Full transcript of “Data Loss Prevention in Microsoft 365 – Easy Guide for Beginners”. Click a timestamp to open the video at that moment. Need another video? Use the YouTube transcript generator.
0:00 What if one accidental email cost your business millions? You know, data doesn't get lost. Sometimes it actually walks out the door. In today's digital world, your data is actual currency. So, you've got to protect it. Welcome to your first line of defense. That is data loss protection in Microsoft 365. And guess what? That's what today's video is all about. But before we begin, just a quick intro as always. My name is Jonathan Edwards, also known as the Bearded 365 guy. I help businesses all over the world with a Microsoft 365. You
0:45 can find more information at bearded 365guy.com. Now, if you're a regular watcher of my YouTube channel, you will know that I talk a lot about protecting your users with things like MFA and conditional access policies. I talk a lot about protecting your devices with things like Defender for Business and Bit Locker and conditional access policies. But what about your actual data? After all, it's your data that's really precious. Now, few small businesses even consider this. Yes, they look after the users and the devices, but they never get round to protecting their data. Now, fortunately, if you're a Microsoft 365 user, they
1:32 have built-in technologies to help you do just that. Now, one of these is called data loss prevention, and that is what today's video is all about. So, what's data loss prevention? When trying to understand what data loss prevention is, it helps to read the words backwards. Basically, we are preventing the loss of data in your business. Let's look at a bit of analogy. I like analogies. Your business is a bucket and the data in your business is the water inside of the bucket. Now, unfortunately for you, there's a few holes in the bucket. So, you're leaking data and you don't want
2:18 to do that. So, what does DLP do? Well, it helps to plug holes in your bucket. Now, there are lots of areas in your business where you could lose data. There are Microsoft 365 services like email, SharePoint, One Drive, and Teams. So, someone could email something out of your business accidentally or on purpose. There's office applications like Word, Excel, and PowerPoint. And what about if you've still got an onremise server? You could accidentally lose data there, too. And what about other cloud applications like Box and Dropbox? Not to mention things like Copilot. You could be losing data via C-Pilot. Copart security is a big thing.
3:06 Now, as always, we're going to start getting into the depths of DLP and we're going to look at how it works. But before we get on to that, let's talk about the allimportant licensing. Now, if you're using Microsoft 365 Business Premium, which we recommend our clients do, you get DLP protection for email, SharePoint, and One Drive. Now, if you're wanting DLP protection for much more than that, things like devices, then unfortunately, you've got to go with Microsoft 365 E3 or E5. In today's video, we're going to be concentrating on a tenency with Microsoft 365 Business Premium. Now that we spoke about licensing, let's dive in. So, I've already said that DLP helps protect your business information, but I should go a
3:54 little bit further. It helps to protect your sensitive business information. That is what's precious to your business. Now, you might not be concerned if the photos from your works Christmas party were emailed out of your business. Depending on how you behaved at the works Christmas party, but if your business handles payments, you certainly don't want people's credit card information to be leaked outside of your business. You might not be concerned if Jeff from accounts wants to share his chocolate brownie recipe, but if you're a health care provider, you don't want your important research to get into the wrong hands. So, it's worth noting that not all business data is created equally. Now, before you start
4:40 getting into creating DLP policies, you need to decide what information in your business is deemed sensitive information. And you do that in Microsoft 365 through something called, wait for it, sensitive information types. Now, there are a couple of ways that your business can utilize sensitive information types in data loss prevention. Firstly, as with a lot of applications, Microsoft make it a little bit easy for you to get started. They've created some basic sensitive information types for different countries around the world. Or secondly, you can create your own custom sensitive information types based on the factors that are relevant
5:27 in your business. For example, you might be a financial services firm who are wanting to protect your trading algorithm or a health care provider wanting to protect your important research. All this is possible with data loss prevention in Microsoft 365. So, let's get started with the demo. I'm going to hop over to my screen now and I'm going to show you the sensitive information types. Let's go. So, sensitive information types and data loss prevention. Where can we find this in Microsoft 365? Well, welcome to my new test tenency. So, I've just created this tenency from scratch. I've logged in as the global admin and you can see
