DLP inspection for content shared with external users in Teams

[Yoav Crombie]

Is there a way to apply the MS DLP to inspect content shared with external users (not guest).

Inspecting content that is shared externally is a be a very common requirement when implementing DLP policies and it does not seem to work.

We have tried this for both a Teams external users as well as a Skype external users (though might be that the Teams users had also Skype)

[#2]

Hi @Yoav Crombie,

See here on my blog

https://microsoft365pro.co.uk/2019/09/16/teams-real-simple-with-pictures-applying-data-loss-preventi...

Note: As outlined here on Petri, Teams communications are internal whilst DLP checking for other workloads focuses on outbound email/document sharing. The DLP policy must therefore cover content shared “only with people in my organization” (many existing policies are likely set to cover content shared “with people outside my organization.” In the context of Teams, this means teams with guest users). It is recommended – if external and guest access is on to set two DLP Policies – one internal and one external.

Hope that answers your question!

Best, Chris

[#3]

@Christopher Hoard 

I am not sure i fully understood the setting we are required to do, but i could understand the bottom line that is written clearly in your great blog that :

"DLP for external chat sessions will only work if both the sender and the receiver are in Teams Only mode and using Microsoft Teams native federation."

In other words, if the other side is not Teams only or is Skype for Business - content will not be inspected and sensitive data can  be shared. Is this a correct understanding?

[#4]

Correct :D

Best, Chris

[#5]

Nice post @Christopher Hoard  👍🏼

Does this also work only on non-managed devices? This to prevent any file downloading on non-managed devices. Tried to set it up, and disabling the "Files" section is working, but for files still in the chat it doesn't apply. You can still open/download these. Any idea?

[#6 · Accepted solution]

Hmmm, afaik it does: see here: https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-wo... and section restrict access to content. AFAIK, the other user it has been shared with cannot access it.

In terms of downloading, well, you would probably look to use app protection policies using Intune in order to block downloads on non managed devices

https://docs.microsoft.com/en-gb/mem/intune/protect/data-leak-prevention

Or you could look to apply sensitivity labels, for example on Teams to require the device to be managed

https://microsoft365pro.co.uk/2019/12/10/teams-real-simple-with-pictures-using-sensitivity-labels-to...

If you were taking a zero trust policy no device accessing the corporate access or applications would be non-managed.

Best, Chris

[#7]

@Christopher Hoard thanks for your article. 

Do you know if the MS DLP cover messages/files sent in a meeting that is hosted by the external?