A DLP alert shows a finance user shared a file with many credit car…

Question

A DLP alert shows a finance user shared a file with many credit card numbers externally. What is the correct first admin action in Purview?

Accepted Answer

Open the DLP alert, review matched content and policy, assess business justification, then remediate/close with status — Alerts are clues, not verdicts. Open it, review evidence, then act.

Answer

Ignore the alert without review

Answer

Delete the user's Entra account immediately without investigation

Answer

Disable Microsoft 365 for the entire company

A DLP alert shows a finance user shared a file with many credit card numbers externally. What is the correct first admin action in Purview?

Short Explanation and Infographic

Full Explanation