6:12 down the left hand side I've got my choice of admin centers. Now, data protection in Microsoft 365 lives in Microsoft Purview. Okay. So, I will launch that now. And here we are. Microsoft Purview. Now, a lot of people might find this a little bit overwhelming. There's a lot going on. There's lots of different tools. I do hope to cover a lot of these over the coming weeks. You can see here, look, if I just hover over solutions, I've got all these things. Microsoft have made a real effort recently to put all the data protection tools in one admin center. So, it does look a bit overwhelming, but don't worry about that. I'm going to head to data loss prevention, which opens up here. Now, we're going to start
6:59 moving through policies. But first, let's go to classifiers and let's go to sensitive information types. And these are the built-in sensitive information types that Microsoft provide. Now, you can see here, look, there are 225 of them. And we can just see from here, look, we've got things like Australian passport numbers, Australian driving license numbers. So, these are all pretty generic. We've got a lot of different countries in there. I I'm in the UK, so if I just type in UK, you can see that I've got some UK bits here. So, for example, if my company holds national insurance numbers, maybe they're held on documents within SharePoint. This is personal information
7:46 that I really don't want to get out into the the real world. So, what I would do is I would create a data loss prevention policy that targets the sensitive information type that is UK national insurance number. Also, you can see at the top look, we can create our own sensitive information types. if we want to move away from these generic ones. Now, creating sensitive information types is a new video and it's something that we're going to tackle over the coming weeks, okay? Because I think in my experience when I start to work with businesses, every business is different. Every business wants to protect different types of information and that is okay. But for now, I just wanted to introduce you to the sensitive
8:33 information types within Microsoft Purview. Okay, now we've looked at sensitive information types. It's time to move on and start creating a data loss prevention policy. Now, I'm going to start simple because simple is best. I'm going to use a template to create a data loss prevention for UK financial data. You ready? Let's go. Okay, we are back in the Microsoft Purview portal. Let's go ahead and set up a fairly basic data loss prevention policy. So, I'll go back into data loss prevention here. And you can see here, look, I've got something called policies. So, let's take a look here. I've got no policies set up at the moment. So, why don't we
9:18 click on create a policy. Okay. Now, let's start talking about templates. So as with a lot of Microsoft products, they do make it easy for you to get started and Microsoft have created some templates. Now these templates consist of a number of sensitive information types. Okay, let me go onto the financial category. Okay, so we've got a number of regulations here. I'm based in the UK, so it makes sense here for me to click on UK financial data. Now this is a template but it consists of these bits of information and each of these is a sensitive information type. So what you
10:05 can do is create your own or you can use one of these templates as it is or you can build on it. Okay. So let me just go through and use this one here. So I'll choose that and click on next. Then we've got to give it a name. Now it's it's autopop populated this name here UK financial data. It's also give it a description. You might want to change that but for this demo I'll keep it the same. Click on next. Okay. It's now reached the admin unit page. So I've got a Microsoft 365 business premium license in this tenency. So I can't do anything with admin units. As it says here, an E5 license is required for admin units. So what's an admin unit? Well, with an admin unit, you can you
10:50 can delegate the management and visibility of DLP policies based on groups and departments and things like that. An example of this might be if you're a large multinational company and you might have a different admin unit, maybe one for Europe, one for North America, one for Asia, and each region security team can only manage and view the policies in their respective areas. Okay? Okay. So, it's it's it's an enterprise thing and it's attached to the enterprise license, so we don't need to worry about it. Click on next. Okay. So, where do we now want to apply this policy? What holes in our bucket do we want to fill? We've got all these options. I'm going to keep it very simple in this video. I'm going to choose Exchange email, SharePoint size,
11:36 and one drive. And you can see here, look, we've got a scope section as well. So, at the moment, it's applying to all groups, all sites, all users. We can click on edit. This example is a SharePoint site. So we could exclude some sites if we wanted to. Okay. So we're talking about UK financial data. We might want to exclude, I don't know, the finance team SharePoint site for whatever reason or we could just apply this policy to specific sites. Okay. So as with these, we can get really granular. you know the I think the end result is for most organizations to have multiple DLP policies protecting different things. Once we're happy with that again we'll click on next. Next we
12:22 need to define the policy settings. So we've got the default settings chosen here or we can go into the advanced DLP rules which I'm not going to go into too much detail today. This is where at the start of this section I said we can take a template and we can expand on it. Okay. So this is the default settings at the moment but we can go in and we can start doing all sorts. We can add new groups. We can change the confidence levels. We can do all sorts and we'll be going into these advanced rules in a few weeks time. Okay. But for now I'm going to keep this as the default and I'm going to click on next. Okay. Now on to info to protect. So I'll leave these as the same again. But we've got this section here. Are we protecting this data with people outside of the
