Microsoft is giving compliance teams a long-awaited dial: as of this month, administrators can turn on policy tips in SharePoint and OneDrive without triggering automatic email notifications—or the other way around. The change untangles two communication channels that have been locked together inside Microsoft Purview Data Loss Prevention rules since the feature’s inception. It rolls out in preview this February and becomes generally available in July 2026, according to the Microsoft 365 roadmap entry for ID 394279.

The decoupling doesn’t add new detection capabilities or block new file types. Instead, it hands back control over how—and whether—a user learns that a DLP rule has fired. For organizations trying to reduce alert noise while still catching risky behavior, that’s a meaningful shift.

Before the update, a Purview DLP rule for SharePoint Online or OneDrive for Business had a binary switch: enable both policy tips and email notifications, or enable neither. There was no middle ground. If you wanted a user to see a short warning next to a sensitive spreadsheet, you also had to send an email—to the document owner, the person who last modified it, or a designated recipient. And if an email felt like overkill, you had to drop the in-app tip as well.

With Roadmap ID 394279, that constraint disappears. Rule creators can now pick from four distinct modes:

  • Neither: No user-facing tip, no email. The rule still runs, collects telemetry, and can trigger admin alerts or incident reports.
  • Policy tip only: The user sees a warning inside SharePoint, OneDrive, or a supported Office desktop app, but no inbox message is sent.
  • Email notification only: A notification goes to chosen recipients (owner, last modifier, site owner, or a specific individual), but no on-screen tip appears.
  • Both: The classic behavior remains available for high-stakes scenarios.

These options apply only to rules scoped to SharePoint and OneDrive. Exchange Online DLP rules are not part of this update, and the underlying detection engines—sensitive information types, exact data matches, trainable classifiers—work exactly as they did before.

Who gets what notification? A practical breakdown

Policy tips and email alerts have never been interchangeable. They serve different moments in a user’s workflow, and the new controls let admins match the channel to the job.

Policy tips are immediate, contextual, and often educational. When a user uploads a document containing passport numbers to a SharePoint library, a policy tip can appear right in the information pane or as a banner in Word. It says, in effect, “Stop—this file has sensitive data. Remove it or label it correctly before sharing.” Tips work well for nudging users toward better habits without pulling them into their inbox. They also support overrides and false-positive reports, which help compliance teams tune rules over time.

But policy tips have limits. They only show in supported experiences—the SharePoint web UI, the OneDrive web client, and recent versions of Word, Excel, and PowerPoint when documents reside in protected locations. A user who edits the file offline or in an unsupported app won’t see the warning until they sync or re-open online. And tips are triggered on editing existing content, not just on new uploads, which is important for iterative work but also means heavy editors may see repeated nudges if the rule is poorly scoped.

Email notifications are asynchronous, durable, and can reach people beyond the document editor. An email can be sent to the document owner, the site owner, or a specific individual—someone who may not even have the file open. That makes email the right channel when a second pair of eyes is needed: a data steward who must review sharing decisions, or a site owner who needs to know that a high-impact library just leaked a confidential file. Email templates support rich formatting, variable tokens (file name, policy name, URL), and in some preview scenarios, actionable buttons that let the recipient stop sharing, apply a label, or report a false positive directly from the message.

But email notifications have drawbacks. They are sent unprotected, so including sensitive details in the body is risky. Microsoft sends only one notification per document, no matter how many times the rule fires—good for noise reduction, bad if you rely on email as an audit trail. And email notifications only fire for new content matches, not for edits to existing documents. That means an email-only rule will miss a user who quietly adds a credit card number to a file that already existed.

Why the old coupling caused headaches

The forced pairing created three common pain points for admins:

  • Alert fatigue. In high-volume environments, every policy tip came with an email. Recipients quickly tuned out both. The “boy who cried wolf” effect made it harder to spot genuine incidents.
  • Mixed audiences. A document owner who manages hundreds of files doesn’t need a policy tip every time someone edits a draft; they need a summary email—or no notification at all if the rule is purely for monitoring. Meanwhile, the person editing the file may benefit from a tip but not an inbox message they’ll ignore.
  • Testing and gradual rollouts. Many organizations prefer to deploy DLP rules in “audit-only” mode first, collecting telemetry before turning on user-facing feedback. The old model forced a choice: either turn on both notification channels and risk confusing users during testing, or turn on neither and lose the chance to observe user behavior.

