In bound Email triggers DLP Policy

[Ian Dicker]

I have a DLP policy to catch financial info from being emailed out by my users.

However we received an alert for an inbound email which had a routing number and account number for an invoice. The email was bounced back to the sender - and to me the security admin.

Is there a way to prevent DLP triggering inbound? The policy was setup in Security and Compliance Center not Exchange Admin.

[#2]

DLP does not trigger inbound, and there are no such options to configure. If you previously had DLP rules configured in the Exchange Admin Center, it's possible that some of the corresponding Transport rules are misconfigured to fire on both outgoing/incoming messages, so check for that.

@Tony Redmond might have some additional insights here.

[#3]

1. Do you have transport rules configured with DLP?

2. The SCC (Office 365) DLP rules are expanding their coverage of email operations, so it is possible that they might have caught this too.

Impossible to say what happened without looking at the rules. Can you share the logic?

[#4]

I'm almost 100% sure that's not caused by the Unified DLP - I just did a test to confirm. Outbound was captured, inbound arrived with no detections.

[#5]

Hmm, i'll take a look at at the Exchange admin - but I dont believe I have ever configured anything there - it was all done from Sec & Comp center.

[#6]

I've got a DLP rule in SCC that is set to detect "Any volume of content detected U.S. Financial CC only".. and this setting catches external emails coming in that contains CC data.

[#7]

OK so its not just me - sounds like you have the same thing.

Is that behavior you want?

[#8]

If you can reliably reproduce it, open a support case. It does not work for me via SCC rules.

[#9]

I don't mind it. It helps keep track of incoming CC info, and can help identify business process gaps, to give customers a secure payment process, compared to sending sensitive information in non-encrypted emails.

[#10]

The rules were created in the SCC - nothing has ever been done in Exchange.

The weird thing is that I have checked and there are other emails that were received to the accounts payable address which also contained information which should have triggered the same rule but did not. It appears to have been from 2 email senders that the issue occurred. 

Is there a way to prevent DLP from inbound external email?

[#11]

We have the same issue: a DLP policy configured through the Compliance Center, no DLP policies configured in Exchange Admin Center, and both inbound and outbound emails trigger the policy. (External sender also gets a copy of the policy tip email.)

Can't find anything about this in the documentation, and per Vasil it's not expected behavior. Does anyone have a clue of what could be causing it?

[#12]

Don't think in terms of inbound/outbound. A mail is scanned once per tenant. If you send an internal mail, it's scanned on the initial outbound flow only; there is no inbound mail scanning. For external mail, a tenant is either scanning on the sending side, or it's scanning on the receiving side.

Have you look into the "Content is received from" condition? This would help control DLP scanning if you just want to scan "outbound" by setting the mail is coming from a "People inside my organization". This should prevent the external incoming mail from being scanned.