Announcing GA of Microsoft Data Loss Prevention Alerts Dashboard

Published 04-12-2021 02:00 PM 7,121 Views
Microsoft

Customers rely on Microsoft Data Loss Prevention(DLP) to enforce policies that identify and prevent risky or inappropriate sharing, transfer or use of sensitive information across cloud, on-premise and endpoints. Alerts, which can be configured as a part of the DLP policy authoring experience are an effective tool for customers to get notified whenever a DLP policy is violated.

 

Microsoft announces the General Availability of the Microsoft Data Loss Prevention Alerts Dashboard. This latest addition in the Microsoft’s data loss prevention solution provides customers with the ability to holistically investigate DLP policy violations across :

  • Exchange
  • SharePoint Online
  • OneDrive
  • Teams
  • Devices
  • Cloud apps
  • On-premises file shares

Advance alert configuration options are available in the existing DLP policy configuration flow. These provide eligible DLP customers with the ability to tailor how they organize DLP policy alerts along with exhaustive information that they need to investigate and address DLP policy violations quickly. Historical workflow information for alerts is available in the Management log.

 

The alerts dashboard provides a list view of all DLP alerts and clicking on an alert will display the relevant details.

 

Shekhar_Palta_0-1618244840706.png

Figure 1 : Data Loss Prevention Alerts Dashboard

 

Clicking on ‘View Details’ will display the alert page with exhaustive information associated with the DLP policy violation, ability to change alert status (Active, Investigating, Dismissed or Resolved), include additional comments and define workflow actions such as assigning alerts to individuals for follow up.

 

Shekhar_Palta_1-1618244840724.png

Figure 2 : Alert details with manage alert options

 

Clicking on the ‘Events’ tab will display the actual user activity along with details including :

  • Source view (requires E5 or related subscriptions) : This will allow customers to view the email or the file involved in the DLP policy alert. Source view in the DLP Alerts Dashboard will be available for content(email/files) belonging to the following workloads :
    • Exchange (Email body only)
    • SharePoint Online
    • One Drive

This feature is available only for licenses in the following subscriptions :

- Microsoft 365 (E5)

- Office 365 (E5)

- Advanced Compliance (E5) add-on

- Microsoft 365 E5/A5 Info Protection & Governance

- Microsoft 365 E5/A5 Compliance

 

  • Matched sensitive terms and context : This will allow customers to view the sensitive terms in the content due to which the DLP policy was violated. You will also be able to view up to 300 characters surrounding the detected sensitive term. This information will be available for detections for the following workloads :
    1. Exchange (both email body and attachments)
    2. SharePoint Online
    3. OneDrive
    4. Teams

For both features : Source View and Matched sensitive terms and context, the role group “Content Explorer Content Viewer” should be assigned. This role group has the role “data classification content viewer” pre-assigned.

 

Shekhar_Palta_2-1618244840738.png

Figure 3 : Exhaustive metadata for each user event

 

Shekhar_Palta_3-1618244840748.png

Figure 4 : View the content of the email(body) or file

 

Shekhar_Palta_4-1618244840792.png

Figure 5 : View matched sensitive terms and surrounding characters

Get Started

Microsoft’s DLP solution is part of a broader set of Information Protection and Governance solutions that are part of the Microsoft 365 Compliance Suite. You can sign up for a trial of Microsoft 365 E5 or navigate to the Microsoft 365 compliance center to get started today.

Additional resources:

  • For more information on DLP Alerts Management, please this and this
  • For more information on Data Loss Prevention, please see this

Thank you,

The Microsoft Information Protection Team

2 Comments
Senior Member

Good to see this go GA with additional features that were in the preview. The sensitive info view and surrounding characters is nice, much better and easier to review than incident reports. 

 

Any change alerts may also be used to review and release 'quarantined' DLP events instead of the existing method where recipients need to review an email to approve/reject?

 

 

Microsoft

Does anyone know when the Alert Dashboard will be available in GCC?

