Forum Discussion
In bound Email triggers DLP Policy
I have a DLP policy to catch financial info from being emailed out by my users.
However we received an alert for an inbound email which had a routing number and account number for an invoice. The email was bounced back to the sender - and to me the security admin.
Is there a way to prevent DLP triggering inbound? The policy was setup in Security and Compliance Center not Exchange Admin.
11 Replies
- Samson_Chan
Microsoft
Don't think in terms of inbound/outbound. A mail is scanned once per tenant. If you send an internal mail, it's scanned on the initial outbound flow only; there is no inbound mail scanning. For external mail, a tenant is either scanning on the sending side, or it's scanning on the receiving side.
Have you look into the "Content is received from" condition? This would help control DLP scanning if you just want to scan "outbound" by setting the mail is coming from a "People inside my organization". This should prevent the external incoming mail from being scanned. - We have the same issue: a DLP policy configured through the Compliance Center, no DLP policies configured in Exchange Admin Center, and both inbound and outbound emails trigger the policy. (External sender also gets a copy of the policy tip email.)
Can't find anything about this in the documentation, and per Vasil it's not expected behavior. Does anyone have a clue of what could be causing it? DLP does not trigger inbound, and there are no such options to configure. If you previously had DLP rules configured in the Exchange Admin Center, it's possible that some of the corresponding Transport rules are misconfigured to fire on both outgoing/incoming messages, so check for that.
TonyRedmond might have some additional insights here.
1. Do you have transport rules configured with DLP?
2. The SCC (Office 365) DLP rules are expanding their coverage of email operations, so it is possible that they might have caught this too.
Impossible to say what happened without looking at the rules. Can you share the logic?
The rules were created in the SCC - nothing has ever been done in Exchange.
The weird thing is that I have checked and there are other emails that were received to the accounts payable address which also contained information which should have triggered the same rule but did not. It appears to have been from 2 email senders that the issue occurred.
Is there a way to prevent DLP from inbound external email?
