Microsoft Purview: Data Loss Prevention - Endpoint DLP now detects sensitivity labels on files inside archives

🚨 The Signal: Endpoint DLP now detects sensitivity labels within archive files (e.g., .zip). This enhances data protection by ensuring classified data remains protected even when compressed, improving detection accuracy and control over sensitive information.

The Impact

Security teams and data owners are affected, reducing the risk of sensitive data exfiltration via compressed files.

• Security Teams: Reduced risk of data exfiltration through archives.
• Data Owners: Improved assurance that classified data remains protected.
• Compliance Officers: Enhanced ability to demonstrate data protection controls.
• IT Administrators: Potential need to refine existing DLP policies for archives.

The Action

1. Review existing Endpoint DLP policies for 'Content contains' conditions to ensure archive scanning is aligned with organisational requirements.
2. Test DLP policies with various archive types (.zip, .rar, etc.) containing labelled sensitive data.
3. Communicate updated DLP capabilities to data owners and relevant stakeholders.
4. Monitor DLP alerts related to archive files for false positives or negatives.

Domain: Purview · Impact: high · Workload: Microsoft Purview