-30T16:43:20.4+00:00 Thanks again for your detailed analysis and for bringing this to our attention.
Regarding the issue, while I don’t have an exact ETA at this time, I will continue to track this internally. I’ll make sure to update this thread as soon as a fix is released or once more concrete information becomes available from the product team.
Appreciate your patience
Sign in to comment
Sign in to answer