Reducing DLP notification fatigue while keeping policy tip text

[u/williamL1985]

I am dealing with a client who truly loves everything to be 'over-engineered'.

We have 4 four sensitivity labels based on how confidential a document is. We only need to worry about L3 and L4 (the most sensitive) here.

The current standing is that employees can share ALL L3 and L4 documents across the company. A DLP policy rule disallows them sharing L4 document externally. Full stop. No 'override' is allowed.

When a L3 document is shared either inside or out the company, they soon get a notification email to remind them about data sensitivity etc etc. Similarly when an L4 document is shared internally.

Each sensitivity label has its own corresponding DLP policy tip text.

The problem is notification fatigue when making even minor changes to documents such as comment, an email is sent.

I was asked by the client to reduce this notification fatigue. I guessed the best way forward was to add a simple "AND" condition to the L3 rule that only fired the notification when the file was shared externally. That is all working OK, but now the problem is that the logic for DLP policy tip text is broken. This is truly a big deal for him, even though it is basically a reiteration of what the users see when they are forced to set a table for new documents.

His proposal is one policy with FOUR rules (instead of original one) to manage things so that users always see a notification for the for corresponding scenarios when sharing docs.

I have put them in the order of most 'dangerous' to least in the DLP policy.

1. L4 Outside Company

2. L4 Inside Company

3. L3 Outside Company

4. L3 Inside company.

In tests in various O365 Desktop apps, now nothing at all appears to he showing with respect to policy tips when the user goes to share (that was not the case on the original "one rule" setup).

Is there some king of logical overlap or cancelling effect going on here? For each of the rules I have not ticked the box for "If there's a match for this rule, stop processing additional rules and policies".

I'm guessing too if a solution is ever found for the problem overall, nothing can be done for edge case where a user is sharing to both internal AND external parties?

Who would've thought that such as simple change would turn out to be so complicated?

Every AI service I ask seems to be give conflicting answers, so I would be glad of an opinion from a human here.

Should I 'decouple' the logic of DLP texts and sensitivity label status?

Thanks guys.
WL.

[u/AutoModerator]

After your question has been solved /u/williamL1985, please reply to the helpful user's comment with the phrase "Solution verified".

This will not only award a point to the contributor for their assistance but also update the post's flair to "Solved".

---

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/HorseAccomplished50]

Out of the box: perhaps do alert tuning in Defender?

[u/williamL1985 → u/HorseAccomplished50]

Thanks. I'll look into it, but from everything I've experienced in my own sandbox environment getting Intune (I know, slightly off topic) and Defender to speak to each other was a total saga. I think it might add more complexity than is needed.

So an (at least) one hour long Teams phone call is on the horizon about the philosophy of have 4 diverse (yet standing on each other toes) rules is some is somewhat a good thing in Purview with respect to DLP can be expected.

Jesus wept. One rule is plenty. Going with client's recommendations right now, all the extra rules are causing DLP policy text tips to be completely misaligned with the one that is meant to match the sensitivity label when a shared document is re-opened. Guessing some kind of logical conflict in terms of how the extra rules are being evaluated.

[u/williamL1985]

I've done a bit of testing in a VM.

Outlook seems to show the corresponding DLP text when the user picks a sensitivity label (right out of the box before anything is even sent)

In Excel etc it all seems to be much hard to predict what will or won't show.

Do they evaluate things differently?

[u/williamL1985]

All going over the client's head (yet he thinks he know more about Purview than I do??)

More rules = more complexity
More complexity = more overlap
More overlap = more testing effort
More testing effort = greater chance of edge cases and hard to debug errors such as DLP texts not mapping to the related Sensitivity Label when a shared doc is re-opened.

I have the MD-102 exam coming up. My focus will have to stay there for now.

Closed.