Decoupling solves all three. A rule can now be set to “neither” during a pilot, then switched to “policy tip only” when it’s ready for general education, and later upgraded to “both” only for the most critical data types.

How to reconfigure your DLP policies right now

If your tenant is in the preview ring, you can start making adjustments immediately. The setting lives in the Microsoft Purview portal, inside each DLP rule that targets SharePoint and OneDrive locations. Here’s a step-by-step approach:

  1. Inventory your existing rules. Open the Purview portal, navigate to Data loss prevention > Policies, and filter by location to see only SharePoint and OneDrive rules. Note which rules currently use both policy tips and email notifications.
  2. Classify each rule by risk and audience. Ask: Is this rule meant to block, educate, or monitor? Who really needs to know when it fires—the editor, the owner, or a compliance officer? If the answer is “it depends,” split the logic into multiple rules with different notification modes.
  3. Map notification modes to rule types. Use policy tip only for low-risk nudges (e.g., “This document contains customer contact info—verify it’s intended for external sharing”). Use email only for governance checks where the editor doesn’t need to stop working but a site owner should review the file later. Reserve both for high-stakes scenarios like external sharing of payment card data or health records. Use neither for silent monitoring, temporary test rules, or automated service accounts where user messaging is pointless.
  4. Craft messages that match the channel. Policy tips are plain text with a 256-character limit, so they must be direct: “Remove credit card numbers or apply the Confidential label before sharing.” Emails can include HTML, links, and remediation steps, so use the extra space to explain the policy, provide a help desk contact, and include the document URL (but never the sensitive data itself).
  5. Test with a small group. Before applying changes broadly, choose a pilot site or a subset of users and verify that tips appear where expected and emails reach the right people. Check that tips show up in the Office desktop apps if your environment supports them.
  6. Monitor and tune. Use the DLP reports in the Purview portal to see how often rules fire, whether users override, and whether false positives cluster around certain file types. Adjust notification modes as the rule matures.

What’s still missing—and the fine print

The new flexibility doesn’t erase existing Purview limitations. Smart admins will keep a few guardrails in mind:

  • Emails are not an audit feed. Because only one notification is sent per document, repeating incidents on the same file won’t generate new emails. Security teams should rely on Purview’s alerting, audit logs, and incident reports for full visibility.
  • You can’t email a group. Recipient fields accept individual addresses only, not distribution lists. If you need to notify a team, you’ll have to set up a shared mailbox, use Power Automate to forward the notification, or accept that one designated person gets the message.
  • Policy tips aren’t universal. They work only in the SharePoint and OneDrive web UIs and in supported Office clients. If your organization relies heavily on third-party editors, mobile apps, or legacy Office versions, the tip may never appear.
  • Emails remain unprotected. The message body is plain text and can be forwarded. Never include the actual sensitive data, full detection logic, or a detailed compliance strategy inside an email notification.
  • OneDrive sync behavior is asynchronous. A tip triggered in the web client may not propagate instantly to the desktop. Users who edit files offline may not see a tip until they reconnect, which can cause confusion if a sharing action is blocked silently beforehand.

Microsoft has also clarified that actionable email notifications—where recipients can stop sharing or apply a label directly from the message—remain in preview for SharePoint and OneDrive. Organizations that want to use those features should test them thoroughly before making them part of a formal incident-response workflow.

The bigger picture: DLP communication as a dial, not a switch

Data Loss Prevention isn’t just a detection problem; it’s a communication challenge. A rule that catches a credit card number is useless if the person holding the file doesn’t know how to fix it, or if the person who should enforce the rule never learns about the violation. The decoupling moves Purview closer to a model where compliance officers can design the right conversation for each situation.

For years, the product forced a one-size-fits-all conversation. Now, a marketing department can get gentle policy tips without inbox clutter while the finance team receives detailed emails for every high-risk external share. A test rule can run silently while the security team evaluates its false-positive rate. A blocked external share can trigger both a tip that stops the user and an email that creates a records trail.

None of this changes the fundamental truth that DLP is a layered process—detection, prevention, notification, remediation, and tuning. But by giving admins control over the notification layer, Microsoft has made the whole stack more useful. The roadmap date may look distant, but the preview is here now. For organizations that have been waiting to untangle their DLP alerts, the time to start planning is before July rolls around.