ASD's Blueprint for Secure Cloud

Data Loss Prevention: Warn users distributing OFFICIAL: Sensitive items

This section describes the configuration of Data Loss Prevention (DLP) policies within Microsoft Purview associated with systems built according to guidance in ASD's Blueprint for Secure Cloud.

Estimated reading time: 3 minutes

Instruction

The below tables outline the as built configuration for ASD’s Blueprint for Secure Cloud (the Blueprint) for the Microsoft Purview portal at the following URL:

https://compliance.microsoft.com/datalossprevention/policies

The settings described on these pages provide a baseline implementation for a system configured using the Blueprint. Any implementation implied by these pages should not be considered as prescriptive as to how an organisation must scope, build, document, or assess a system.

Implementation of the guidance provided by the Blueprint will differ depending on an organisation’s operating context and organisational culture. Organisations should implement the Blueprint in alignment with their existing change management, business processes and frameworks.

Placeholders such as <ORGANISATION.GOV.AU>, <BLUEPRINT.GOV.AU> and <TENANT-NAME> should be replaced with the relevant details as required.

Name

Item	Value
Name	Warn users distributing OFFICIAL: Sensitive items
Description	Provide a warning notification to users distributing OFFICIAL: Sensitive information

Admin units

Item	Value
Admin units	Full directory

Locations

Item	Value
Exchange email	All groups
SharePoint sites	All sites
OneDrive accounts	All users & groups
Teams chat and channel messages
Devices
On-premises repositories
Power BI workspaces

Advanced DLP rules

Caution users distributing OFFICIAL: Sensitive information

Item	Value
Name	Caution users distributing OFFICIAL: Sensitive information
Description

Conditions

Item	Value
Content is shared from Microsoft 365	with people outside my organization
AND
Content contains	Sensitivity labels
Group name	Default
Group operator	Any of these
Sensitive info types
- OFFICIAL Sensitive classified information	Medium confidence Instance count: `1` to `Any`
- OFFICIAL Sensitive Legislative-Secrecy classified information	Medium confidence Instance count: `1` to `Any`
- OFFICIAL Sensitive Personal-Privacy classified information	Medium confidence Instance count: `1` to `Any`
- OFFICIAL: Sensitive Legal-Privilege classified information	Medium confidence Instance count: `1` to `Any`
- All Credential Types	Medium confidence Instance count: `1` to `Any`
Trainable classifiers	Non disclosure agreement Loan agreements and offer letters Health/Medical forms Personal Financial Information

Actions

None

User notifications

Item	Value
Use notifications to inform your users and help educate them on the proper use of sensitive info	On
Microsoft 365 services
- Notify users in Office 365 service with a policy tip	Checked
Email notifications	Notify the user who sent, shared, or last modified the content
- Attach matching email message to the notification	Not checked
- Customize the policy tip text	Checked This item appears to contain Classified or otherwise sensitive information. Disclosure of this information may result in harm to the Australian Government or individuals. Please be sure you understand your obligations to protect this information
- Show the policy tip as a dialog for the end user before send	Checked
- Provide a compliance URL for the end user to learn more about your organization’s policies	Not checked

User overrides

Item	Value
Allow overrides from M365 services	Not checked

Incident reports

Item	Value
Use this severity level in admin alerts and reports	Low
Send an alert to admins when a rule match occurs	Off
Use email incident reports to notify you when a policy match occurs	Off

Additional options

Item	Value
If there’s a match for this rule, stop processing additional DLP policies and rules	Not checked
Priority	0

Policy mode

Item	Value
Policy mode	Turn the policy on immediately

Security & Governance

None identified

Design

None identified

Configuration

None identified

References

None identified