Question

A compliance administrator has created a new Data Loss Prevention (DLP) policy intended to block emails containing credit card numbers from being sent externally. Before enforcing the block across the entire organization, the administrator wants to observe how many messages the policy would affect and review potential false positives without disrupting any users' work. Which approach should the administrator take first?

Accepted Answer

Deploy the policy in test mode (simulation) with policy tips turned off, then review matches in Activity Explorer and DLP reports

Answer

Deploy the policy immediately in enforce mode but scope it to a single pilot user's mailbox

Answer

Create a retention policy to capture affected emails before enabling the DLP rule

Answer

Enable the policy in enforce mode with policy tips shown so users can self-report false positives