Blog Post

Security, Compliance, and Identity Blog
1 MIN READ

Tips and tricks for maximizing accuracy and reducing false positive detections in MIP and DLP

Robin_Baldwin's avatar
Robin_Baldwin
Icon for Microsoft rankMicrosoft
May 17, 2022

Does your organization struggle with false positives in our built-in SITs, as well as with custom SITs? If so, please watch this webinar to learn some advanced techniques that can be used to reduce or outright eliminate false positive detections.

 

Resources:

Microsoft Information Protection (MIP) in Microsoft 365

Learn about sensitive information types

 

This webinar was presented on May 4, 2022, and the recording can be found here.

 

Attached to this post are:

  1. The FAQ document that summarizes the questions and answers that came up over the course of the webinar.
  2. A PDF copy of the presentation.

 Thanks to those of you who participated during the live session.

 

Thanks!

Updated May 17, 2022
Version 2.0
microsoft information protection
  • David_Caddick's avatar
    David_Caddick
    Brass Contributor
    May 18, 2022

    Hi Robin,

    Very comprehensive info - thanks very much.

    At some stage it might be worth while catching up for a deeper conversation?

    Regards,

    Dave C

     

  • David_Caddick's avatar
    David_Caddick
    Brass Contributor
    May 18, 2022

    A question based on the Tips & Tricks deck - I'm guessing this might be for Esaggese ?

     

    Is it possible to use EDM and target the "Opportunity Codes" randomly generated by D365 for each Opp as it's entered in the OneCRM?  Taking your tip from Slide 21 this would appear to be the most unique/single element that could be used? Then map it with other supporting info to build up a reasonably positive result of finding docs that might be considered "Commercial-in-Confidence"? 

     

    Thoughts?

  • Esaggese's avatar
    Esaggese
    Icon for Microsoft rankMicrosoft
    May 19, 2022

    The opportunity code looks like a good candidate for a primary element, but it might not be the only one depending on what you are trying to protect. I guess for some roles opportunity codes are critical and always included in conversations about data in CRM, but other roles only care about tenant IDs, names, subscription IDs, etc., so it always depends on which permutations of data need to be detected. Also, while some scenarios are about detecting data that came from the data source (e.g. data extracted from CRM), in others the objective is to use the data in that source to pinpoint sensitive data even if it came from entirely different sources (or even manually entered into an email, e.g. during a support conversation with the customer), in which cases identifiers like opportunity ID or contract ID are less likely to be present.

    In the follow up webinar we will go over a structured process to decide which columns to use as primary elements based on the column permutations of interest, so stay tuned!