SharePoint Online and Data Loss Protection (DLP)

So as you all should know by now, Data Loss Protection (DLP) was introduced into SharePoint Online earlier this year. This is really just an extension of the eDiscovery process in SharePoint, it is really used for checking the content you have in the site already. As I have spoken with other SharePoint people in the community and clients I have been surprised that not many people have used or even seen it.

To learn more about DLP as a whole, then review this video and details from TechNet: http://technet.microsoft.com/library/jj150527%28v=exchg.150%29

So to hopefully help with this, let’s take a look at it. Firstly we are talking SharePoint Online, so you will first need to have access to your tenant, and a site/site collection based on the “eDiscovery” template.

To make sure it should be look like this:

To start, we need to create a new case. To do this simply click the “Create New Case” button.

I have set the properties as shown below:

 

You’re case site should then be created and you should be taken to that site and should be ready for you to use.

So the first part of the DLP “search” process is to perform a “Search and Export” query. I named mine “Credit Card PII” as shown below.

As you can see you are able to add some free-text query, dates, and names or email addresses as well as set a scope for the results. At the bottom of the screen you get results back from Exchange or SharePoint.

So the plan here is to find any content that contain credit card numbers, so first off make sure you actually have content in the site that contains credit cards or this won’t work. Then we will start to add a query to retrieve the content.

Let’s start by understanding the syntax that should be used. The queries should be set in the following format:

SensitiveType:”{Type}|{Count Range}|{Confidence Range}”

The “SensitiveType” is required whereas the ranges are optional. The syntax can also be added to using regular search syntax.

An example of this combination could be something like this that finds all documents that contain 2 to 15 “Credit Card Numbers“, within all file types except “PDF” files.

SensitiveType:”Credit Card Number| 2..15″ AND
NOT
FileExtension:PDF

If you want to learn more about using search query syntax in eDiscovery you can visit the following documentation.

http://blogs.technet.com/b/quentin/archive/2014/07/30/using-search-properties-and-operators-with-ediscovery.aspx

So our example will be something simple to just get anything with credit card numbers in. We would use the following:

SensitiveType:”Credit Card Number”

We could have chosen something else instead of “Credit Card Number“, to see the fully supported list you see the table below, or visit the TechNet page.

http://technet.microsoft.com/library/jj150541%28v=exchg.150%29.aspx

 

So we can use any of the syntax above to search for any type of PII data. Next I am going to set the source to my team site, currently have a file stored there with the content in. To do this I click the “Modify Query Scope”

Next I will select the “Add Location” and past the URL of my Team Site and check it.

Now we should have a query form completed as shown below.

Adding a location will change the underlying the search query to be the following:

Now if we run the search we should get the results back as expected, obviously having to wait for Office 365 to perform a search crawl, which could take a while J

Of course the next step is to export the results or just to save it and perform the required hold and remedial work to fix this issue. This is the first implementation within the Office 365 platform, with great plans I am sure for future updates.