Microsoft Purview DLP rule matches are recorded, but no DLP alerts or email notifications are generated

A recorded DLP rule matched event in Activity Explorer does not guarantee that a DLP alert will be created. Activity Explorer can show detailed DLP match events from Microsoft 365 audit logs, including partial matches, while alerts are a separate rule configuration and investigation workflow.

For the scenario described, these are the supported checks and likely causes:

1. Confirm the rule’s alert configuration in the deployed policy In the Microsoft Purview portal, go to Data loss prevention > Policies > open the policy > Edit policy > Customize advanced DLP rules > open the rule, then verify under Incident reports that:
   • Send an alert to admins when a rule match occurs is On
   • Send alert every time an activity matches the rule is selected
   • the intended recipients are listed
   • the severity is set as expected
   Those are the settings that control alert generation.
2. Check the correct investigation locations DLP alerts can be investigated in both places, but the recommended locations differ by task:
   • Microsoft Purview portal: create and edit DLP policies
   • Microsoft Defender XDR dashboard: recommended location for investigating and managing DLP alerts
3. Use Activity Explorer only as evidence of policy match, not alert success The available information shows that Activity Explorer reports DLP-related activities and can be used to view policy matches and generate reports. It does not indicate that an alert was successfully created.
4. Consider alert type and aggregation behavior DLP alerts can be configured as:
   • Single-event alerts
   • Aggregate-event alerts
   Single-event alerts can still be aggregated within a time window. By default, events from a single rule that occur within one minute of each other are aggregated for E5, and 15 minutes for E3. That affects how alerts appear, but it does not explain a complete absence of alerts if alerting is correctly enabled.
5. Check workload-specific behavior for SharePoint and OneDrive For rules with alerts configured on SharePoint or OneDrive, only one alert per file per rule is sent, even if multiple users commit the same violation. If repeated tests used the same file and same rule, that can explain why additional alerts were not seen.
6. Email notification expectations When a rule is matched and alerting is configured, an alert email can be sent to the compliance officer or chosen recipients with event details. Optional email content can include:
   • person who last modified the content
   • sensitive content types that matched
   • rule severity
   • matched content and surrounding text
   • the item containing the matched content
   If no email is received, first verify that the rule still has Incident reports enabled and that the recipient is configured in that rule.
7. Retention window check The Microsoft Defender portal retains incidents for six months. The DLP alert management dashboard retains alerts for 30 days. This matters when validating older events.

For the specific questions:

1. What could cause a DLP rule match without a DLP alert? Supported causes from the available information are:
   • the rule matched, but alerting in Incident reports is not actually enabled in the deployed rule
   • the event appears in Activity Explorer as a detailed audit event and does not by itself prove alert creation
   • SharePoint/OneDrive one-alert-per-file-per-rule behavior prevented another alert for the same file
   • alert aggregation changed how the alert is grouped
2. How to verify alert-generation is enabled in the deployed rule? Reopen the policy in the Purview portal and inspect the rule’s Incident reports settings directly.
3. Additional logs, diagnostics, or PowerShell properties? The available information supports using Activity Explorer for DLP-related activities and exporting activity data with Export-ActivityExplorerData (ExchangePowerShell), O365 Management Activity API, or Incident API. No additional diagnostic command or PowerShell property is provided here that explains why a specific alert was not generated.
4. Could role group permissions or administrative unit scoping prevent the alert or incident from appearing? No supported information here confirms that permissions or administrative unit scoping can suppress alert creation or visibility in this scenario.
5. Does the empty diagnostic export prove the event was not passed correctly? No supported information here links those empty diagnostic export fields to DLP alert-generation failure.

A practical next validation path is:

1. Edit the rule and re-check Incident reports settings.
2. Test with a new file name in SharePoint or OneDrive to avoid the one-alert-per-file-per-rule behavior.
3. Review the event in Activity Explorer.
4. Check the alert in Microsoft Defender XDR first, then the Purview alerts dashboard.

References:

• Get started with the data loss prevention alerts
• Data Loss Prevention policy reference
• Create policy to detect and alert on U.S. PII data exposure
• Learn about investigating data loss prevention alerts