When the product is configured properly for third-party add-ins, DLP Outlook add-in sets itself to bypass mode if the following Outlook add-in is installed and active. This issue can be caused due to misconfiguration of DLP and third-party for Outlook. Setting up third-party add-in for Outlook is a two-step configuration:

1. In Policy Catalog, open the Windows Client Configuration. Select Settings, Operational Mode and Modules and verify that you selected the Activate 3rd Party Add-in Integration under Outlook Add-ins.
2. In Settings, Email Protection, select the Vendor Name from the drop-down list in the Outlook 3rd Party Add-in Integration option.

If you misconfigure and skip selecting the vendor name for Outlook 3rd Party Add-in Integration, multiple incidents get generated from the endpoint. 

To verify that the third-party add-in and DLP add-in has scanned the email, see the block incidents in HDLP_OThirdParty.log and HDLP_Outlook.log logs.

HDLP_OThirdParty.log - This log file is generated only when third-party plug-ins are enabled for email protection. It contains details about the email scanned by third-party plug-ins:

[ERROR][OutlookEmailAnalyzerImp::analyzeEmailWithParam(1038)]> Third Party support: Third Party classification parameter: TLPropertyRoot=Titus;Classification=t_class_1;
[ERROR][OutlookEmailAnalyzerImp::analyzeEmailWithParam(1036)]> Third Party support: Start analyzing outgoing email
[INFO][OutlookEmailAnalyzerImp::handleEmail(1629)]> Received block operation from agent, blocking email send


Similar log entries can be found in HDLP_Outlook.log:

[OINFO] [Outlook Probe] [MailInspector::HandleOutgoingEmail] Received block operation from agent, blocking email send