You are configuring a data loss prevention (DLP) policy to report when credit card data is found on a Microsoft Entra joined Windows device. You plan to use information from the policy to restrict…

User notifications inform users about policy matches but do not enforce restrictions on data activities.

To restrict the ability to copy sensitive data to the clipboard, you must configure an 'action' within the advanced DLP rule. Endpoint DLP actions allow you to control specific user activities, such as blocking or auditing the copying of sensitive data to the clipboard on a Microsoft Entra joined Windows device.

User overrides provide a mechanism for users to bypass a restriction with justification, but they are not the setting used to define the restriction itself.

The incident report specifies how and to whom alerts about policy matches are sent, which is for auditing and alerting, not for restricting data activities.