OCR is enabled for sensitive information detection
Overview
Section titled “Overview”OCR (optical character recognition) extends sensitive information type and trainable classifier detection to images across Exchange, SharePoint, OneDrive, Teams, and endpoint devices. Without OCR, DLP policies, and auto-labeling policies can’t scan image-based content, scanned documents, screenshots, and invoices, leaving sensitive data in images unprotected. OCR requires Azure pay-as-you-go billing for Microsoft Syntex, and is configured at the tenant level.
Remediation
Section titled “Remediation”Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Data, AI |
| Category | Information Protection |
| Product | Purview |
| Feature | Data classification |
| Area | Data protection |
| Licence | EXCHANGE_S_ENTERPRISE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.