Identifying Sensitive Information in Plans

[Dean Gross]

Are there any plans to support the Data Loss Prevention policies from O365 in Planner, i.e. if a user enters sensitive information in a task is should be findable by DLP.

[#2]

Thanks for your question Dean. We're currently working through the plans for these security and compliance features. DLP is on our radar, but we plan to start with eDiscovery and Audit Logs first.

[#3]

@Dean Gross If our PMO went big on Planner this would be something that concerned me. User education only goes so far, a bit of nudging/monitoring via config would be useful.

[#4]

@Eray Chou  Here is a scenario that needs to addressed.

1. A team member gets assigned a task to gather Patient records or Custom credit information.
2. when they finish the task, they attach a file containing the sensitive data to the task.

DLP needs to let the compliance people know that this has occurred.

[#5]

@Dean Gross Thanks for the clarification.  I'll need to verify, but for this specific case (DLP for attachment content) it's possible that SharePoint's DLP support would kick in and detect this case.  The DLP work we are investigating would then extend support to also include other Tasks fields -- for example, recording credit card numbers in the Task's description.  

[#6]

@Eray Chou You are correct, in my scenario, the File attached to the task gets put into SPO (which I forgot happened) so DLP will find it. Your scenario is better than mine and needs to be covered.