Prior to DLP in Microsoft 365 compliance center, most organizations protected data using the transport rules aka mail flow rules created in Exchange admin center. You can use transport rules to identify and act on messages that flow through the Exchange Online organization. With the evolution of a centralized console for all the workloads, it’s recommended to move the existing Exchange admin center-DLP policies to DLP in Microsoft 365 Compliance Center. To learn more about Data loss prevention, please refer DLP.
Advantages of migrating to Compliance Center:
- Unified admin console which is easy to maintain
- Single policy across all workloads (Exchange, SPO, ODB, Teams, Devices, MCAS, etc.)
- Protection of data at rest and in transit.
- Near real-time alerts
- Easy navigation to other compliance product features and capabilities
- More advanced classification and labeling
- Rich built-in alerting and incident management experience
Why now?
With the rich experience of Microsoft compliance portal and for easy maintenance of all the DLP policies across workloads at a common place, it's advisable to migrate all the legacy ETR(EAC-DLP) policies into Microsoft Compliance portal (DLP-EXO). We plan to deprecate the EAC-DLP experience in Exchange admin center between April-June 2022. Hence, this is the right time to re-validate the existing legacy rules, consolidate, and rationalize, and migrate to Unified console. To help in migrating the EAC-DLP policies, we are providing a migration wizard which will bring over the policies to Microsoft 365 compliance center.
Migration Process & Playbook:
To fast up the migration process, we have an in-built Wizard within the compliance portal, that will help to migrate all the policies in a simple flow of few clicks. The entire process has been explained in the Playbook. Please view the playbook at aka.ms/mipc/oss
The attached Playbook helps in identifying the activities in each of the below phases along with insights and best practices.
In summary, this playbook will help to:
- Understand the migration process.
- Understand the unified console and interface.
- Develop a strategy for the migration.
- Ensure a smooth migration process.
- Find resources to support the migration process
For more up-to-date information, please refer to the documentation here.
Frequently asked questions:
- Are ETR (mail flow rules) being deprecated?
No changes planned for mail flow rules. Only Exchange DLP will be deprecated (Dates, yet to announce)
- Will the migration wizard impact my existing DLP policies in Exchange?
No. The migration wizard only creates new policies in Compliance Center.
You can choose to disable the Exchange policies using the wizard or independently
- Why am I not seeing the migration wizard banner?
Migration wizard banner will be displayed only if you have active Exchange DLP policies
- What should I do if there are any failures in migration?
Check details in the migration report to understand the root cause. Make required edits in Exchange policy and retry migration using the wizard
- For testing purposes, can I enable both the EAC-DLP rule and the DLP-EXO rule?
Yes. As soon as, the results are satisfied, make the EAC-DLP rules to disable state.
- Why am I getting 2 incident reports?
This is expected in case both Exchange and Microsoft365 DLP policies are in enabled state
- What should I do if my rules are using unsupported conditions?
Create a separate mail flow rule for conditions like SCLOver which are not supported in Unified DLP (Microsoft 365 DLP), remove the unsupported condition from the transport rule and perform the migration.
- Discrepancy in Exchange and Microsoft365 DLP policy evaluation
If policies are enforced in both Exchange and Microsoft365 DLP, please refer to this document to understand the expected behavior
Additional Resources
Join Microsoft Information Protection Preview ring
Microsoft Information Protection Tech Communities
Microsoft
