Prepare environment for monitoring confidential file movement using DLP

Question

Prepare environment for monitoring confidential file movement using DLP

jpcapone 1,776

I am deploying DLP policies in an effort to monitor the movement of confidential files. Is there any specific settings within the policies that should be configured to monitor the ingress/egress of files? What type of reports do I run to follow up on this?

Accepted answer

0 additional answers

Your answer

Answer 1

Ganesh Gurram 7,295 Microsoft External Staff Moderator

@jpcapone - Thanks for the question & using MS Q&A platform.

Unfortunately, there is no specific settings within the policies that should be configured to monitor the ingress/egress of files in DLP policies.

According to the document: DLP Activity Explorer and reports

Note: All DLP monitored activities are recorded to the Microsoft 365 Audit log by default and routed to Activity explorer.

The Activity explorer tab on the DLP page has multiple filters you can use to view DLP events. Use this tool to review activity related to content that contains sensitive info or has labels applied, such as what labels were changed, files were modified, and matched a rule.

You can view the last 30 days of DLP information in Activity Explorer using these preconfigured filters:

Endpoint DLP activities
Files containing sensitive info types
Egress activities
DLP policies that detected activities
DLP policy rules that detected activities

For more details, refer to Get started with activity explorer.

Hope this helps. Do let us know if you have any further queries.

------------

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

jpcapone 1,776 Reputation points

2024-10-15T11:44:25.61+00:00

Thank you for the answer. So deploying any type of DLP policy will cause the ingress/egress activities to become monitored?
Ganesh Gurram 7,295 Reputation points Microsoft External Staff Moderator

2024-10-16T05:25:25.8+00:00

@jpcapone - Deploying any type of DLP policy will not automatically monitor all ingress and egress activities for your files. The DLP policies need to be specifically configured to track the movement of files containing sensitive information. You can configure the policies to monitor the movement of files by specifying the sensitive information types and the actions to take when sensitive information is detected. Once the policies are configured, the ingress and egress activities for files containing sensitive information will be monitored and recorded in the Microsoft 365 Audit log by default and routed to Activity explorer.
Hope this helps. Do let us know if you have any further queries.
jpcapone 1,776 Reputation points

2024-10-16T12:02:38.2266667+00:00

Perfect. Thank you!!!
jpcapone 1,776 Reputation points

2024-10-16T12:05:14.8+00:00

If we are just getting started, would it make sense to make on DLP policy with all of the SITs or multiple DLP policies with different SITs?
Ganesh Gurram 7,295 Reputation points Microsoft External Staff Moderator

2024-10-17T06:35:10.0366667+00:00

@jpcapone - The scope of your question is different compared to the original scope of the question asked.

I would recommend creating a new thread on the same forum with as much details about your issue as possible. That would make sure that your issue has better visibility in the community.
jpcapone 1,776 Reputation points

2024-10-17T11:46:10.9133333+00:00

thank you!

Share via

Prepare environment for monitoring confidential file movement using DLP

0 additional answers

Your answer