Data loss prevention policies are enabled

Overview

A DLP policy can help you identify, monitor, and automatically protect sensitive information in Enterprise applications & devices and Inline web traffic data. DLP policies act on a variety of locations, methods of data transmission, and types of user activities. By protecting sensitive information, DLP policies can help you prevent data leaks, ensure compliance with regulations, and maintain the confidentiality of your organization’s data.

Remediation

• Create and configure DLP policies

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Data, AI
Category	Data Loss Prevention (DLP)
Product	Purview
Feature	Data loss prevention
Area	Data protection
ATT&CK	T1213 Data from Information Repositories, T1530 Data from Cloud Storage, T1567 Exfiltration Over Web Service
Licence	EXCHANGE_S_ENTERPRISE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.