Data Loss Prevention

This provides flexibility for you to determine how sensitive data of your organization will be handled in Data Loss Prevention logs on Cloud App Security for privacy concerns.

• If the check box is not selected, Cloud App Security does not record and display violating content, including the sensitive data that triggered a Data Loss Prevention violation, in the Violating Content column in Logs.

• If Display violating content in logs with sensitive data Unmasked is selected, Cloud App Security records and displays violating content in the Violating Content column in Logs. The sensitive data that triggered a Data Loss Prevention violation is displayed without being masked.

  Note:

  Violating content including the sensitive data to display does not exceed 300 characters.

• If Display violating content in logs with sensitive data Masked is selected, Cloud App Security records and displays violating content in the Violating Content column in Logs. The sensitive data that triggered a Data Loss Prevention violation is replaced with asterisks (*), except for the last four characters.

  Note:

  If the sensitive data is no longer than four characters, it is displayed without being masked.

The default value is Display violating content in logs with sensitive data Unmasked.

If this setting is changed, it applies only to subsequent violating content. The previous content is not affected.

1. (OneDrive, Microsoft Teams - Teams, and SharePoint Online only) Add sensitivity labels and select the action.

   Optionally click Sync Labels to sync the latest sensitivity labels from Microsoft Information Protection.

   Note:

   Sensitivity label-based actions are available only after you have provisioned Microsoft Information Protection.

2. Add compliance templates, then select the action.

   You can also import compliance templates and edit or remove the existing templates.

   Note:

   • For the OneDrive, Microsoft Teams - Teams, SharePoint Online services, the Apply sensitivity label and Remove sensitivity label actions are available in addition to Pass, Delete, and Quarantine after you provision for Microsoft Information Protection. When you select the action Apply sensitivity label, click Show Advanced Options and configure Sensitivity Labeling.

   • For the actions applied to Salesforce, see the following table.

     Pass	Cloud App Security records the detection in a log and the object record content is unchanged.
     Quarantine	For text contents: Cloud App Security replaces half of the content violating the policy with asterisks (*) and moves the content to a restricted custom object. The quarantined content is not editable. For files: Cloud App Security moves the file to a restricted custom object and replaces it with a pre-configured file, informing the user that the original file violated a specific Cloud App Security policy and was replaced. Note: For files with a version history, for example, Chatter File, Cloud App Security does not remove it, but adds a feed comment to warn the user that the file violated a specific Cloud App Security policy.
     Delete	For files: Cloud App Security deletes the file and adds a pre-configured replacement file, informing the user that the original file violated a specific Cloud App Security policy and was removed. Note: For files with a version history, for example, Chatter File, Cloud App Security deletes the file and adds a feed comment to warn the user that the file violated a specific Cloud App Security policy and was removed. For text contents in Chatter and Community: Cloud App Security deletes the entire content. For text contents in Note, Cloud App Security deletes the note content and adds pre-configured text, informing the user that the original content violated a specific Cloud App Security policy and was removed. For text contents in other Salesforce object records: Cloud App Security records the detection in a log and replaces the entire content violating the policy with asterisks (*).

     For more information about each action applied to the other services and applications, see Adding Advanced Threat Protection Policies.

1. (Salesforce only) Select the Configure actions dedicated to files check box to separately configure actions for files.
   Note:

   When this option is selected, for a file, Cloud App Security takes the action specified here instead of the policy-level action described in step 5.

2. (Salesforce only) Select Apply secondary action when file quarantine fails and specify a secondary action if you want to take a backup action when the quarantine action for a file fails.
   Note:

   This option can be configured only when the Quarantine action is selected.

   • If Configure actions dedicated to files is enabled with the Quarantine action selected, the secondary action applies when this Quarantine action fails.
   • If Configure actions dedicated to files is not enabled, the secondary action applies when the policy-level Quarantine action (as described in step 5) for a file fails.
3. If the Tag file name action is selected, specify the tag to amend to the file name.
   Note:

   The tag cannot exceed 20 characters or contain unsupported characters (/ \ : * ? < > " |).

4. If the Quarantine or Delete action is selected, specify text to replace the original file content when a file is quarantined or deleted.
   Note:

   This option is not available for Exchange Online, Exchange Online (Inline Mode), and Gmail.

5. If the Apply sensitivity label action is selected, configure Sensitivity Labeling.

   1. Select a Microsoft Information Protection sensitivity label from the drop-down list.

      Note:

      The sensitivity labels are defined on the Microsoft 365 compliance center and automatically sync to Cloud App Security on a daily basis. If no sensitivity has been defined, you cannot specify the "Apply sensitivity label" action, and the policy cannot be saved.

   2. Optionally select Override the original sensitivity label.

      Note:

      The original sensitivity label refers to the sensitivity label that users have applied when uploading, creating, synchronizing, or modifying files in Microsoft Teams, SharePoint Online, or OneDrive.

   3. Optionally select Take a backup action when applying the sensitivity label fails and select an action from the drop-down list, which can be Pass, Delete, or Quarantine.

      Note:

      This backup action is taken on files that violate the Data Loss Prevention policy if Cloud App Security fails to apply the specified sensitivity label to the files for reasons such as that the specified sensitivity label has been deleted on the Microsoft 365 compliance center, or that the file type is not supported.

   4. Optionally click Click here to synchronize the latest sensitivity labels from Microsoft.

6. (Exchange Online - Inline Mode only) If the Change recipient action is selected, configure Change Recipient Action Settings.

   The Change recipient action intercepts emails and routes them to your specified recipients, allowing related personnel to have direct access to the emails violating a Data Loss Prevention policy.

   1. Type an email address in your organization to redirect emails to.

      You can add up to 5 email addresses.

   2. Type the disclaimer to inform the recipients why they receive this redirected email.

      You can use tokens in the message. Currently, the disclaimer only supports the token %policy_name%.