Change the Response of Multiple Incidents

DLP policies determine the response to violations, but you can change the status of one or more incidents to better reflect the outcome you would like.

Note that available responses may vary depending on the type of violation and the type of interaction that triggered the response.

To work with bulk remediation for Office 365 groups, see Revoke Collaboration in Office 365 Groups.

To change the response of DLP incidents:

1. Go to Incidents > Policy Incidents.
2. In the Omnibar, filter incidents and select their checkboxes. 
3. Go to Actions > Select Response. 
   
4. Select a Response, Status, and Email Template from the menu. 
   
5. Click Submit.

The response is validated. If the response is not compatible with the incident, an error message appears. Try choosing a different response.