Using Microsoft Purview for Data Identification?

Question

Hello,

We have successfully set up the Microsoft Purview Information Protection Scanner to scan an on-premises file server hosted on Linux using an SMB share. The scanner cluster is fully working and scans are completing successfully. In Activity Explorer, we see "File Discovered" events, which can confirm this. 

However, we are not finding any DLP-related events or any detections of sensitive information from to these scanned files. Our goal is to use Purview to identify and monitor sensitive data on this on-premise file share, but currently the results only appear to show file discovery. A DLP policy has been created for the on-premise scanning, but the scan results still seem limited to discovery activity only. Is there a way to customize scans to identify specific data?

Answer 1

Hi Addison Wolanin

It looks like you’re diving deep into Microsoft Purview and want to utilize it for identifying and monitoring sensitive data on your on-premises file share. It’s great to hear that you’ve set up the Information Protection Scanner and are able to see file discovery events!

However, I understand that you’re not seeing DLP-related events or detections of sensitive information, and that can definitely be frustrating. Here are a few things to consider that might help you out:

Ensure that Data Sources are Registered: Make sure that your on-premises file share is properly registered with Microsoft Purview for data use management. This is necessary for DLP policies to effectively identify and monitor sensitive data.

Check Policy Publishing: Double-check if your DLP policy is published correctly. Policies remain in draft mode until published; ensure you have the necessary permissions to publish and that the policy is published to the right data sources.

Sensitivity Labels and Classification: Analyze if the data you’re looking for falls under any of the sensitivity labels or classification types you've set up. Verify that the labels are correctly associated with the data and are published to users who need access.

Explore Custom Classifications: If you have specific data types you want to identify, you can create custom classifications and rules. This would allow you to define exactly what sensitive data you want the scanner to track.

Scan Rule Configuration: Check if the scan rules are set up specifically to look for the sensitive information types that are relevant to your DLP policies.

Time for Enforcement: Sometimes there can be a delay in seeing DLP results after a scan. Depending on the type of DLP policy, it can take several hours to enforce after the scan.

If these suggestions don’t solve the issue, could you provide a bit more information? Here are some follow-up questions that might help clarify things:

1. Have you confirmed that the on-premises data source is registered for data use management?
2. Can you verify if the DLP policy is published and has the right permissions set up?
3. Are you using any specific sensitivity labels or classifications that you expect to apply to the detected information?
4. How are you currently configuring the scan rules in your Purview setup?
5. Are there specific types of sensitive information you are trying to monitor?

Hope this helps, and I look forward to your response!

References

• Enable data use management on your Microsoft Purview sources
• Authoring and publishing data owner access policies
• Sensitive information types in Microsoft Purview
• Check for missing or incorrectly labeled assets