Add exception to DLP rule based on trigger word in email subject line - powershell or any other method

Question

Add exception to DLP rule based on trigger word in email subject line - powershell or any other method

Joseph Saling 1

I have setup DLP rules that apply email messages in Exchange online. It is currently in report only mode. It is working, identifying things like a SSN in an email message or an attachment.

We use a trigger word in email subject lines that will send a message automatically through secure email messaging - for example if SendSecured (case insensitive) is anywhere in the subject line and it doesn't have to be the only thing on the subject line, it will flow through the secure messaging system.

Today, these messages, even though sent correctly based on our policies, are being reported by DLP.

How do I add an exception to the DLP rule (or policy) so that it only triggers when ExceptIf SubjectContainsWords "SendSecured" is true?

all my searches lead me back to https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-conditions-and-exceptions?view=o365-worldwide where it appears this is the correct exception parameter to apply, but I've not been able to figure out how to do this in PowerShell. I can see that the field is blank, but I can't figure out how to add this.

Please help!

Joyce Shen - MSFT 16,701 Reputation points

2022-05-23T05:34:59.34+00:00

Hi @Joseph Saling

Is there any progress about your question so far? Have you tried the command below to meet your needs?

You could refer to the official ducument here which introduces the usages of this command: Set-DlpComplianceRule

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Joseph Saling 1 Reputation point

2022-05-24T13:35:04.367+00:00

Thank you for the suggestions. I didn't find the documentation very helpful from an example standpoint, but it's probably more me not really understanding.

In the end, I went back to the admin portal and made the policies only apply to Exchange instead of including SharePoint, Teams and OneDrive. Then the ExceptIfSubjectContainsWords exception setting option was available as a drop down. Much easier to include here. I'll have to create separate policies for the other services.

I didn't find a way to change the scope to just Exchange in the PowerShell commands.
Joyce Shen - MSFT 16,701 Reputation points

2022-05-30T06:57:52.72+00:00

Hi,

Thanks for your feedback, and we can see the introduction here about the parameter:
PRADEEPCHEEKATLA 90,641 Reputation points Moderator

2022-06-06T05:36:26.417+00:00

Hi @Joseph Saling ,

Just checking in to see if the below answer provided by @Vasil Michev helped. If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.
Joseph Saling 1 Reputation point

2022-06-06T14:07:04.96+00:00

@PRADEEPCHEEKATLA the answer provided by @Vasil Michev , while appreciated, did not answer my query.

I had already reviewed the documentation and was trying to apply the setting via PowerShell to no effect. In the end, I believe this was because the rule I was trying to adjust was scoped to Exchange, OneDrive and SharePoint while the setting I was attempting to apply was ONLY available for Exchange.

As I posted in my follow up, I changed the scope of the rule to only apply to Exchange, then I was able to select the Subject matching field in the GUI dropdown box and enter my desired terms. This was easier than using PowerShell (in my opinion).

1 answer

Your answer

Joyce Shen - MSFT 16,701 Reputation points

2022-05-23T05:34:59.34+00:00

Hi @Joseph Saling

Is there any progress about your question so far? Have you tried the command below to meet your needs?

You could refer to the official ducument here which introduces the usages of this command: Set-DlpComplianceRule

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Joseph Saling 1 Reputation point

2022-05-24T13:35:04.367+00:00

Thank you for the suggestions. I didn't find the documentation very helpful from an example standpoint, but it's probably more me not really understanding.

In the end, I went back to the admin portal and made the policies only apply to Exchange instead of including SharePoint, Teams and OneDrive. Then the ExceptIfSubjectContainsWords exception setting option was available as a drop down. Much easier to include here. I'll have to create separate policies for the other services.

I didn't find a way to change the scope to just Exchange in the PowerShell commands.
Joyce Shen - MSFT 16,701 Reputation points

2022-05-30T06:57:52.72+00:00

Hi,

Thanks for your feedback, and we can see the introduction here about the parameter:
PRADEEPCHEEKATLA 90,641 Reputation points Moderator

2022-06-06T05:36:26.417+00:00

Hi @Joseph Saling ,

Just checking in to see if the below answer provided by @Vasil Michev helped. If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.
Joseph Saling 1 Reputation point

2022-06-06T14:07:04.96+00:00

@PRADEEPCHEEKATLA the answer provided by @Vasil Michev , while appreciated, did not answer my query.

I had already reviewed the documentation and was trying to apply the setting via PowerShell to no effect. In the end, I believe this was because the rule I was trying to adjust was scoped to Exchange, OneDrive and SharePoint while the setting I was attempting to apply was ONLY available for Exchange.

As I posted in my follow up, I changed the scope of the rule to only apply to Exchange, then I was able to select the Subject matching field in the GUI dropdown box and enter my desired terms. This was easier than using PowerShell (in my opinion).

Answer 1

Vasil Michev 119.5K MVP Volunteer Moderator

The cmdlet you need is Set-DlpComplianceRule, and in your case likely the -ExceptIfSubjectOrBodyMatchesPatterns parameter will do for the exception. To get the rule, use this:

Get-DlpComplianceRule -Policy DLPPolicyName

All the cmdlets require you to connect to the SCC endpoint: https://learn.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell?view=exchange-ps

Share via

Add exception to DLP rule based on trigger word in email subject line - powershell or any other method

1 answer

Your answer