Set Up Endpoint DLP Evidence Collection on your Azure Blob Storage
Endpoint Data Loss Prevention (Endpoint DLP) is part of the Microsoft Purview Data Loss Prevention (DLP) suite of features you can use to discover and protect sensitive items across Microsoft 365 services. Microsoft Endpoint DLP allows you to detect and protect sensitive content across onboarded Windows 10, Windows 11 and macOS devices. Learn more about all of Microsoft's DLP offerings. Before you start setting up the storage, you should review Get started with collecting files that match data loss prevention policies from devices | Microsoft Learn to understand the licensing, permissions, device onboarding and your requirements. Prerequisites Before you begin, ensure the following prerequisites are met: You have an active Azure subscription. You have the necessary permissions to create and configure resources in Azure. You have setup endpoint Data Loss Prevention policy on your devices Configure the Azure Blob Storage You can follow these steps to create an Azure Blob Storage using the Azure portal. For other methods refer to Create a storage account - Azure Storage | Microsoft Learn Sign in to the Azure Storage Accounts with your account credentials. Click on + Create On the Basics tab, provide the essential information for your storage account. After you complete the Basics tab, you can choose to further customize your new storage account, or you accept the default options and proceed. Learn more about azure storage account properties Once you have provided all the information click on the Networking tab. In network access, select Enable public access from all networks while creating the storage account. Click on Review + create to validate the settings. Once the validation passes, click on Create to create the storage Wait for deployment of the resource to be completed and then click on Go to resource. Once the newly created Blob Storage is opened, on the left panel click on Data Storage -> Containers Click on + Containers. Provide the name and other details and then click on Create Once your container is successfully created, click on it. Assign relevant permissions to the Azure Blob Storage Once the container is created, using Microsoft Entra authorization, you must configure two sets of permissions (role groups) on it: One for the administrators and investigators so they can view and manage evidence One for users who need to upload items to Azure from their devices Best practice is to enforce least privilege for all users, regardless of role. By enforcing least privilege, you ensure that user permissions are limited to only those permissions necessary for their role. We will use portal to create these custom roles. Learn more about custom roles in Azure RBAC Open the container and in the left panel click on Access Control (IAM) Click on the Roles tab. It will open a list of all available roles. Open context menu of Owner role using ellipsis button (…) and click on Clone. Now you can create a custom role. Click on Start from scratch. We have to create two new custom roles. Based on the role you are creating enter basic details like name and description and then click on JSON tab. JSON tab gives you the details of the custom role including the permissions added to that role. For owner role JSON looks like this: Now edit these permissions and replace them with permissions required based on the role: Investigator Role: Copy the permissions available at Permissions on Azure blob for administrators and investigators and paste it in the JSON section. User Role: Copy the permissions available at Permissions on Azure blob for usersand paste it in the JSON section. Once you have created these two new roles, we will assign these roles to relevant users. Click on Role Assignments tab, then on Add + and on Add role assignment. Search for the role and click on it. Then click on Members tab Click on + Select Members. Add the users or user groups you want to add for that role and click on Select Investigator role – Assign this role to users who are administrators and investigators so they can view and manage evidence User role – Assign this role to users who will be under the scope of the DLP policy and from whose devices items will be uploaded to the storage Once you have added the users click on Review+Assign to save the changes. Now we can add this storage to DLP policy. For more information on configuring the Azure Blob Storage access, refer to these articles: How to authorize access to blob data in the Azure portal Assign share-level permissions. Configure storage in your DLP policy Once you have configured the required permissions on the Azure Blob Storage, we will add the storage to DLP endpoint settings. Learn more about configuring DLP policy Open the storage you want to use. In left panel click on Data Storage -> Containers. Then select the container you want to add to DLP settings. Click on the Context Menu (… button) and then Container Properties. Copy the URL Open the Data Loss Prevention Settings. Click on Endpoint Settings and then on Setup evidence collection for file activities