You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/data-protection-policies.md
+12-8Lines changed: 12 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,8 +7,6 @@ ms.topic: how-to
7
7
8
8
# File policies in Microsoft Defender for Cloud Apps
9
9
10
-
11
-
12
10
File Policies allow you to enforce a wide range of automated processes using the cloud provider's APIs. Policies can be set to provide continuous compliance scans, legal eDiscovery tasks, DLP for sensitive content shared publicly, and many more use cases. Defender for Cloud Apps can monitor any file type based on more than 20 metadata filters (for example, access level, file type).
13
11
14
12
## Supported file types
@@ -24,8 +22,9 @@ The engine combines three aspects under each policy:
24
22
* Context filters including user roles, file metadata, sharing level, organizational group integration, collaboration context, and additional customizable attributes.
25
23
26
24
* Automated actions for governance and remediation.
27
-
> [!NOTE]
28
-
> Only the governance action of the first triggered policy is guaranteed to be applied. For example, if a file policy has already applied a sensitivity label to a file, a second file policy cannot apply another sensitivity label to it.
25
+
26
+
> [!NOTE]
27
+
> Only the governance action of the first triggered policy is guaranteed to be applied. For example, if a file policy has already applied a sensitivity label to a file, a second file policy cannot apply another sensitivity label to it.
29
28
30
29
Once enabled, the policy continuously scans your cloud environment and identifies files that match the content and context filters, and apply the requested automated actions. These policies detect and remediate any violations for at-rest information or when new content is created. Policies can be monitored using real-time alerts or using console-generated reports.
31
30
@@ -55,7 +54,7 @@ To create a new file policy, follow this procedure:
55
54
56
55
1. Select **Create policy** and select **File policy**.
57
56
58
-
57
+
59
58
60
59
1. Give your policy a name and description, if you want you can base it on a template, for more information on policy templates, see [Control cloud apps with policies](control-cloud-apps-with-policies.md).
61
60
@@ -64,10 +63,12 @@ To create a new file policy, follow this procedure:
64
63
1. Within **Category**, link the policy to the most appropriate risk type. This field is informative only and helps you search for specific policies and alerts later, based on risk type. The risk may already be preselected according to the category for which you chose to create the policy. By default, File policies are set to DLP.
65
64
66
65
1.**Create a filter for the files this policy will act on** to set which discovered apps trigger this policy. Narrow down the policy filters until you reach an accurate set of files you wish to act upon. Be as restrictive as possible to avoid false positives. For example, if you wish to remove public permissions, remember to add the **Public** filter, if you wish to remove an external user, use the "External" filter and so on.
66
+
67
67
> [!NOTE]
68
68
> When using the policy filters, **Contains** searches only for full words – separated by commas, dots, spaces, or underscores. For example if you search for **malware** or **virus**, it finds virus_malware_file.exe but it does not find malwarevirusfile.exe. If you search for **malware.exe**, then you find ALL files with either malware or exe in their filename, whereas if you search for **"malware.exe"** (with the quotation marks) you find only files that contain exactly "malware.exe". **Equals** searches only for the complete string, for example if you search for **malware.exe** it finds malware.exe but not malware.exe.txt.
69
69
>
70
70
> For more information about File Policy Filters, see [File filters in Microsoft Defender for Cloud Apps](file-filters.md#file-filters).
71
+
71
72
1. Under the first **Apply to** filter, select **all files excluding selected folders** or **selected folders** for Box, SharePoint, Dropbox, or OneDrive, where you can enforce your file policy over all files on the app or on specific folders. You're redirected to sign in the cloud app, and then add the relevant folders.
72
73
73
74
1. Under the second **Apply to** filter, select either **all file owners**, **file owners from selected user groups** or **all file owners excluding selected groups**. Then select the relevant user groups to determine which users and groups should be included in the policy.
@@ -125,15 +126,18 @@ Each policy is composed of the following parts:
125
126
You can go to the Policy center to review file policy violations.
