Detections
Analytics
MS.DEFENDER.4.1v2 - A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency, blocking at a minimum: credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN).
Information
Users may inadvertently share sensitive information with others who should not have access to it. DLP policies provide a way for agencies to detect and prevent unauthorized disclosures.Solution
1. Sign in to the Microsoft Purview portal.2. Under the Solutions section on the left-hand menu, select Data loss
prevention.
3. Select Policies from the top of the page.
4. Select Create policy.
5. From the Categories list, select Custom.
6. From the Regulations list, select Custom policy and then click
Next.
7. Edit the name and description of the policy if desired, then click
Next.
8. Under Assign admin units, ensure Admin units is set to Full directory by default, then click Next.
9. Under Choose where to apply the policy, set Status to On
for at least the Exchange email, OneDrive accounts, SharePoint
sites, Teams chat and channel messages, and Devices locations, then
click Next.
10. Under Define policy settings, select Create or customize advanced
DLP rules, and then click Next.
11. Click Create rule. Assign the rule an appropriate name and
description.
12. Click Add condition, then Content contains.
13. Click Add, then Sensitive info types.
14. Add information types that protect information sensitive to the agency.
At a minimum, the agency should protect:
- Credit card numbers
- U.S. Individual Taxpayer Identification Numbers (ITIN)
- U.S. Social Security Numbers (SSN)
- All agency-defined PII and sensitive information
15. Click Add.
16. Under Actions, click Add an action.
17. Check Restrict Access or encrypt the content in Microsoft 365
locations.
18. Under this action, select Block Everyone.
19. Under User notifications, turn on Use notifications to inform your users and help educate them on the proper use of sensitive info.
20. Under Microsoft 365 services if using a GCC environment or under Microsoft 365 files and Microsoft Fabric items if using a Commercial environment, a section that appears after user notifications are turned on, check the box next to Notify users in Office 365 service with a policy tip or email notifications.
21. Click Save, then Next.
22. Select Turn the policy on immediately, then click Next.
23. Click Submit.
See Also
Item Details
Audit Name: CISA SCuBA Microsoft 365 Defender v1.8.0
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7(10)
Plugin: microsoft_azure
Control ID: 8974f8f50ada74c48056fad02e97c60183d23b364abac821c0df4c0b54852931