Use Distribution Lists or Security Groups to Add Accounts to DLP Policies

Teams and DLP (and now OneDrive too)

Updated February 24, 2021

Almost two years ago, Microsoft added Teams to the workloads supported by Data Loss Prevention (DLP) policies (Figure 1). For Teams, DLP checking occurs after users send messages to chats or channels. Offending messages are blocked, sometimes after a short delay. The system works well, but whether it is worth spending extra for Office 365 E5 licenses is debatable (DLP checking for Exchange Online and SharePoint Online is covered in Office 365 E3).

In any case, message center update MC234475 published on January 15 says that “DLP for Microsoft Teams will soon support security groups and distribution lists as part of the Teams location picker.” (Microsoft 365 roadmap item 68874). Rollout is scheduled for mid-February with completion worldwide in mid-March.

Upgrading the Teams Location Picker

The title used for MC234475 is a tad obscure for even those accustomed to working with DLP policies. The Teams location picker is a Microsoft term for the UI component used to select the Teams user accounts to include or exclude in a DLP policy. Teams shares its location picker with Exchange Online while SharePoint and OneDrive for Business, which operate based on site URLs, have a different picker. Many DLP policies operate on a whole organization basis, meaning that no accounts are explicitly included or excluded as the DLP policy applies to every channel and every user in the organization. In these cases, you don’t worry about the location picker because it’s not used.

Things are more problematic when different policies are deployed to different user groups within an organization. Now the location picker is used to select which accounts come within the scope of a DLP policy. Exchange Online has always used distribution lists to select accounts to set the scope for policies, but up to now compliance administrators were forced to select individual accounts for Teams DLP policies (the Teams locations). The change being made in the Teams location picker allows administrators to select distribution lists and mail-enabled security groups instead of individual accounts (Figure 2).

Because distribution lists and mail-enabled security groups can contain more than accounts, Teams applies a filter to select only Teams-enabled accounts from the membership.

DLP Used in Large Organizations

Being able to use distribution lists and security groups to select the target accounts for DLP policies is a welcome update because it is much easier to add one or two distribution lists to a policy instead of finding and adding potentially hundreds of individual accounts. In addition, being able to specify distribution lists and mail-enabled security groups instead of individual accounts removes the previous limit of 1,000 individual accounts that could be added to a Teams DLP policy.

Microsoft said that Teams is used by 93 of the Fortune 100 in March 2020. Given that Teams had 44 million active users then and the latest data (October 2020) says Teams has 115 million daily active users, it’s obvious that a bunch of large organizations use Teams. Those are exactly the kind of tenants likely to use DLP to help control the sharing of confidential data. It’s also reasonable to assume that these tenants will be interested in granular control over policy scope (for instance, to apply a policy on a country or department-level basis) and therefore use the Teams location picker. Being able to use distribution lists or security groups reduces administrator workload and avoid the need to use PowerShell to update the Teams location in DLP policies when large number of accounts need to be added.

List and Group Updates Handled

Even better, if you use a distribution list or security group to define the scope of a Teams DLP policy, a background process keeps an eye on the membership of the list or group so that if accounts are added to or leave the list or group, the DLP policy is automatically adjusted to reflect the membership changes.

Picker for OneDrive for Business Accounts

Microsoft 365 notification MC241352 published on February 24 brought further good news in that the picker for OneDrive accounts in DLP policies will support distribution lists and security groups from March 2021 (Microsoft 365 roadmap item 70708). Exactly the same reasons exist why this is a welcome update.

---

DLP is covered in Chapter 22 of the Office 365 for IT Pros eBook. It’s not the most compelling topic we cover, but it is technically challenging and interesting in its own right.