%3CLINGO-SUB%20id%3D%22lingo-sub-2271670%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20GA%20of%20Microsoft%20Data%20Loss%20Prevention%20Alerts%20Dashboard%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2271670%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20to%20see%20this%20go%20GA%20with%20additional%20features%20that%20were%20in%20the%20preview.%20The%20sensitive%20info%20view%20and%20surrounding%20characters%20is%20nice%2C%20much%20better%20and%20easier%20to%20review%20than%20incident%20reports.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20change%20alerts%20may%20also%20be%20used%20to%20review%20and%20release%20'quarantined'%20DLP%20events%20instead%20of%20the%20existing%20method%20where%20recipients%20need%20to%20review%20an%20email%20to%20approve%2Freject%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2304093%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20GA%20of%20Microsoft%20Data%20Loss%20Prevention%20Alerts%20Dashboard%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2304093%22%20slang%3D%22en-US%22%3E%3CP%3EDoes%20anyone%20know%20when%20the%20Alert%20Dashboard%20will%20be%20available%20in%20GCC%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2268194%22%20slang%3D%22en-US%22%3EAnnouncing%20GA%20of%20Microsoft%20Data%20Loss%20Prevention%20Alerts%20Dashboard%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2268194%22%20slang%3D%22en-US%22%3E%3CP%3ECustomers%20rely%20on%20Microsoft%20Data%20Loss%20Prevention(DLP)%20to%20enforce%20policies%20that%20identify%20and%20prevent%20risky%20or%20inappropriate%20sharing%2C%20transfer%20or%20use%20of%20sensitive%20information%20across%20cloud%2C%20on-premise%20and%20endpoints.%20Alerts%2C%20which%20can%20be%20configured%20as%20a%20part%20of%20the%20DLP%20policy%20authoring%20experience%20are%20an%20effective%20tool%20for%20customers%20to%20get%20notified%20whenever%20a%20DLP%20policy%20is%20violated.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMicrosoft%20announces%20the%20General%20Availability%20of%20the%20Microsoft%20Data%20Loss%20Prevention%20Alerts%20Dashboard.%20This%20latest%20addition%20in%20the%20Microsoft%E2%80%99s%20data%20loss%20prevention%20solution%20provides%20customers%20with%20the%20ability%20to%20holistically%20investigate%20DLP%20policy%20violations%20across%20%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EExchange%3C%2FLI%3E%0A%3CLI%3ESharePoint%20Online%3C%2FLI%3E%0A%3CLI%3EOneDrive%3C%2FLI%3E%0A%3CLI%3ETeams%3C%2FLI%3E%0A%3CLI%3EDevices%3C%2FLI%3E%0A%3CLI%3ECloud%20apps%3C%2FLI%3E%0A%3CLI%3EOn-premises%20file%20shares%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fdlp-configure-view-alerts-policies%3Fview%3Do365-worldwide%23alert-configuration-experience%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EAdvance%20alert%20configuration%20options%3C%2FA%3E%20are%20available%20in%20the%20existing%20DLP%20policy%20configuration%20flow.%20These%20provide%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fdlp-configure-view-alerts-policies%3Fview%3Do365-worldwide%23licensing-for-alert-configuration-options%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Eeligible%26nbsp%3B%3C%2FA%3EDLP%20customers%20with%20the%20ability%20to%20tailor%20how%20they%20organize%20DLP%20policy%20alerts%20along%20with%20exhaustive%20information%20that%20they%20need%20to%20investigate%20and%20address%20DLP%20policy%20violations%20quickly.%20Historical%20workflow%20information%20for%20alerts%20is%20available%20in%20the%20Management%20log.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20alerts%20dashboard%20provides%20a%20list%20view%20of%20all%20DLP%20alerts%20and%20clicking%20on%20an%20alert%20will%20display%20the%20relevant%20details.