13:09 organization or with people inside of the organization? I think we need to choose this one here for now. With people outside my organization. So when someone internally tries to share information with people outside, this will kick in. Okay. Click on next. Now onto the protective actions. So the first section here when content matches this condition. So for example, if someone internally tries to send an email with a credit card number to someone outside of the organization, that would be a content match. That user would get a policy tip. Okay? And this is like a a notification. So what we can do is see what notifications they'll get. So this is within Excel. You can see here, look,
13:54 this file conflicts with a policy in your organization. If you don't resolve this, access might be blocked. We've also got a email notification down here. This item conflicts with the policy. Okay. What we can do, we can customize these. So we've got different customizations and notifications we can choose. So other people will be notified, which is good. So the owner, the person who sent, shared, and modified the content will be notified, but also the owners of the SharePoint site. Plus, we can add and remove users. So if you've got an information officer or something like that, you could add them in here. Okay. So we can customize that. Come out of there. And we've also got instant reports by email as well to the global admins. Okay. Happy with
14:42 that? Click on next. Okay. Now to customize access and override settings. You can see at the top. Look, it says by default user block from sending email and teams chat and channel messages that contain the type of content you're protecting. So people in our case will be blocked from sending for example credit card information. If I just click on here we get a few more options. We can customize it a little bit more. So at the moment we can block only people outside our organization from seeing these settings. I say so if a credit card information is sent, people outside the organization wouldn't be able to see it. We can block everyone which includes inside the organization. Okay. Then it says, "Let people who see the tip override the policy." So if we go back
15:27 to this one here, if I just scroll up, you can see the Excel document here. Look, there's an override. So people can override it if we select this. Okay. Override the rule automatically if they report as a false positive. So maybe it's not a credit card number at all, but DLP thinks it is. Uh this is a good option here. Look, if someone overrides, then they've got to provide a business justification as to why they've overridden it. Okay, so again, your information officer can review these. We've also got another option where says require the end user to explicitly acknowledge the override. So it's just a bit of extra security. Okay, we've got these going on here, but because I've unticked devices earlier in the policy, then these are grayed out.
16:15 Okay. Again, we'll go through these in some further videos. Click on next. We've got a simulation mode. Okay. So, this is like running the policy in test mode. It's not going to affect anything and the policy is switched off, but you will get some really good reporting. It's a good way to get started. Okay. If you're just introducing data loss prevention in your business, you don't want it to restrict everyone. So running it in simulation mode and maybe switching policy tips on so they can continue doing what they're doing is a good way to get started and then we can turn it in simulation mode but again you can switch it on in 15 days automatically or we can switch that on straight away. Okay, so I'm going to go
17:00 with this for my testing. Click on next review and finish. Let's create that DLP policy. Okay, our policy has now been created. I will click undone. Okay, our policy is now created. But for our policy to take effect, it can take a little bit of time. It might take an hour, it might take 6 hours, it might take 24 hours. Okay, we've now got a user called Percy Pig. And do you know what he's trying to do? He's trying to email somebody's credit card information outside of our business. The question is, will our policy work? Let's see. Okay, so we're in Percy Pig's email. Okay, and Percy is
17:47 going to share some credit card details externally. Now, he might be doing this maliciously. It might be doing this by accident. Okay, he might be thinking he's doing the right thing. He's going to type the email address in here. So, it's an external address. We'll put a subject line for the email. and then Percy will send these details. Now this is clearly a credit card information. Okay, so Percy will then click on send and he will send that email. So what happens next? Okay, so we immediately get an email back and I can open this email here and it says to us your message conflicts with a policy. Okay, and it wasn't delivered. And we can see here, look, the message contains sensitive information, which is a credit card
18:34 information. Okay, credit card number. So, we can see that our policy has done the job. There's a bit more information here and that email hasn't been sent outside of the business. So, our DLP policy is working as it should do. Okay, that is it. That is an introduction to data loss prevention in Microsoft 365. I hope you've enjoyed today's video. I love sing and
