Fix Teams DLP Policy Does Not Block a Message in a Private Channel

When a data loss prevention policy fails to block a message in a private channel, users can send sensitive content without warning. This usually happens because the policy scope does not include private channels. Microsoft Teams applies DLP policies to standard channels by default, but private channels require explicit configuration. This article explains the root cause and shows how to fix the policy so it blocks messages in private channels.

Private channels in Teams have their own site collection in SharePoint. DLP policies that target Teams chat and channel messages must be extended to cover these site collections. If the policy is set to only scan standard channels, private channel messages bypass the rules. You will learn how to adjust the policy scope and verify the protection works.

Why Teams DLP Policy Does Not Block Messages in Private Channels

Data loss prevention policies in Microsoft 365 scan content in Exchange, SharePoint, OneDrive, and Teams. In Teams, DLP policies apply to chat and channel messages, but they only cover standard channels unless you add the private channel sites manually. Each private channel has a dedicated SharePoint site collection that stores all messages and files. When you create a DLP policy in the Microsoft Purview compliance portal, the Teams location option includes all standard channels by default. Private channels are separate and are not automatically added to the policy scope.

The root cause is that the policy location for Teams chat and channel messages does not expand to include private channel SharePoint sites. Even if the policy is set to block sensitive data types, the private channel messages are never scanned. This is a known behavior because private channels have isolated site collections that require explicit inclusion in the policy.

Another factor is that DLP policies for Teams only work when the policy is assigned to a user or group that is part of the policy scope. If the private channel owner or member is not in the policy scope, the messages are not evaluated. You must verify that the policy applies to the correct users and that the private channel site is added as a location.

What DLP Covers in Teams Private Channels

DLP policies can block messages that contain credit card numbers, social security numbers, or other sensitive info. In private channels, the policy must be configured to scan the SharePoint site that backs the channel. Without this, the messages are stored in the site but never inspected.

Steps to Fix the DLP Policy for Private Channels

Follow these steps to update your DLP policy so it blocks messages in private channels. You need to be a global admin or a compliance admin to make these changes.

1. Identify the private channel SharePoint site URL
   Open the Teams admin center at admin.teams.microsoft.com. Go to Teams > Manage teams. Select the team that contains the private channel. Go to the Private channels tab and note the Site URL for each private channel. Write down these URLs because you will add them to the DLP policy.
2. Open the Microsoft Purview compliance portal
   Go to compliance.microsoft.com and sign in with your admin account. In the left navigation, select Data loss prevention and then Policies. Find the policy that is not blocking private channel messages and select it.
3. Edit the policy locations
   In the policy details page, select Edit policy. Go to the Locations section. Under Teams chat and channel messages, select Edit. The current location shows All teams and all channels. Change this to Specific teams and channels.
4. Add the private channel site as a location
   Select Add and choose the team that contains the private channel. Then select the specific private channel from the list. If your private channel does not appear, you must add the SharePoint site URL manually. Use the Add link next to Additional locations and paste the site URL from step 1. Save your changes.
5. Verify the policy settings for sensitive info
   In the same policy edit flow, confirm that the conditions and actions are correct. Go to the Rules section and check that the rule blocks messages containing your target sensitive info types. Set the action to Block messages and allow override if needed. Save the policy.
6. Test the policy in a private channel
   Sign in as a user who is a member of the private channel. Send a message that contains a test sensitive data pattern, such as a fake credit card number. The message should be blocked or trigger a policy tip. If it is not blocked, go back to the policy and confirm the private channel site is listed under locations.

Using PowerShell to Verify the Policy Scope

You can also use PowerShell to check which sites are included in the DLP policy. Connect to Security & Compliance Center PowerShell and run the Get-DlpCompliancePolicy cmdlet. The output shows the ExchangeLocation and SharePointLocation properties. Ensure the private channel site URL appears in the SharePointLocation list.

If Teams Still Allows Sensitive Messages in Private Channels

Private channel site is not added to the policy

The most common reason is that the private channel site URL is missing from the policy locations. Go back to the policy and add the exact site URL. Use the full URL that appears in the Teams admin center, including the /sites/ path.

Policy does not apply to the user sending the message

DLP policies apply to users who are included in the policy scope. If the private channel member is not in the policy’s user list, the message is not scanned. Edit the policy and add the user or group to the Users and groups section.

Policy tips are disabled for private channels

Even if the policy is applied, policy tips may not show in private channels if the Teams client is outdated. Update Teams to the latest version and test again. Policy tips appear as a warning under the message box.

DLP policy is in test mode

If the policy is set to Test mode, it will not block messages. Change the mode to Enforce in the policy settings. Then test again to confirm blocking works.

DLP Policy for Private Channels vs Standard Channels: Key Differences

Item	Standard Channel	Private Channel
Default DLP coverage	Included automatically	Not included automatically
SharePoint site	Shared team site	Separate site collection per channel
Policy location	Teams chat and channel messages	Must add site URL manually
Policy tips	Show in Teams client	Show only after site is added
Block action	Works by default	Works after configuration

You can now update your DLP policy to cover private channels by adding the site URL. Test the policy with a sample sensitive message to confirm it blocks. For advanced control, use PowerShell to review the SharePointLocation property in your policy. Remember to keep the Teams app updated to see policy tips in private channels.