126
127
127
128
1. In the Microsoft Defender Portal, under **Cloud Apps**, go to **Policies** -> **Policy management**, and then select the **Information protection** tab.
129
+
128
130
1. For each file policy, you can see the file policy violations by selecting the **matches**.
129
131
130
-
![Screenshot of sample PCI matches.](media/pci-matches.png"Screenshot of sample PCI matches.")
132
+
:::image type="content" alt-text="Screenshot of sample PCI matches." source="media/pci-matches.png" lightbox="media/pci-matches.png":::
131
133
132
134
1. You can select the file itself to get information about the files.
133
135
134
-
![Screenshot of sample PCI content matches.](media/pci-content-matches.png"Screenshot of sample PCI content matches.")
136
+
:::image type="content" alt-text="Screenshot of sample PCI content matches." source="media/pci-content-matches.png" lightbox="media/pci-content-matches.png":::
137
+
138
+
1. For example, you can select **Collaborators** to see who has access to this file, and you can select **Matches** to see the Social Security numbers.
135
139
136
-
1. For example, you can select **Collaborators** to see who has access to this file, and you can select **Matches** to see the Social Security numbers.![Content matches credit card numbers.](media/content-matches-ccn.png"contentmatches Social Security numbers")
140
+
:::image type="content" alt-text="Content matches Social Security numbers." source="media/content-matches-ccn.png" lightbox="media/content-matches-ccn.png":::
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/release-note-archive.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -65,6 +65,7 @@ Defender for Cloud Apps plans to rotate its application certificate. If you’ve
65
65
66
66
```powershell
67
67
keytool -list -keystore ..\lib\security\cacerts
68
+
```
68
69
69
70
1. If you see the following four aliases, that means you have previously explicitly trusted our certificate and need to take action. If those aliases aren't present, no action should be needed.
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/tutorial-dlp.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -45,11 +45,13 @@ Our approach to information protection can be split into the following phases th
45
45
1.**Define which information is sensitive**: Before looking for sensitive information in your files, you first need to define what counts as sensitive for your organization. As part of our [data classification service](dcs-inspection.md), we offer over 100 out-of-the-box sensitive information types, or you can [create your own](/microsoft-365/compliance/create-a-custom-sensitive-information-type) to suit to your company policy. **Defender for Cloud Apps is natively integrated with Microsoft Purview Information Protection** and the same sensitive types and labels are available throughout both services. So when you want to define sensitive information, head over to the Microsoft Purview Information Protection portal to create them, and once defined they'll be available in Defender for Cloud Apps. You can also use advanced classifications types such as fingerprint or Exact Data Match (EDM).
46
46
47
47
For those of you that have already done the hard work of identifying sensitive information and applying the appropriate sensitivity labels, you can use those labels in your policies without having to scan the contents again.
48
+
48
49
1.**Enable Microsoft Information Protection integration**
49
50
1. In the Microsoft Defender Portal, select **Settings**. Then choose **Cloud Apps**.
50
51
1. Under **Information Protection**, go to **Microsoft Information Protection**. Select **Automatically scan new files for Microsoft Information Protection sensitivity labels and content inspection warnings**.
51
52
52
53
For more information, see [Microsoft Purview Information Protection integration](azip-integration.md).
54
+
53
55
1.**Create policies to identify sensitive information in files**: Once you know the kinds of information you want to protect, it's time to create policies to detect them. Start by creating the following policies:
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/use-case-admin-quarantine.md
+20-20Lines changed: 20 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,8 +7,6 @@ ms.topic: tutorial
7
7
8
8
# Tutorial: Protect files with admin quarantine
9
9
10
-
11
-
12
10
[File policies](data-protection-policies.md) are a great tool for finding threats to your information protection policies. For instance, create file policies that find places where users stored sensitive information, credit card numbers, and third-party ICAP files in your cloud.
