Microsoft Message ID

Summary

• Microsoft is updating the sender email address for Teams Data Loss Prevention (DLP) Generate Incident Report (GIR) notifications.
• The current sender address, [email protected], will be replaced by [email protected].
• The transition is scheduled to begin on December 30, 2025, and is expected to be fully completed by late January 2026 (noted as January 30 in the update).

Impact

• Notification Delivery: If your organization uses automated rules, scripts, or third-party tools to process DLP incident reports based on the “From” address, these processes will fail once the change occurs.
• Email Filtering: There is a risk that the new sender address could be flagged as spam or quarantined if your email security gateways are not configured to recognize the new address.
• Admin Visibility: Security analysts and IT admins who monitor these reports may experience a disruption in their workflow if they rely on Outlook rules or folders sorted by the previous sender address.

Action Required

• Update Safe Senders: Add the new address [email protected] to your organization’s allow-lists or Anti-Spam bypass policies to ensure uninterrupted delivery.
• Modify Transport Rules: Review and update any Exchange Mail Flow rules (Transport Rules) that specifically reference the old Microsoft Information Protection sender address.
• Update Automations: Adjust any Power Automate flows, Logic Apps, or SIEM integration scripts that parse incident reports based on the sender’s identity.
• Review Documentation: Update internal standard operating procedures (SOPs) or security playbooks that instruct staff on how to identify official Teams DLP incident reports.