Double check emails on sending - Outlook/O365

[TheRobins]

Afternoon all,

 

Been asked to look in a suggestion that was recently raised during some DPA training. I have had a quick look and not sure its a do-able thing.

 

When any user sends an email from the main school/office account, after clicking send the user is requested/reminded to check the recipents and any attachments to add a barrier to any potentional data breaches and general headaches.

 

The slight complication is some users are via full fat Outlook and others via outlook 365 on the web,

 

Any suggestions?

[NegativeKillDeath]

You can look at DLP policies to forward specific messages to be approved by specific approvers. The problem with any system is the fatigue in doing it and then people just go into autopilot and allow things through without rigorously checking. 

[TheRobins]

Thanks for reply, Exactly this I did test it using DLP but, when an email might be urgent and no one who can auth it is near by its not worth it. 

[psydii]

EDIT NKD got there first. You can set an alert to appear if any recipients are external or students, and use DLP to block or warn based on classifiers (which these days it appears you can train up on, say, example reports from sims and the contents of the SEN teams folders).

We don't block, we warn. The Data Protection Officer gets a note about it and checks with people periodically. The occasional visit by the DPO keeps people on their toes, and improves their practice - it turns out, beside actual breaches, the amount of data flowing out of the org via email might be more than strictly necessary.

 

 

Edited October 3, 2025 by psydii

[TechMonkey]

This is an accountability thing.  If someone isn't trusted to send things from the School account they shouldn't have access to it.  You can set all the warnings and prompts you like but if someone is being dim and not paying attention it is going to happen and there is no way to stop that.

 

I've setup the pupil warning DLP, we have our pupils using a different format of username, a different format of display name, a single user pic and now a warning that reminds them to check they mean to send it to a pupil.  I guess you could setup a warning if there is an attachment. But staff need to be accountable for their actions and act accordingly.