Hello,
We are trying to get the DLP logs from O365 to discover the sensitive data that is in Office 365, including Exchange Online, Sharepoint Online and OneDrive.
For that, I am connecting to Exchange Online Powershell using Connect-EXOPSession and I run the Get-DLPDetailReport cmdlet. Over the last few days, I am getting over 5000 entries but they are all coming from the EXCH source (Exchange Online) except 3 logs that are coming from ODB (OneDrive). Nothing from the SPO source (Sharepoint Online) which makes no sense to me since we have many files that have sensitivity information in them.
For the test, we saved many files that have SIN numbers, credit car number and other sensitivity information types in them. To make sure that they would be indexed (since DLP logs seems to be based on the Sharepoint index), We opened and edited these files many times. Many days have passed but still, I have no logs from SPO in the DLP logs.
I'm not a Sharepoint expert and I was wondering if there could be anything that would cause this issue like Sharepoint permissions that could be to restrictive for the DLP to discover the sensitivity information in the files stores in SPO? Or maybe some SPO sites that would be excluded from being indexed?
Any idea will be more than welcome!
Thanks!
Charles
