DLP - Custom Content Type

Question

I have been trying to create DLP policies around custom content types and their meta data and have been running in to issues. So for the background we have been trying to implement DLP policies by using custom properties versus the pre-built properties that O365 is already aware of.  I've been following the directions from here:

https://support.office.com/en-us/article/Create-a-DLP-policy-to-protect-documents-with-FCI-or-other-properties-1b9e3c6c-4308-4a20-b11e-c37b8013e177?ui=en-US&rs=en-US&ad=US&fromAR=1

I can create the custom content type, with columns to manage the meta data. I can see the columns in the Crawled Properties, and I can map those to a managed property. When I create the DLP policy off of the managed property it is triggering an alert regardless of what the properties content. For example I create a custom content type called "Business File", and that content type has a column associated with it called "Business Risk" which has three levels: Low, Medium, High, with a default of Medium. When I create a new managed property I can see the crawled property of "Business Risk" which I map to a managed property of BRISK. When I create the DLP property, I select custom property of BRISK with a value of "HIGH" and block and alert. When I go back to that library and select New, Business File, it creates the new file, defaults to "Medium" on the Business Risk column, which I change to "Low". It usually takes about 30 minutes, but then the file will be blocked, regardless of what is in the Business Risk column. If I upload a file and select as type Business File, it will default to "Medium" but DLP will not trigger off of those files, even if I set to "High".

Anyone have luck creating custom DLP in SPOL using managed properties?

Answer 1

Hi Steven,

Thanks for the detailed information.

From the screenshot, I notice that you mapped the DLPClass property, we need to map the ows_DLPCALSS property. Could you try to map the ows_DLPCALSS property to see the outcome?

Regards,

Allan

Answer 2

Allan/Ryan,

I finished this mapping this morning and it looks like DLP is functioning as expected. Appreciate the help!

Thanks,

Steve

Answer 3

Hi Steven,

Have you try mapping map the ows_DLPclass property as Allen suggested? We'd appreciate if you can share any updates

Regards,

Ryan

Answer 4

I've been testing for about a week now, and I've manually requested the crawls and re-indexing. Here are the screen shots, let me know if you need more:

Answer 5

Hi Steven,

Firstly, I would like to share an article with you.

Overview of data loss prevention policies

Regarding the issue, could you wait for some time (it may take up 24 Hours) or manually request crawling and re-indexing to see the outcome. As in SharePoint Online, content is automatically crawled based on a defined crawl schedule. The crawler picks up content that has changed since the last crawl and updates the index. For your reference:

Manually request crawling and re-indexing of a site, a library or a list

If the issue persists after waiting for it or performing a manually re-index, could you provide us with the detailed steps and some related screenshots about this for our further investigation?

Regards,

Allan