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Shekhar_Palta_0-1618244840706.png%22%20style%3D%22width%3A%20782px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F272012iD89EA3600C671EF6%2Fimage-dimensions%2F782x440%3Fv%3Dv2%22%20width%3D%22782%22%20height%3D%22440%22%20role%3D%22button%22%20title%3D%22Shekhar_Palta_0-1618244840706.png%22%20alt%3D%22Shekhar_Palta_0-1618244840706.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EFigure%201%20%3A%20Data%20Loss%20Prevention%20Alerts%20Dashboard%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EClicking%20on%20%E2%80%98View%20Details%E2%80%99%20will%20display%20the%20alert%20page%20with%20exhaustive%20information%20associated%20with%20the%20DLP%20policy%20violation%2C%20ability%20to%20change%20alert%20status%20(Active%2C%20Investigating%2C%20Dismissed%20or%20Resolved)%2C%20include%20additional%20comments%20and%20define%20workflow%20actions%20such%20as%20assigning%20alerts%20to%20individuals%20for%20follow%20up.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Shekhar_Palta_1-1618244840724.png%22%20style%3D%22width%3A%20785px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F272014i4199CAA7CF7F4ADF%2Fimage-dimensions%2F785x441%3Fv%3Dv2%22%20width%3D%22785%22%20height%3D%22441%22%20role%3D%22button%22%20title%3D%22Shekhar_Palta_1-1618244840724.png%22%20alt%3D%22Shekhar_Palta_1-1618244840724.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EFigure%202%20%3A%20Alert%20details%20with%20manage%20alert%20options%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EClicking%20on%20the%20%E2%80%98Events%E2%80%99%20tab%20will%20display%20the%20actual%20user%20activity%20along%20with%20details%20including%20%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3ESource%20view%20(requires%20E5%20or%20related%20subscriptions)%3C%2FSTRONG%3E%20%3A%20This%20will%20allow%20customers%20to%20view%20the%20email%20or%20the%20file%20involved%20in%20the%20DLP%20policy%20alert.%20Source%20view%20in%20the%20DLP%20Alerts%20Dashboard%20will%20be%20available%20for%20content(email%2Ffiles)%20belonging%20to%20the%20following%20workloads%20%3A%3CUL%3E%0A%3CLI%3EExchange%20(Email%20body%20only)%3C%2FLI%3E%0A%3CLI%3ESharePoint%20Online%3C%2FLI%3E%0A%3CLI%3EOne%20Drive%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EThis%20feature%20is%20available%20only%20for%20licenses%20in%20the%20following%20subscriptions%20%3A%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3E-%20Microsoft%20365%20(E5)%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3E-%20Office%20365%20(E5)%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3E-%20Advanced%20Compliance%20(E5)%20add-on%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3E-%20Microsoft%20365%20E5%2FA5%20Info%20Protection%20%26amp%3B%20Governance%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3E-%20Microsoft%20365%20E5%2FA5%20Compliance%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EMatched%20sensitive%20terms%20and%20context%3C%2FSTRONG%3E%20%3A%20This%20will%20allow%20customers%20to%20view%20the%20sensitive%20terms%20in%20the%20content%20due%20to%20which%20the%20DLP%20policy%20was%20violated.%20You%20will%20also%20be%20able%20to%20view%20up%20to%20300%20characters%20surrounding%20the%20detected%20sensitive%20term.%20This%20information%20will%20be%20available%20for%20detections%20for%20the%20following%20workloads%20%3A%3COL%3E%0A%3CLI%3EExchange%20(both%20email%20body%20and%20attachments)%3C%2FLI%3E%0A%3CLI%3ESharePoint%20Online%3C%2FLI%3E%0A%3CLI%3EOneDrive%3C%2FLI%3E%0A%3CLI%3ETeams%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EFor%20both%20features%20%3A%20Source%20View%20and%20Matched%20sensitive%20terms%20and%20context%2C%20the%20role%20group%20%E2%80%9CContent%20Explorer%20Content%20Viewer%E2%80%9D%20should%20be%20assigned.%20This%20role%20group%20has%20the%20role%20%E2%80%9Cdata%20classification%20content%20viewer%E2%80%9D%20pre-assigned.