DLP Workflows for Incoming Emails
| Workflow | Description |
|---|---|
| Email is blocked. User is alerted and allowed to request a restore (admin must approve) | Detected email will not be delivered to the recipient and will be moved to quarantine mailbox. The user will receive an email with an alert of the quarantine action, and will be able to request to restore the original email (send the original email to the recipient). |
| Email is blocked. User is alerted and allowed to restore the email | Any detected email will not be delivered to the recipient and will be moved to quarantine mailbox; the user will receive an email with alert of the quarantine action, and will be able to restore the original email (send the original email to the recipient). |
| Do nothing | Any detected email will be delivered to the recipient without any changes. |
| User receives the email with a warning | The email is delivered to the user with a warning banner inserted in the body of the email. To customize the banner (text, background color etc.), click the gear icon next to the workflow. |
| Email is allowed. Header is added to the email | The detected email is delivered to the recipient with an additional header that can be configured in the policy. |
| Email is blocked. User is not alerted (admin can restore) | Detected email will not be delivered to the recipient and is automatically quarantined without any user notification. The administrator can restore the email. |
To create Allow-List for DLP, see DLP Exceptions.