This article walks you through the prerequisites and configuration for using the Microsoft Purview Data Loss Prevention on-premises repositories location in a DLP policy.
All users who contribute to the scanned location, either by adding files or consuming files, need to have a license, not just the scanner user.
Permissions
Data from DLP can be viewed in activity explorer. There are four roles that grant permission to activity explorer, the account you use for accessing the data must be a member of any one of them.
Global administrator
Compliance administrator
Security administrator
Compliance data administrator
Viktig
Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should only be used in scenarios where a lesser privileged role can't be used.
Roles and Role Groups
There are roles and role groups in that you can test out to fine tune your access controls.
The Microsoft Purview Information Protection scanner implements DLP policy matching and policy enforcement. The scanner is installed as part of the information protection client, so your installation must meet all the prerequisites for the rights management encryption service, the information protection client, and the information protection scanner.
There must be at least one label and policy published in the tenant, even if all your detection rules are based on sensitive information types only.
Deploy the DLP on-premises scanner
Select the appropriate tab for the portal you're using. Depending on your Microsoft 365 plan, the Microsoft Purview compliance portal is retired or will be retired soon.
You must create a content scan job and specify the repositories that host the files to be evaluated by the DLP engine.
Enable DLP rules in the created content scan job, and set the Enforce option to Off (unless you want to proceed directly to the DLP enforcement stage).
Verify that your content scan job is assigned to the right cluster. If you haven't created a content scan job, create a new one and assign it to the cluster that contains the scanner nodes.
Connect to the Microsoft Purview portal and add your repositories to the content scan job that will perform the scan.
Do one of the following to run your scan:
Set the scanner schedule
Use the manual Scan Now option in the portal
Run Start-Scan PowerShell cmdlet
Viktig
Remember that the scanner runs a delta scan of the repository by default and files that were scanned in the previous scan cycle will be skipped, unless the file was changed or you initiated a full rescan. A full rescan can be initiated by using the Rescan all files option in the UI or by running Start-Scan -Reset.
Scope the DLP on-premises repositories rule to specific locations if needed. If you scope locations to All, all files scanned will be subject to the DLP rule matching and enforcement.
When specifying the locations, you can use either exclusion or inclusion list. You can either define that the rule is relevant only to paths matching one of the patterns listed in inclusion list or, all files, except the files matching the pattern listed in inclusion list. No local paths are supported. Here are some examples of valid paths:
\\server\share
\\server\share\folder1\subfolderabc
*\folder1
*secret*.docx
*secret*.*
https:// sp2010.local/sites/HR
https://*/HR
Here are some examples of unacceptable values use:
*
*\a
Aaa
c:\
C:\test
Viktig
The exclusion list takes precedence over the inclusions list.
You must create a content scan job and specify the repositories that host the files to be evaluated by the DLP engine.
Enable DLP rules in the created content scan job, and set the Enforce option to Off (unless you want to proceed directly to the DLP enforcement stage).
Verify that your content scan job is assigned to the right cluster. If you haven't created a content scan job, create a new one and assign it to the cluster that contains the scanner nodes.
Connect to the Microsoft Purview compliance portal and add your repositories to the content scan job that will perform the scan.
Do one of the following to run your scan:
Set the scanner schedule
Use the manual Scan Now option in the portal
Run Start-Scan PowerShell cmdlet
Viktig
Remember that the scanner runs a delta scan of the repository by default and files that were scanned in the previous scan cycle will be skipped, unless the file was changed or you initiated a full rescan. A full rescan can be initiated by using the Rescan all files option in the UI or by running Start-Scan-Reset.
Scope the DLP on-premises repositories rule to specific locations if needed. If you scope locations to All, all files scanned will be subject to the DLP rule matching and enforcement.
When specifying the locations, you can use either exclusion or inclusion list. You can either define that the rule is relevant only to paths matching one of the patterns listed in inclusion list or, all files, except the files matching the pattern listed in inclusion list. No local paths are supported. Here are some examples of valid paths:
\\server\share
\\server\share\folder1\subfolderabc
*\folder1
*secret*.docx
*secret*.*
https:// sp2010.local/sites/HR
https://*/HR
Here are some examples of unacceptable values use:
*
*\a
Aaa
c:\
C:\test
Viktig
The exclusion list takes precedence over the inclusions list.
Now that you've deployed a test policy for DLP on-premises locations and can view the activity data in Activity explorer, you're ready to move on to your next step where you create DLP policies that protect your sensitive items.
Microsoft Purview Data Loss Prevention (DLP) helps safeguard sensitive information by monitoring and preventing accidental data leaks across your organization's digital platforms. In this module, you'll learn how to plan, deploy, and adjust DLP policies to protect sensitive data in your organization, ensuring security without disrupting daily work.
Demonstrere det grunnleggende om datasikkerhet, livssyklusadministrasjon, informasjonssikkerhet og samsvar for å beskytte en Microsoft 365-distribusjon.