10.2 Interpret DLP Policy and Rule Precedence

The July 28, 2026 outline asks you to interpret policy and rule precedence in data loss prevention. Microsoft’s current published model lives in the Data Loss Prevention policy reference (priority by which rules are evaluated and applied) and in Send email notifications and show policy tips for DLP policies. Adaptive Protection Device DLP even restates the same idea: if the default Adaptive Protection Device policy and an independent Device policy both target a user, the most restrictive policy’s actions apply. Do not import Exchange mail-flow rule folklore. DLP does not stop at the first matching policy the way a transport rule with stop-processing might.

A DLP policy is a container: locations plus one or more rules. A rule holds conditions, actions, user notifications, optional user overrides, incident reports, and Additional options. Microsoft states that rules run sequentially, starting with the highest-priority rule in each policy. Priority is an evaluation order, not a promise that lower-priority rules are ignored.

Hosted service locations: first most-restrictive rule wins

For Exchange, SharePoint, and OneDrive, each rule is assigned priority in the order it is created. The rule created first has first (highest) priority; the next rule is second; and so on. Content is evaluated against rules in that order. If content matches multiple rules, the first rule evaluated that has the most restrictive action is enforced.

Microsoft’s canonical four-rule example is the one to memorize:

Restrict without override beats restrict with override, which beats notify-only. A later restrict-only rule does not steal enforcement from an earlier restrict-without-override rule. Matches for all of the rules are still recorded in the audit log and DLP reports. Investigators can see Rule 1 and Rule 4 fired even though the user only felt Rule 3.

The same most-restrictive logic applies when several policies match, not only when several rules sit in one policy. The policy-tips article is explicit: content can match several rules in one DLP policy or several different DLP policies, but only the policy tip from the most restrictive rule that has the highest priority is shown. Evaluation is not “policy 0 matches, stop.” Other policies still match and still write audit events; the user still sees one tip from the winning rule.

That grouping is why Microsoft tells you to put related protection requirements in one policy with several rules (for example every HIPAA rule together) instead of scattering overlapping HIPAA clones across ten policies. Overlap is legal; it is just harder to predict which tip the user sees.

Policy tips and overrides follow the same winner

Users must not see a cascade of tips. Only the policy tip from the most restrictive rule that has the highest priority is shown, including policies that are in simulation mode. A tip from a rule that blocks access is shown instead of a tip from a rule that only sends a notification. Custom policy tips follow the most restrictive rule, not necessarily the rule that is performing the restriction — a wording trap if two rules share a match but only one blocks.

If that winning rule allows people to override, overriding it also overrides any other rules the content matched. Override is therefore a precedence feature, not a per-rule peephole. User overrides require Notify users in Office 365 services with a policy tip. If you set an override action but BlockAccess is not true (or BlockAccessScope is wrong), the tip appears without an override control. Overrides are not available for on-premises repositories.

On endpoints, if the user selects Allow for print, copy to USB, or copy to a network share, they have 30 seconds after the popup; miss that window and the activity stays blocked. Other device activities must be retried after Allow.

Endpoint DLP: aggregate the most restrictive actions

Devices do not collapse to a single rule. When an item matches multiple DLP rules, Endpoint DLP runs a documented calculation and applies the aggregate or sum of the most restrictive actions. Factors:

Worked Microsoft scenarios use three policies, all matching credit cards or SSNs:

• ABC (priority 0): block print, audit other egress.
• MNO (priority 1): block copy to USB, audit other egress.
• XYZ (priority 2): block copy to clipboard, audit other egress; also blocks print in the SSN example.

Credit cards only, both ABC and MNO Turn it on: runtime blocks print and USB, audits the rest. Credit cards and SSNs, all three on: runtime blocks clipboard, USB, and print. Credit cards, ABC on and MNO in simulation: MNO’s USB block does not enforce; runtime blocks print (from ABC) and audits USB. Credit cards, ABC blocks USB with override and MNO blocks USB without override: runtime is block without override.

Simulation rewrites the configured action at runtime:

Allow as a DLP action exists on Devices. A simulation-mode Adaptive Protection Device policy that “blocks” USB is therefore not blocking in production until you switch the policy to Turn it on — which is why quick setup’s Adaptive Protection DLP policies start in simulation.

Additional options, list order, and what precedence is not

Additional options on a rule can set evaluation priority and stop further rule and policy processing after a match. Microsoft documents that stop-processing control only for Exchange and Teams locations. Do not promise it on SharePoint, OneDrive, or Devices.

On endpoints, Microsoft’s worked examples number policies 0, 1, and 2, with 0 as the highest-priority policy. When two Turn-it-on policies configure the same action, that highest-priority policy supplies the action. When they configure different actions, both the priority-0 print block and the priority-1 USB block can apply together. Raising a blocking policy’s priority therefore matters for identical actions; it does not hide another policy’s matches from audit logs or DLP reports.

What precedence is not:

• It is not “priority 0 means ignore every other policy.” Other policies still evaluate. Hosted workloads still pick the most restrictive matching rule among those evaluated; endpoints still sum blocks.
• It is not mail-flow order. Microsoft Q&A on overlapping DLP policies repeats the product behavior: priority does not make DLP first-match-wins.
• It is not “the notify-only rule hides the block.” The block is more restrictive, so the block (and its tip) wins on hosted locations.
• It is not Adaptive Protection replacing this model. Adaptive Protection is a condition. Once two Device policies match, you are back in most-restrictive aggregation.
• Custom Learn more URLs on Exchange policy tips override the tenant Set-PolicyConfig -ComplainceURL value (Microsoft’s cmdlet spelling). That is URL precedence, not rule precedence.

Design implication you should be able to say out loud: if two policies fight, reduce overlap or combine the logic into one policy with ordered rules. Use simulation to see which rule is most restrictive before you Turn it on. When you can walk the four-rule hosted example, the ABC/MNO/XYZ endpoint grid, the simulation rewrite table, and the single-tip/override-all behavior, you can interpret DLP precedence on SC-401.