Which DLP Policy Tip Appears for File2 in SharePoint Online?
You have a Microsoft SharePoint Online site named Site1 that contains the files shown in the following table.
You have a data loss prevention (DLP) policy named DLP1 that has the advanced DLP rules shown in the following table.
You apply DLP1 to Site1.
Which policy tips will appear for File2?
Community Insight
This question tests whether you know that DLP shows only one policy tip per item; the trap is treating every matching rule as a separate visible tip.
Microsoft Purview DLP policy tips are governed by rule priority: even when File2 matches both IP-address rules, only the tip from the highest-priority matching rule is displayed. This page establishes that Tip1, not Tip1 and Tip2, appears for File2.
Selecting Tip1 and Tip2 only because File2 meets both Rule1 and Rule2 thresholds; matching multiple rules does not cause multiple policy tips to be shown.
Community Discussion (10 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
File2 contains three IP addresses, so it satisfies Rule1's at-least-one-IP condition and Rule2's at-least-three-IP condition. In Microsoft Purview DLP, when an item matches multiple rules that each have a policy tip, the user does not get a tip for every matching rule; only the policy tip for the highest-priority matching rule is displayed. Because Rule1 has the lower priority number (priority 0) and therefore outranks Rule2, Tip1 is the tip shown for File2. Rule3's higher threshold is not met by File2, and it is lower priority anyway. The decisive point is tip display, not merely which conditions evaluate to true.Why the Other Options Are Wrong
B is wrong because Tip2 belongs to Rule2, which is lower priority than Rule1; even if Rule2 is evaluated and matches, it does not replace Rule1's tip. C is wrong because File2 does not reach Rule3's condition and Rule3 is lower priority. D is the trap: File2 does match Rule1 and Rule2, but Purview shows only one policy tip per item, so Tip1 and Tip2 are not both displayed. The correctness of D would require a product behavior where every matching rule contributes a visible tip, which is contrary to the policy-tip note in the Purview documentation.Community Comment Notes
underscore1234 gives the practical Purview-engineer explanation: "Only a single policy tip can be shown", with the highest-priority matching rule winning. kollyp2000 cites the related rule behavior that "actions from the highest priority rule are applied", which reinforces why Rule1's Tip1 wins. skalolaz and Eltooth focus on the fact that Rule1 and Rule2 both match File2's IP count, but matching two rules does not mean two tips appear. PAPAKIA correctly states that "Rules are evaluated by priority order (lowest number first)." but then assumes both matching tips would be shown, which is where that reasoning departs from the documented policy-tip display behavior. Scrambles points readers to the Note section of Microsoft's policy reference, which is the key documentation behavior.Official Reference
Exam Strategy
Read the rule priority column before comparing which conditions match. When several DLP rules match, ask which policy tip Purview surfaces (the highest-priority matching rule), not how many rules evaluated to true; check Stop processing separately because it affects enforcement, not the one-tip display rule.
Frequently Asked Questions
Why does File2 show Tip1 only when Rule2’s IP address threshold is also met?
File2 matches both Rule1 and Rule2, but Purview displays only one policy tip: the tip from the highest-priority matching rule, Rule1.
Does “Stop processing” explain why only one policy tip appears?
No. The single-tip result comes from DLP policy-tip display behavior; Stop processing only controls whether later rules are evaluated for enforcement.