From 96a01aa0835ee1d5d93f44afe06a3f45e439e1ff Mon Sep 17 00:00:00 2001 From: ybhargav1995 <102363816+ybhargav1995@users.noreply.github.com> Date: Mon, 15 Sep 2025 13:33:33 +0530 Subject: [PATCH 1/2] Update New-DlpComplianceRule.md with parameter notes Clarified behavior of DLP rule matching with new notes on parameter effects. --- .../exchange-ps/ExchangePowerShell/New-DlpComplianceRule.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/exchange/exchange-ps/ExchangePowerShell/New-DlpComplianceRule.md b/exchange/exchange-ps/ExchangePowerShell/New-DlpComplianceRule.md index 1936b0c804..1e6fafd94d 100644 --- a/exchange/exchange-ps/ExchangePowerShell/New-DlpComplianceRule.md +++ b/exchange/exchange-ps/ExchangePowerShell/New-DlpComplianceRule.md @@ -1157,6 +1157,8 @@ The EvaluateRulePerComponent parameter specifies whether a match for conditions For example, say a DLP rule is configured to block messages that contain three or more Social Security numbers (SSNs). When the value of this parameter is $true, a message is blocked only if there are three or more SSNs in the message body, or there are three or more SSNs in a specific attachment. The DLP rule doesn't match and the message isn't blocked if there are two SSNs in the message body, one SSN in an attachment, and two SSNs in another attachment in the same email message. +**Note** : When this is turned on the scoping within Content Contains condition is overriden, that is even if the scoping is set to Attachments only the message body will also be scanned as a separate component and even when the scoping is set to Message only the attachments are scanned as individual components. + This parameter works with the following conditions or exceptions only: - Content contains @@ -1164,6 +1166,10 @@ This parameter works with the following conditions or exceptions only: - Attachment is not labeled - File extension is +**Note** : When the rule contains any conditions other than the above, the unsupported conditions will be evaluated considering entire email including the attachments as a single component, but the supported conditions are evaluated for each component. + + + ```yaml Type: Boolean Parameter Sets: (All) From d30f2879138e4a2053a7db8b011a0228152d6d80 Mon Sep 17 00:00:00 2001 From: Chris Davis Date: Mon, 15 Sep 2025 08:42:01 -0700 Subject: [PATCH 2/2] Update New-DlpComplianceRule.md --- .../ExchangePowerShell/New-DlpComplianceRule.md | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/exchange/exchange-ps/ExchangePowerShell/New-DlpComplianceRule.md b/exchange/exchange-ps/ExchangePowerShell/New-DlpComplianceRule.md index 1e6fafd94d..6896738852 100644 --- a/exchange/exchange-ps/ExchangePowerShell/New-DlpComplianceRule.md +++ b/exchange/exchange-ps/ExchangePowerShell/New-DlpComplianceRule.md @@ -1155,20 +1155,18 @@ The EvaluateRulePerComponent parameter specifies whether a match for conditions - $true: A DLP rule match for conditions and exceptions must be in the same message component (for example, in the message body or in a single attachment). - $false: A DLP rule match for conditions and exceptions can be anywhere in the message. -For example, say a DLP rule is configured to block messages that contain three or more Social Security numbers (SSNs). When the value of this parameter is $true, a message is blocked only if there are three or more SSNs in the message body, or there are three or more SSNs in a specific attachment. The DLP rule doesn't match and the message isn't blocked if there are two SSNs in the message body, one SSN in an attachment, and two SSNs in another attachment in the same email message. +For example, a DLP rule is configured to block messages that contain three or more Social Security numbers (SSNs). When the value of this parameter is $true, a message is blocked only if there are three or more SSNs in the message body, or there are three or more SSNs in a specific attachment. The DLP rule doesn't match and the message isn't blocked if there are two SSNs in the message body, one SSN in an attachment, and two SSNs in another attachment in the same email message. -**Note** : When this is turned on the scoping within Content Contains condition is overriden, that is even if the scoping is set to Attachments only the message body will also be scanned as a separate component and even when the scoping is set to Message only the attachments are scanned as individual components. +**Note**: When the value of this parameter is $true, the scoping within Content Contains condition is overriden. In other words, even if the scoping is set to Attachments only, the message body is also scanned as a separate component. Even when the scoping is set to Message only, attachments are scanned as individual components. This parameter works with the following conditions or exceptions only: -- Content contains -- Attachment contains -- Attachment is not labeled -- File extension is - -**Note** : When the rule contains any conditions other than the above, the unsupported conditions will be evaluated considering entire email including the attachments as a single component, but the supported conditions are evaluated for each component. - +- Content contains. +- Attachment contains. +- Attachment is not labeled. +- File extension is. +**Note**: Unsupported conditions evaluate the entire email message and attachments as a single component. Supported conditions are evaluated for each email message component. ```yaml Type: Boolean