on devices. Select Customer Managed Storage option and then click on Add Storage Give the storage name and copy the container URL we copied. Then click on Save. Storage will be added to the list. Storage will be added to the list for use in the policy configuration. You can add up to 10 URLs Now open the DLP endpoint policy configuration for which you want to collect the evidence. Configure your policy using these settings: Make sure that Devices is selected in the location. In Incident reports, toggle Send an alert to admins when a rule match occurs to On. In Incident reports, select Collect original file as evidence for all selected file activities on Endpoint. Select the storage account you want to collect the evidence in for that rule using the dropdown menu. The dropdown menu shows the list of storages configured in the endpoint DLP settings. Select the activities for which you want to copy matched items to Azure storage Save the changes Please reach out to the support team if you face any issues. We hope this guide is helpful and we look forward to your feedback. Thank you, Microsoft Purview Data Loss Prevention TeamThe First Purview AMA of 2025 is Now On-Demand
The Microsoft Purview Community has kicked off a new year picking the brains of subject matter experts to understand all that Purview can do for their data security, governance, and compliance. The panelists: Maxime Bombardier - Purview Data Security and Horizontals Sandeep Shah - Purview Data Governance Peter Oguntoye - Purview Compliance A sampling of the questions: When will we see integration between the container sensitivity labels (groups and sites) and item sensitivity labels (files and emails)? Is there a matrix to see what capabilities in Purview can be used with which license? In Purview Activity Explorers, is there a way to save custom filters? There are the built-in filters, and then you can add additional filters, but never see an option to save. If not possible, is this a future enhancement coming? What is your advice on sharing confidential information with external users and the use of Information Protection labeling? I mean, do you recommend adding external users as guest users, or using a label configured with 'Any Authenticated Users' instead? If a large enterprise customer sees many false positives returned from trainable classifiers like profanity, how can they train or recreate these to more effectively use communication compliance The rest of the questions can be found in this post; even those that didn't make it to the live AMA are answered. Here is the full Jan 8th Purview AMA Recording: And finally, please comment below- what kind of content would you like to see from Purview experts or your fellow community members/users in the future? Thank you for engaging with the Purview Community!Fields with Formulas
Hi gang, I am using an accounting software called Xero, that has the ability to utilise custom templates I create in Word. My restaurant chain has a Central Kitchen and a Bakery. Both invoices are added into Xero but need to be split up when I am sending the Statement (payments are made into separation bank accounts). The Statement feature currently consolidates all invoices (from both the Bakery and CK). I need to find a way of splitting up the lines so that only the CK appears in the table; and visa versa for the Bakery. A difference between the Invoices is the Invoice Number (field code: <<Description>>). All Central Kitchen Invoices start with a "CK-"; and the Bakery with "BK-". Is there a field code formula to only capture data that contains the above in its reference, including all of the subsequent data on that Line? Perhaps you have another suggestion for this. I have attached a document for you reference. I have 2 separate tables where I would like the data split. Any help is greatly appreciated! Thank you very much, Danny
Copying Content Type and Fields from one Hub Site to another crashes Document Library
Hi, I have 2 Hub Sites on SharePoint Online (Site A and Site B). Site A has a Content Type called "Finance Document" with some fields. I follow the instruction on this page to create new Content Type, Fields and link the Fields to my Content Type using the field definition from Site A. https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/create-sharepoint-content-types-by-using-csom After that, my document library becomes inaccessible (screenshot), however I can still access its setting page or access it via CSOM code. Any idea why it happens ?SharePoint Online: PowerShell script to Remove a defined column accross the Site collection