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Shekhar_Palta_2-1618244840738.png%22%20style%3D%22width%3A%20790px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F272013i0CC386959F8CFB05%2Fimage-dimensions%2F790x444%3Fv%3Dv2%22%20width%3D%22790%22%20height%3D%22444%22%20role%3D%22button%22%20title%3D%22Shekhar_Palta_2-1618244840738.png%22%20alt%3D%22Shekhar_Palta_2-1618244840738.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EFigure%203%20%3A%20Exhaustive%20metadata%20for%20each%20user%20event%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Shekhar_Palta_3-1618244840748.png%22%20style%3D%22width%3A%20802px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F272015i9D6E967DA5E03C45%2Fimage-dimensions%2F802x451%3Fv%3Dv2%22%20width%3D%22802%22%20height%3D%22451%22%20role%3D%22button%22%20title%3D%22Shekhar_Palta_3-1618244840748.png%22%20alt%3D%22Shekhar_Palta_3-1618244840748.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EFigure%204%20%3A%20View%20the%20content%20of%20the%20email(body)%20or%20file%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Shekhar_Palta_4-1618244840792.png%22%20style%3D%22width%3A%20800px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F272016iEF9BAD9EA7CF1D15%2Fimage-dimensions%2F800x430%3Fv%3Dv2%22%20width%3D%22800%22%20height%3D%22430%22%20role%3D%22button%22%20title%3D%22Shekhar_Palta_4-1618244840792.png%22%20alt%3D%22Shekhar_Palta_4-1618244840792.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EFigure%205%20%3A%20View%20matched%20sensitive%20terms%20and%20surrounding%20characters%3C%2FEM%3E%3C%2FP%3E%0A%3CH1%20id%3D%22toc-hId-1302404954%22%20id%3D%22toc-hId-1303118228%22%3EGet%20Started%3C%2FH1%3E%0A%3CP%3EMicrosoft%E2%80%99s%20DLP%20solution%20is%20part%20of%20a%20broader%20set%20of%20Information%20Protection%20and%20Governance%20solutions%20that%20are%20part%20of%20the%20Microsoft%20365%20Compliance%20Suite.%20You%20can%20sign%20up%20for%20a%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fbusiness%2Fcompliance-solutions%23midpagectaregion%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Etrial%3C%2FA%3E%26nbsp%3Bof%20Microsoft%20365%20E5%20or%20navigate%20to%20the%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fcompliance.microsoft.com%2Fdatalossprevention%3Fviewid%3Ddlpalerts%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EMicrosoft%20365%20compliance%20center%3C%2FA%3E%26nbsp%3Bto%20get%20started%20today.%3C%2FP%3E%0A%3CP%3EAdditional%20resources%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EFor%20more%20information%20on%20DLP%20Alerts%20Management%2C%20please%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fdlp-alerts-dashboard-get-started%3Fview%3Do365-worldwide%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ethis%3C%2FA%3E%20and%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fdlp-alerts-dashboard-learn%3Fview%3Do365-worldwide%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ethis%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3EFor%20more%20information%20on%20Data%20Loss%20Prevention%2C%20please%20see%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-security-and%2Fa-unified-approach-to-data-loss-prevention-from-microsoft%2Fba-p%2F1694492%22%20target%3D%22_blank%22%3Ethis%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EThank%20you%2C%3C%2FP%3E%0A%3CP%3EThe%20Microsoft%20Information%20Protection%20Team%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2268194%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECompliance%20Management%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EData%20Loss%20Prevention%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EInformation%20Protection%20and%20Governance%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20Information%20Protection%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Version history
Last update:
‎May 11 2021 01:58 PM
Updated by: