Microsoft Purview Data Protection – Creating a Safelist with Data Loss Prevention

I recently encountered an interesting use case. A client wanted to control the sharing of their highly sensitive information via a whitelist or safelist. That is, for every document emailed out that was flagged as restricted or contained a restricted attachment, they wanted to block it outright unless it was going to an approved external partner. So, I set about creating a safelist with data loss prevention within Microsoft Purview.

Disclaimer: Any procedures or screenshots demonstrated in this post were tested at the time of writing.  I will do my best to update the steps as Microsoft implements updates but be aware that while the overall concept may not change, the actual steps may change as Microsoft makes changes.

The Requirements

The client had their most sensitive information configured as a user-defined permission (UDP) label but needed to share the contact externally in some special cases.  If all of the following criteria were met, the email had to be blocked from being sent:

1. Only affect email
2. The email had to be sent externally
3. The email had to have a restricted label applied or have an attachment with a restricted label applied
4. One or more recipients must not be part of the approved safelist

Overview of the solution

First, you may wonder why we did this via Exchange only. It’s because we don’t have the necessary controls available in OneDrive and SharePoint. What I mean by this, is the ability to control a safelist requires you to be able to add users or email addresses to the condition of the policy.  SharePoint and OneDrive lack the ability to do this.  To ensure email was the only way to share the content, a blocking DLP policy for all restricted content being shared from SharePoint and OneDrive was created as part of the overall solution.  I’ll post how that was accomplished next.  So this brings us back to Exchange.  The solution is going to have the following attributes:

1. DLP policy is scoped to Exchange only
2. The policy contains a single rule
3. The rule activates when:
   1. Email is sent externally
   2. Email contains a restricted attachment, or the email is restricted itself
   3. Email contains a recipient that does not fall under the approved list.
4. If activated the rule will block the email from being sent, but will allow the user to override with a justification.

As the business couldn’t always determine who the actual recipient was, it was agreed that the recipient check would be for a domain rather than an individual user.

Creating a Safelist with Data Loss Prevention

Note: as Microsoft is removing the classic Purview soon, the following steps and screenshots are done in the new Microsoft Purview portal:

1. Navigate to Purview (https://purview.microsoft.com)
2. Click on Data Loss Prevention

3. Click on Policies –> + Create policy
4. Select a custom template for the policy and click Next.

5. Provide the policy with a meaningful name and description (optional)
6. Click Next at Admin units
7. At the Locations page, select only Exchange (you can assign this to specific groups here as well if necessary)

8. If not already selected, ensure “Create or customize advanced DLP rules” is selected and click next
9. Click on + Create rule to create a new rule.
10. Provide the rule with a meaningful name (usually the details of your search)
11. Click on + Add condition.
12. Select “Content contains”

 

13. This will create a new Condition Group.  The default name is Default, but I suggest renaming to something that makes sense like “Restricted Content Shared Externally”
14. Click on Add.  Select Content is shared from Microsoft 365.  Within this condition, select “with people outside my organization”.

 

15. Next click on Add.  Select Sensitivity Label. Note: the operator AND is automatically added between the conditions.  This can be changed to OR is required.

 

16. In the blade that pops out, select the required label.
17. Under “Evaluate predicate for (available for Exchange workload only)” select Message or attachment.
18. Click “Add Group”
19. Click on the “NOT” operator option to activate.  In this section, we will add the list of safe domains.  If the recipient is not on that list, they will activate the rule (hence the need for NOT to be active).
20. Click on + Add Condition.
21. Select “Recipient domain is”
22. Add the list of domains.  Can use a comma to separate without having to click + Add each time.
23. Once all domains are in the text box, click + Add

 

24. Scroll down a little and click on + Add an action.
25. Click on “Restrict access or encrypt the content in Microsoft 365 locations”

 

26. Select the option “Block only people outside your organization”

 

27. If you wish to allow users to override this, you have to enable notifications.  Do this and select the notifications you wish the users and administrators to receive.
    • Click on the checkbox “Allow users to override policy restrictions in Fabric (including Power BI), Exchange, SharePoint, OneDrive, and Teams.​” to allow users to override the block and provide a justification if required.

28. Continue to configure the rule as your organization requires.
29. Click Save.
30. You will be brought back to the rule list page and you can see a summary of the settings you just configured.

 

28. Click Next.
29. You can then choose to run the policy, disable the policy, or run it in simulation mode.  Make your selection and click Next.
30. Review the settings and click Submit.

The User Experience

Now, when users send an email containing a restricted attachment or the email itself is restricted, they will need to justify sending the document if there is a recipient not within the safelist.

 

If they use a mix of allowed and disallowed recipient lists they will also receive a block:

And if only safe recipients are added:

Thanks for reading!