This document provides an overview of data loss prevention and rights management features in Microsoft 365. It discusses implementing more or less restrictive controls based on data sensitivity. New transport rule conditions and actions are introduced, including total message size filtering. Deep content analysis and predefined rules help identify and protect sensitive data. Rights management allows controlling data access and usage through encryption and usage rights. Integrations with Azure Active Directory and on-premises Active Directory are covered.

9. LESS RESTRICTIVE MORE RESTRICTIVE
• Apply the right level of control based on the sensitivity of the data
• Maximize control and minimize unnecessary user disruptions
Alert
“Allow delivery
but add a
warning.”
Append
“Allow delivery
but add a
disclaimer.”
Protect
“Allow delivery
but prevent
forwarding.”
Redirect
“Block
delivery
and redirect.”
Review
“Block delivery
until
reviewed.”
Block
“Do not
deliver.”
Modify
“Allow delivery
but modify
message.”
Classify
“Allow delivery
but apply
classification.”

11. Transport rules
Data Loss Prevention
Rights Management
11

12. Conditions
Actions
Exceptions
Conditions
Actions
Exceptions
12
New options
• Rules can be configured to run for a specific time
period
• Rules can be run in Test Mode
New filters
• Total message size
• Attachment extension keyword matching
• Sender IP address
New actions
• Criteria-based routing
• Forced TLS routing
• Halt processing of remaining rules on a message (“Stop
processing rules”)

15. DLP helps to
identify
monitor
protect
sensitive data through
deep content analysis

16. 16

17. • Content to monitor
• User action
• Mail flow actions
contains
• Credit cards
• EU debit cards
Defines the policy objectives
to help meet regulatory requirements
for identified content
Contains data type definitions
to help identify sensitive content
17

18. Predefined rules targeted at
sensitive data types
Advanced content detection
Combination of regular expressions,
dictionaries, and internal functions
(e.g., validate checksum on credit
card numbers)
Extensibility for customer and ISV-
defined data types

19. Conditions
Actions
Exceptions

20. Empower users to manage their
compliance
Contextual policy education
Doesn’t disrupt user workflow
Can work even when disconnected
Admin-customizable text and actions
20

21. 21

22. Comprehensive view of DLP
policy performance
Downloadable Excel workbook
Drill into specific departures from
policy to gain business insights
22

25. Information Author Information Recipient
2
3
1
4 5
6
8
7
9
Database Server RMS Active Directory
Publishing Consuming

26.  Use Windows Azure AD Right Management
 Out-of the box
 Integrate natively with Exchange online and SharePoint online
 Integrate Office 365 with existing on-premises AD RMS
infrastructure

34. NwTraders Contoso
1. NwTraders
exports private
key and SLC
2. Contoso
imports
private key
and SLC
4. Ilse sends PL
and RAC with
request for UL
from local
licensing server
5. Contoso
uses imported
private key to
decrypt PL and
issues UL
3. Robin send IRM-Protected
message to Ilse

36. BYOK and logging are
not compatible with
Exchange Online

44. emailtext
disclaimertext
image

45. image

46. image
portaltext

47. Exchange Online
Policy detection and
Enforcement
Tenant
configuration
O365 User Internet User
Microsoft
account/Organization
Account
Mail Reading Portal

50. Ilse Van Criekinge
Technology Advisor Business Productivity
@ivcrieki, ilvancri@microsoft.com