Hello team, Purview DLP in Sharepoint, I create a DLP with override option, so, what is the duration for the override? then, In SPO I did the override for the file to bypass the blocking sharing. How long this override duration will have, when do I need to provide override again? For how long the override bypass the blocking will be active, when do I need to apply the override again, Is the override for ever to share externally?

There is no duration, the sharing will be active until revoked. You might want to configure link expiration settings in SharePoint/ODFB, so that sharing links automatically expire after some time.

Purview DLP in Sharepoint: How long the override is active and when should I provide override next time?

Accepted answer

Vasil Michev 98,766 Reputation points MVP

2024-06-20T06:39:29.64+00:00

There is no duration, the sharing will be active until revoked. You might want to configure link expiration settings in SharePoint/ODFB, so that sharing links automatically expire after some time.
Please sign in to rate this answer.
Sergio Londono 406 Reputation points

2024-06-20T12:30:35.69+00:00

Hello @Vasil Michev Thanks for the reply, unfortunately the question is more related to DLP in sharepoint for Override.

Let suppose the end-user plans to share a file that is in scope for DLP policy that block the creation of sharing link to external user1. the user can't create the sharing link.

there is a pop-up with the DLP policy tip requesting override and the user needs to provide a justification to bypass the DLP blocking policy.

the user add the override with the justification and it was allowed to bypass the DLP blocking policy to external user1.

2 hours later the end-user needs to share the same file with external USER2 which is a total different user that was allowed from the first override, in this case the end-user was allowed to share the file without any pop-up policy tip or without require add override/justification.

Meaning that the override executed in step 3 continue active and the file continue allowed to create sharing links to external without enforcing the DLP blocking restriction.

meaning that if the end-user override one time the DLP blocking policy, the file will continue without DLP protection. the objective is to know if that file will continue without the DLP protection or if there is a timer that will remove the first override.

Why the end-user is able to create a second sharing link to other external user without override and provide a justification?

I believe the override to bypass the DLP blocking policy should be required each time the user plan to share sensitive data with external users.

I hope this help to understand the challenge and the question.

thanks,

Sergio Londono 406 Reputation points

2024-06-26T13:32:49.53+00:00

@Vasil Michev

I found if you do one time override the DLP policy in sharepoint and Onedrive, the file become shareable without any expiration, this is a security breach because even other user who didn't provide the override can share the file.

Please see link associated to this

https://feedbackportal.microsoft.com/feedback/idea/03f51584-c457-ee11-a81c-000d3ae46fcb

https://feedbackportal.microsoft.com/feedback/idea/28da7bb5-0e69-ee11-a81c-0022484e5453

The answer is: Override DLP policy in Sharepoint and OneDrive doesn't expire.

Best regards,
Sign in to comment

Share via

Purview DLP in Sharepoint: How long the override is active and when should I provide override next time?

0 additional answers