Mail flow rules apply rights protection to sensitive messages

Overview

Without mail flow rules, organizations depend on users to manually apply sensitivity labels or encrypt messages. This approach can lead to inconsistencies and errors, which may result in sensitive emails being sent without proper protection and increase the risk of unauthorized access and data exfiltration.

Mail flow rules help automatically add encryption and set permissions for emails that meet certain conditions, such as:

• Mail sent to people outside the company
• Mail that contains sensitive information
• Mail that must follow department-based requirements
  This ensures that important messages are protected without relying on users to manually secure them.

Remediation

• Set up Message Encryption and mail flow rules to use Microsoft Purview Message Encryption

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Medium
Impact on users	Medium
Pillar	Data
Category	Information Protection
Product	Exchange Online
Feature	Mail flow
Area	Data protection
Licence	RMS_S_PREMIUM2, Microsoft 365 E5
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.