Our large SharePoint Online Site collection used for Intranet Corporate Portal based on Publishing site, we have a large number of subsites into. We had to remove a field place into the page library of all those subsites. The following script was built to do that removal. You can adapt it as you want for your own requirements. [string]$username = "Admin@yourtenant.onmicrosoft.com" [string]$PwdTXTPath = "C:\SECUREDPWD\ExportedPWD-$($username).txt" $secureStringPwd = ConvertTo-SecureString -string (Get-Content $PwdTXTPath) $adminCreds = New-Object System.Management.Automation.PSCredential $username, $secureStringPwd [string]$RootSiteToCheck = "https://yourtenant.sharepoint.com/sites/YourSiteCollection" [string]$SPListToCheck = "Pages" [string]$SPFieldInternalNameToCheck = "PublishedDate" function Load-DLLandAssemblies { [string]$defaultDLLPath = "" # Load assemblies to PowerShell session $defaultDLLPath = "C:\Program Files\SharePoint Online Management Shell\Microsoft.Online.SharePoint.PowerShell\Microsoft.SharePoint.Client.dll" [System.Reflection.Assembly]::LoadFile($defaultDLLPath) $defaultDLLPath = "C:\Program Files\SharePoint Online Management Shell\Microsoft.Online.SharePoint.PowerShell\Microsoft.SharePoint.Client.Runtime.dll" [System.Reflection.Assembly]::LoadFile($defaultDLLPath) $defaultDLLPath = "C:\Program Files\SharePoint Online Management Shell\Microsoft.Online.SharePoint.PowerShell\Microsoft.Online.SharePoint.Client.Tenant.dll" [System.Reflection.Assembly]::LoadFile($defaultDLLPath) } function Check-And-Fix-Field-In-SPList ([Microsoft.SharePoint.Client.ClientContext]$Context, [Microsoft.SharePoint.Client.Web]$CurrentWeb) { $MyCurrentListTocheck = $CurrentWeb.Lists.GetByTitle($SPListToCheck) $AllSPListCT = $MyCurrentListTocheck.ContentTypes $Context.Load($MyCurrentListTocheck) $Context.Load($AllSPListCT) $Context.ExecuteQuery() Write-Host " ===>>> SubSite to check:", $CurrentWeb.Title, "- URL:", $CurrentWeb.Url -ForegroundColor Green Write-Host " ===>>> List to check:", $MyCurrentListTocheck.Title -ForegroundColor Green foreach($MySpListCT in $AllSPListCT) { Write-Host " -->> Content Type Name:", $MySpListCT.Name Write-Host " -->> Content Type ID:", $MySpListCT.id $Myfields = $MySpListCT.Fields $Context.Load($Myfields) $Context.ExecuteQuery() $MyfieldToCheck = ($Myfields | where {$_.InternalName -eq $SPFieldInternalNameToCheck}) if($MyfieldToCheck -ne $null) { Write-Host " ---------------------------------------------- " -ForegroundColor Yellow Write-Host " >>>> Field Name:", $MyfieldToCheck.Title -ForegroundColor Yellow Write-Host " >>>> Field InternalName:", $MyfieldToCheck.InternalName, "- Field ID:", $MyfieldToCheck.id -ForegroundColor Yellow Write-Host " >>>> Field Required:", $MyfieldToCheck.Required -ForegroundColor Yellow Write-Host " ---------------------------------------------- " -ForegroundColor Yellow $MyfieldToCheck.DeleteObject(); $MySpListCT.Update($false); $Context.Load($MySpListCT); $Context.ExecuteQuery() Write-Host " >>>> Field Deleted !!!!" -ForegroundColor Red } } } function Get-SPOSubWebs { Param( [Microsoft.SharePoint.Client.ClientContext]$Context, [Microsoft.SharePoint.Client.Web]$RootWeb ) $Webs = $RootWeb.Webs $Context.Load($Webs) $Context.ExecuteQuery() ForEach ($sWeb in $Webs) { Write-host " ====>> SubSite:", $sWeb.URL -ForegroundColor red Check-And-Fix-Field-In-SPList $Context $sWeb Get-SPOSubWebs -RootWeb $sWeb -Context $Context } } cls Write-Host " ---------------------------------------------- " Load-DLLandAssemblies Write-Host " ---------------------------------------------- " Write-host "===================================================================================================" -ForegroundColor Green $mySitectx = New-Object Microsoft.SharePoint.Client.ClientContext($RootSiteToCheck) $mySitectx.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($adminCreds.UserName, $adminCreds.Password) $mySitectx.RequestTimeout = 1000000 # milliseconds $myCurrentWeb = $mySitectx.Web $mySitectx.Load($myCurrentWeb) $mySitectx.ExecuteQuery() Write-Host " " Write-Host " ---------------------------------------------------------" Write-Host " >>>> # Server Version:" $mySitectx.ServerVersion " # <<<<<<" -ForegroundColor Green Write-Host " ---------------------------------------------------------" Write-Host " " Write-host "===================================================================================================" Write-host " -->> RootSite:", $myCurrentWeb.URL -ForegroundColor green Write-host "===================================================================================================" Check-And-Fix-Field-In-SPList $mySitectx $myCurrentWeb Get-SPOSubWebs $mySitectx $myCurrentWeb Write-host "===================================================================================================" Fabrice Romelard French version: http://blogs.developpeur.org/fabrice69/archive/2018/11/27/sharepoint-online-script-powershell-pour-supprimer-une-colonne-dans-tous-les-sites-d-une-collection.aspx Source used: https://social.technet.microsoft.com/wiki/contents/articles/31151.sharepoint-online-content-types-in-powershell-get.aspx https://social.technet.microsoft.com/wiki/contents/articles/31444.sharepoint-online-content-types-in-powershell-edit.aspx https://msdn.microsoft.com/en-us/library/microsoft.sharepoint.client.contenttype.aspx https://msdn.microsoft.com/en-us/library/microsoft.sharepoint.client.field.aspx https://thesharedcontext.wordpress.com/2014/12/11/removing-a-site-column-from-a-content-type-using-the-client-object-model/ http://www.sharepointdiary.com/2016/08/sharepoint-online-rename-column-using-powershell.html
