CIS.M365.3.2.2 - (L1) Ensure DLP policies are enabled for Microsoft Teams
Overview
At least one data loss prevention policy includes the Microsoft Teams location and is turned on.
Chat and channel messages are a quick way to paste a customer list or credentials, and files that users share in Teams end up in SharePoint and OneDrive. A DLP policy that covers Teams can block or warn about sensitive information in chat messages and channel conversations, in addition to the files. The policy covers the Teams content that an attacker collects from (T1213), the files stored behind it in SharePoint and OneDrive (T1530), and it stops sensitive content from leaving through a web service such as a message or an upload (T1567).
The policy must be in the Enable mode. Once it is on, a user who posts sensitive content in a chat or channel meets a policy tip or a block. DLP for Teams chat and channel messages needs Microsoft 365 E5 or the Microsoft Purview suite licence.
Remediation action
- Sign in to the Microsoft Purview portal.
- Go to Solutions > Data loss prevention > Policies and edit a policy, or create a new one.
- Under Locations, turn on Teams chat and channel messages and apply it to all accounts, without excluding any account or group.
- Set the policy mode to Turn it on right away and save the policy.
Related links
- Microsoft Purview portal - Data loss prevention policies
- Create and deploy data loss prevention policies
- Data loss prevention and Microsoft Teams
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 3.2.2
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.3.2.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Purview |
| Feature | Data loss prevention |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1213 Data from Information Repositories, T1530 Data from Cloud Storage, T1567 Exfiltration Over Web Service |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 3.2.2 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:3.2.2, nist-800-53-r5:AC-4 |
| PowerShell test | Test-MtCisTeamsDlpPolicy |
| Services | SecurityCompliance |
| Compatible licenses | COMMUNICATIONS_DLP |
Source
- Test:
tests/cis/Test.CIS.M365.3.2.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.3.2.2.md