Purview DLP - In Scope Users and Groups

A standard non-mail-enabled security group is not a generally supported Exchange DLP scope; use a mail-enabled security group, distribution group, or Microsoft 365 group instead.

Why the group does not appear

The broad Exchange Online location table lists non-mail-enabled security groups, but the detailed group-support matrix adds the controlling limitations:

• Non-mail-enabled security group, assigned membership: supported during policy creation only for specific customers.
• Non-mail-enabled security group, dynamic membership: may be supported during creation.
• Both types: marked No for rule evaluation.
• Mail-enabled security groups, distribution groups, and Microsoft 365 groups: supported during both policy creation and rule evaluation. ^1^

Consequently, a regular Entra security group might not appear in the Purview picker unless that limited creation-time capability is enabled for the tenant. Even if it appeared, the documented matrix does not indicate general Exchange rule-evaluation support.

Supported resolution

Create or select one of these group types and add the users that the Exchange DLP policy must cover:

1. Mail-enabled security group
2. Distribution group, assigned or dynamic
3. Microsoft 365 group, assigned or dynamic

Then edit the policy:

1. Go to Microsoft Purview portal → Data Loss Prevention → Policies.
2. Open the policy and select Edit policy.
3. Under Locations, keep Exchange email enabled.
4. Open Scope for Exchange email.
5. Select Specific groups.
6. Search for and select the supported group.
7. Save the policy and deploy it in the required policy mode.

For Exchange location scoping, membership determines which senders are covered. If both include and exclude scopes are configured, exclusion overrides inclusion. ^1^

Do not confuse location scope with rule conditions

If the group is being referenced inside an Exchange DLP rule—for example, Sent to member of—the supported inputs are also limited to distribution groups, mail-enabled security groups, and Microsoft 365 groups. Standard non-mail-enabled security groups are not listed for sender- or recipient-based conditions. ^2^

There is one client-specific caveat: Microsoft documents that classic Outlook does not display policy tips for policies scoped to non-mail-enabled security groups, although rule actions can be enforced. That does not make these groups generally selectable or evaluated for every tenant; it applies where that limited scoping capability is available. ^3^

If a supported mail-enabled or Microsoft 365 group also fails to appear, that is a separate picker or tenant issue and should be raised through Microsoft 365 support with the policy ID, group type, group object ID, and a screenshot of the empty search result.

References

1. Data Loss Prevention policy reference
2. Data loss prevention Exchange conditions and actions reference
3. Data loss prevention policy tip reference for Outlook for Microsoft 365