Fix Teams DLP Policy Does Not Block a Message in Teams Admin Center

Your DLP policy in the Teams admin center is configured to block sensitive messages, but messages still go through. This usually happens because the policy applies to the wrong scope or because the condition uses an unsupported data type. In this article, you will learn the exact settings to check, how to correct the policy scope, and how to test the policy with a real message.

Data loss prevention policies in Teams rely on the Microsoft Purview compliance portal, not on the Teams admin center alone. The Teams admin center shows the policy but does not enforce it. Enforcement happens in Exchange Online, SharePoint, and OneDrive, and for Teams specifically, it uses the Teams chat and channel data classification. If your policy is not blocking, the most common cause is that the policy is set to audit-only mode or the condition references a sensitive info type that Teams does not support.

This guide walks you through the policy configuration steps, explains why the policy might not trigger, and provides a test procedure to confirm the fix. You will also find a table comparing the two main policy modes so you can choose the right one for your organization.

Why Your Teams DLP Policy Does Not Block Messages

The Teams admin center is not the enforcement point for DLP policies. The actual enforcement happens in the Microsoft Purview compliance portal, which scans messages in Teams chat and channels. When you create a DLP policy in the Purview portal, you must explicitly select the location “Teams chat and channel messages.” If you created the policy in the Teams admin center, it may only apply to other workloads.

Another common cause is the policy mode. By default, new DLP policies are often set to “Test” mode. In test mode, the policy logs violations but does not block the message. You must change the mode to “Enforce” for the policy to actually block the message.

The third cause is the sensitive info type. Teams supports a specific set of sensitive info types, such as credit card numbers, social security numbers, and passport numbers. If your policy uses a custom sensitive info type that is not recognized by Teams, the policy will not trigger. Check the list of supported types in the Microsoft Purview documentation.

Finally, the policy may be scoped to specific users or groups that do not include the sender or recipient. If the policy is scoped to a distribution group that does not contain the test user, the policy will not apply.

Steps to Diagnose and Fix the Teams DLP Policy

Follow these steps in order. Each step checks a specific part of the policy configuration.

1. Open the Microsoft Purview compliance portal
   Go to compliance.microsoft.com and sign in with an account that has the DLP Compliance Management role. You cannot edit DLP policies from the Teams admin center.
2. Locate your DLP policy
   In the left navigation, select Data loss prevention, then Policies. Find the policy that you want to fix. If the policy does not appear here, it was not created correctly.
3. Edit the policy
   Select the policy name to open the details page. Click Edit policy to change the settings.
4. Check the policy mode
   On the first page, look for the mode setting. If it says “Test mode,” change it to “Enforce” or “Turn on policy.” If you want to test without blocking, you can keep test mode, but then the message will not be blocked.
5. Verify the locations
   Go to the Locations section. Confirm that “Teams chat and channel messages” is selected. If it is not, select it and save the policy.
6. Check the conditions
   Go to the Conditions section. Review the sensitive info types that are used. If you use a custom type, verify that it is supported by Teams. If not, replace it with a built-in type.
7. Check the user scope
   Go to the Users and groups section. Ensure that the test user is included in the scope. If the policy is scoped to specific groups, add the test user to those groups or change the scope to All users.
8. Save and apply the policy
   Click Next and then Save. Wait at least 30 minutes for the policy to take effect. DLP policies do not apply instantly.

After you apply the changes, test the policy by sending a message that contains the sensitive content. For example, if the policy blocks credit card numbers, send a message with a number that matches the format. If the message is blocked, the policy works.

If Teams Still Does Not Block the Message

Teams Shows a Message That the Policy Is Not Applied

This error appears when the policy is not assigned to the correct location. Go back to the Locations section and confirm that “Teams chat and channel messages” is selected. Also check that the policy is not in “test mode.”

DLP Policy Applies to Channels but Not to Chats

The policy may be configured to apply to channel messages only. In the Locations section, you can choose to apply the policy to both chat and channel messages. Expand the location and select both sublocations.

DLP Policy Blocks Messages in Outlook but Not in Teams

This happens when the policy was created for Exchange or email and the Teams location was not added. Edit the policy and add the Teams location. You do not need to remove the Exchange location.

DLP Policy Does Not Block Images or Attachments

Teams DLP policies only scan text in messages. They do not scan images or attachments. If you need to block sensitive content in files, use a separate DLP policy for SharePoint and OneDrive.

DLP Policy Modes in Microsoft Purview: Enforce vs Test

Item	Enforce mode	Test mode
Blocks messages	Yes	No
Logs violations	Yes	Yes
Shows policy tips to users	Yes	Yes
Used for production	Yes	No
Used for validation	No	Yes

After fixing the policy, you can now rely on the DLP policy to block sensitive messages in Teams. Test with a real message to confirm the block works. If you need to adjust the policy for different data types, use the Microsoft Purview compliance portal to edit the conditions. For advanced scenarios, consider using the built-in DLP report to monitor blocked messages and false positives.