When I click dismiss once I would like to be asked for a reason and input the details so there is good understanding for you and us. eg. Advised the customer to remove the vpn or remove outlook from their device. Add Expected rule would be insecure, adding an Unauthorized rule will block the user