Forum Discussion
Microsoft Teams tenant specific DLP
Can’t see any way of preventing that ”gap” other than configuring permissions in the label/labels.
*edit WillNunez just realized this should be possible by instead using Endpoint DLP policy.
Endpoint dlp can prevent application and url level uploading. But with teams for example you can't differentiate between tenancies by url. I want to be able to block uploads of classified files at a tenancy level. I've been told casb by other vendors can do this. I'm trying to work out how it can be done with microsoft
- You can use CA with a Conditional Access App Control session policy, connected to Microsoft Defender for Cloud Apps, with the session control type "Control file upload" and action "Block". There are many configuration options in there, such as scoping on sensitivity labels etc., and target "All company" for example.
Not sure you've seen the new setting in Endpoint DLP for devices where you can select a block of upload if a document isn't already labeled. Meaning no file can be uploaded until it's been labeled. Something to consider as well.- Thanks for the replies Christian. But a key requirement is differentiating tenancies.
Eg allow a file to be uploaded to Teams tenant for an organisation but blocked for all other tenantsShould be possible to scope that in a Defender for Cloud Apps session policy but can take a look at it later on.
WillNunez So I've read the initial post again and understand the use case as you want to prevent uploading of files in third-party tenants. Can't say I have a good solution for this as those users already are members of that organization and adhere to their policies. I would probably use sensitivity labels as mentioned in the first reply or use tenant-restrictions, but for the latter you would break the collaboration and encryption part completely and the users will not be able to open the files. You certainly can prevent external sharing of files with DLP and use Defender for Cloud Apps with several settings controlling your own environment. But I just can't see what can be done here besides what has already been suggested.
Try with the official support and let us know if they have a solution. Thanks.