13
11
14
12
In this tutorial, you'll learn how to use Microsoft Defender for Cloud Apps to detect unwanted files stored in your cloud that leave you vulnerable, and take immediate action to stop them in their tracks and lock down the files that pose a threat by using **Admin quarantine** to protect your files in the cloud, remediate problems, and prevent future leaks from occurring.
@@ -33,27 +31,27 @@ In this tutorial, you'll learn how to use Microsoft Defender for Cloud Apps to d
33
31
34
32
1. Do one of the following actions to quarantine the file:
1. The user can only access the tombstone file. In the file, they can read the custom guidelines provided by IT and the correlation ID to give IT to release the file.
53
51
54
52
1. When you receive the alert that a file has been quarantined, go to **Policies** -> **Policy Management**. Then select the **Information Protection** tab. In the row with your file policy, choose the three dots at the end of the line, and select **View all matches**. This brings you the report of matches, where you can see the matching and quarantined files:
1. After a file is quarantined, use the following process to remediate the threat situation:
59
57
@@ -62,7 +60,7 @@ In this tutorial, you'll learn how to use Microsoft Defender for Cloud Apps to d
62
60
1. If you find the file is against corporate policy, run the organization's Incident Response (IR) process.
63
61
1. If you find that the file is harmless, you can restore the file from quarantine. At that point the original file is released, meaning it's copied back to the original location, the tombstone is deleted, and the user can access the file.
1. Validate that the policy runs smoothly. Then, you can use the automatic governance actions in the policy to prevent further leaks and automatically apply an Admin quarantine when the policy is matched.
68
66
@@ -77,26 +75,28 @@ In this tutorial, you'll learn how to use Microsoft Defender for Cloud Apps to d
77
75
78
76
1. Set file policies that detect breaches. Examples of these types of policies include:
79
77
80
-
- A metadata only policy such as a sensitivity label in SharePoint Online
81
-
- A native DLP policy such as a policy that searches for credit card numbers
82
-
- An ICAP third-party policy such as a policy that looks for Vontu
78
+
- A metadata only policy such as a sensitivity label in SharePoint Online
79
+
- A native DLP policy such as a policy that searches for credit card numbers
80
+
- An ICAP third-party policy such as a policy that looks for Vontu
83
81
84
82
1. Set a quarantine location:
85
-
1. For Microsoft 365 SharePoint or OneDrive for Business, you can't put files in admin quarantine as part of a policy until you set it up:
To set admin quarantine settings, in the Microsoft Defender Portal, select **Settings**. Then choose **Cloud Apps**. Under **Information Protection**, choose **Admin quarantine**. Provide a site for the quarantine folder location and a user notification that your user will receive when their file is quarantined.
> Defender for Cloud Apps will create a quarantine folder on the selected site.
88
+
To set admin quarantine settings, in the Microsoft Defender Portal, select **Settings**. Then choose **Cloud Apps**. Under **Information Protection**, choose **Admin quarantine**. Provide a site for the quarantine folder location and a user notification that your user will receive when their file is quarantined.
93
89
94
-
1. For Box, the quarantine folder location and user message can't be customized. The folder location is the drive of the admin who connected Box to Defender for Cloud Apps and the user message is: This file was quarantined to your administrator's drive because it might violate your company's security and compliance policies. Contact your IT administrator for help.
> Defender for Cloud Apps will create a quarantine folder on the selected site.
94
+
95
+
1. For Box, the quarantine folder location and user message can't be customized. The folder location is the drive of the admin who connected Box to Defender for Cloud Apps and the user message is: This file was quarantined to your administrator's drive because it might violate your company's security and compliance policies. Contact your IT administrator for help.
95
96
96
97
## Next steps
97
98
98
99
> [!div class="nextstepaction"]
99
100
> [Best practices for protecting your organization](best-practices.md)
100
101
101
102
[!INCLUDE [Open support ticket](includes/support.md)]
0 commit comments