|
1 | 1 | --- |
2 | 2 | title: DLP content inspection |
3 | 3 | description: This article describes the process Defender for Cloud Apps follows when performing DLP content inspection on data in your cloud. |
4 | | -ms.date: 01/29/2023 |
| 4 | +ms.date: 06/26/2025 |
5 | 5 | ms.topic: how-to |
6 | 6 | --- |
7 | 7 | # DLP content inspection in Microsoft Defender for Cloud Apps |
8 | 8 |
|
9 | 9 |
|
| 10 | +Data loss prevention (DLP) in Microsoft Defender for Cloud Apps uses content inspection to detect sensitive information in files. When content inspection is enabled, Defender for Cloud Apps analyzes files for text patterns defined by expressions. Text that meets these expressions is treated as a match and can be used to determine a policy violation. |
10 | 11 |
|
11 | | -If you enable content inspection, you can choose to use preset expressions or to search for other customized expressions. |
| 12 | +You can use preset or custom expressions and define a threshold for when a match constitutes a violation. For example, you can set a threshold of 10 to alert when a file contains at least 10 credit card numbers. |
12 | 13 |
|
13 | | -You can specify a regular expression to exclude a file from the results. This option is highly useful if you have an inner classification keyword standard that you want to exclude from the policy. |
| 14 | +Matched text is replaced with "X" characters, and the surrounding context (100 characters before and after the match) is masked. Numbers in the context are replaced with "#" and aren't stored. To expose the final four digits of a match, enable the **Unmask the last four characters of a match** setting in the file policy. |
14 | 15 |
|
15 | | -You can decide set the minimum number of content violations that you want to match before the file is considered a violation. For example, you can choose 10 if you want to be alerted on files with at least 10 credit card numbers found within its content. |
| 16 | +You can also define which file elements are inspected—content, metadata, or file name. By default, inspection applies to both content and metadata. This approach allows inspection of protected files, detection of sensitive data, enforcement of compliance, and application of governance controls, while reducing false positives and aligning enforcement with internal classification standards. |
| 17 | + |
| 18 | +## Prerequisites |
| 19 | + |
| 20 | +To inspect encrypted files, and enable scanning of labels a [Global Administrator](/entra/identity/enterprise-apps/configure-admin-consent-workflow) must first grant one‑time admin consent to Defender for Cloud Apps in Microsoft Entra ID. |
| 21 | + |
| 22 | +To do this, in the Defender portal go to **Settings > Cloud Apps > Microsoft Information Protection > Inspect protected files**, and select **Grant permission**. |
16 | 23 |
|
17 | | -When content is matched against the selected expression, the violation text is replaced with "X" characters. By default, violations are masked and shown in their context displaying 100 characters before and after the violation. Numbers in the context of the expression are replaced with "#" characters and are never stored within Defender for Cloud Apps. When creating a file policy, if you've enabled an inspection method, then you can select the option to **Unmask the last four characters of a match** to unmask the last four characters of the violation itself. It's necessary to set which data types the regular expression searches: content, metadata and/or file name. By default it searches the content and the metadata. |
18 | 24 |
|
19 | 25 | ## Content inspection for protected files |
20 | 26 |
|
21 | | -Defender for Cloud Apps allows admins to grant Defender for Cloud Apps permission to decrypt encrypted files and scan their content for violations. This consent is also required to enable scanning labels on encrypted files. |
| 27 | +Once consent is granted, Defender for Cloud Apps provisions the Microsoft Cloud App Security (Internal) app in your tenant. The app uses the Azure Rights Management Services > Content.SuperUser permission to decrypt and inspect protected files. |
| 28 | + |
| 29 | +The following app IDs apply based on your Microsoft cloud environment: |
| 30 | + |
| 31 | +**App IDs** |
| 32 | + |
| 33 | +| Environment | App ID | |
| 34 | +|--------------|---------| |
| 35 | +| Public | 25a6a87d-1e19-4c71-9cb0-16e88ff608f1 | |
| 36 | +| Fairfax | bd5667e4-0484-4262-a9db-93faa0893899 | |
| 37 | +| GCCM | 23105e90-1dfc-497a-bb5d-8b18a44ba061 | |
| 38 | + |
| 39 | +>[!NOTE] |
| 40 | +>App IDs are internal service principals used by Defender for Cloud Apps in Public, Fairfax, and GCC‑M environments to inspect and enforce DLP policies on protected files. |
| 41 | +>Don't remove or disable these App IDs. Doing so breaks inspection and prevent DLP policies from applying to protected files. |
| 42 | +>Always verify that the App ID for your environment is present and enabled. |
| 43 | +
|
| 44 | +## Configure Microsoft Information Protection settings |
22 | 45 |
|
23 | 46 | In order to give Defender for Cloud Apps the necessary permissions: |
24 | 47 |
|
25 | | -1. Go to **Settings** and then **Microsoft Information Protection**. |
26 | | -2. Under **Inspect protected files**, select **Grant permission** to grant Defender for Cloud Apps permission in Microsoft Entra ID. |
27 | | -3. Follow the prompt to allow the required permissions in Microsoft Entra ID. |
28 | | -4. You can configure the settings per file policy to determine which policies will scan protected files. |
| 48 | +1. Go to **Settings** > **Microsoft Information Protection**. |
| 49 | +1. Under **Microsoft Information Protection settings**, configure one or both of the following options: |
| 50 | + |
| 51 | + - **Automatically scan new files for Microsoft Information Protection sensitivity labels and content inspection warnings.** When enabled, the App connector scans new files for embedded sensitivity labels from Microsoft Information Protection. |
| 52 | + |
| 53 | + - **Only scan files for Microsoft Information Protection sensitivity labels and content inspection warnings from this tenant.** When enabled, only sensitivity labels applied within your tenant are scanned. Labels applied by external tenants are disregarded. |
| 54 | + |
| 55 | +1. After selecting your options, select **Save** to apply your changes. |
| 56 | + |
| 57 | +## Configure file policies for protected files |
| 58 | + |
| 59 | +1. In the Defender portal, go to **Settings > Cloud Apps > Policies > Policy management**. |
| 60 | +1. Follow the steps to [create a new file policy](data-protection-policies.md#create-a-new-file-policy). |
| 61 | +1. Select either **Apply to all files**, or **Apply to selected files** to specify which files to scan. This option is useful if you have an inner classification keyword standard that you want to exclude from the policy. |
| 62 | +1. Select **Inspection method** > **Data Classification Service** to enable content inspection for the policy. |
| 63 | +1. Check both boxes - **Inspect protected files** and **Unmask the last 4 characters of a match**. |
| 64 | + |
| 65 | + :::image type="content" source="media/content-inspection/inspection-method-data-classification-service.png" alt-text="Screenshot that shows the Data classification service inspection method."::: |
| 66 | + |
29 | 67 |
|
30 | 68 | ## Next steps |
31 | 69 |
|
32 | | -> [!div class="nextstepaction"] |
33 | | -> [Control cloud apps with policies](control-cloud-apps-with-policies.md) |
| 70 | +- [Tutorial: Discover and protect sensitive information in your organization](tutorial-dlp.md) |
| 71 | +- [Learn how to control cloud apps using policies](control-cloud-apps-with-policies.md) |
| 72 | +- [Integrate with Microsoft Purview for information protection](azip-integration.md) |
34 | 73 |
|
35 | 74 | [!INCLUDE [Open support ticket](includes/support.md)] |
0 commit comments