Skip to content

Update New-DlpComplianceRule.md with parameter notes #13100

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 15, 2025
Merged

Update New-DlpComplianceRule.md with parameter notes #13100

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
96a01aa
Update New-DlpComplianceRule.md with parameter notes
ybhargav1995 Sep 15, 2025
d30f287
Update New-DlpComplianceRule.md
chrisda Sep 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions exchange/exchange-ps/ExchangePowerShell/New-DlpComplianceRule.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1155,14 +1155,18 @@ The EvaluateRulePerComponent parameter specifies whether a match for conditions
- $true: A DLP rule match for conditions and exceptions must be in the same message component (for example, in the message body or in a single attachment).
- $false: A DLP rule match for conditions and exceptions can be anywhere in the message.

For example, say a DLP rule is configured to block messages that contain three or more Social Security numbers (SSNs). When the value of this parameter is $true, a message is blocked only if there are three or more SSNs in the message body, or there are three or more SSNs in a specific attachment. The DLP rule doesn't match and the message isn't blocked if there are two SSNs in the message body, one SSN in an attachment, and two SSNs in another attachment in the same email message.
For example, a DLP rule is configured to block messages that contain three or more Social Security numbers (SSNs). When the value of this parameter is $true, a message is blocked only if there are three or more SSNs in the message body, or there are three or more SSNs in a specific attachment. The DLP rule doesn't match and the message isn't blocked if there are two SSNs in the message body, one SSN in an attachment, and two SSNs in another attachment in the same email message.

**Note**: When the value of this parameter is $true, the scoping within Content Contains condition is overriden. In other words, even if the scoping is set to Attachments only, the message body is also scanned as a separate component. Even when the scoping is set to Message only, attachments are scanned as individual components.

This parameter works with the following conditions or exceptions only:

- Content contains
- Attachment contains
- Attachment is not labeled
- File extension is
- Content contains.
- Attachment contains.
- Attachment is not labeled.
- File extension is.

**Note**: Unsupported conditions evaluate the entire email message and attachments as a single component. Supported conditions are evaluated for each email message component.

```yaml
Type: Boolean
Expand Down