Two DLPs for the same environment

(0) Share

Report

Posted on by Plinderoth

Hi,

If we have two DLPs affecting the same environment, how is that handled?

For example; DLP1 has SharePoint and Twitter connectors both in the Business data group and DLP2 has SharePoint in Business data group and Twitter in No business data group. A flow in the environment is using both the Twitter and the SharePoint connector, will it work?

The best thing would be if DLPs where supersets of the DLPs affecting the environment so that new DLPs could be added on top of tenant DLP without having to re-add the same connectors and keep them consistent.

Categories:

Governance & administering

All responses (5)

Answers (0)

Sort by

Pstork1 69,661 Most Valuable Professional on at

Like
a
(1)

Report
Copy link

Link copied!

To the best of my knowledge, if you have two DLPs in the same environment then the most restrictive set will be applied. In the example you describe apps in that environment would NOT be able to use Twitter with SharePoint even though one of the DLP policies allowed it.
Plinderoth 42 on at

Like
a
(0)

Report
Copy link

Link copied!

Thanks for your reply. I did some testing also and what you say is what I am seeing. To bad it is not s superset of the DLPs instead, would make it some much easier to administer.
Pstork1 69,661 Most Valuable Professional on at

Like
a
(1)

Report
Copy link

Link copied!

To some extent it would make it easier, but also much more unpredictable. Any new DLP policy could completely subvert a previous policy.
Keith-Whatling 41 on at

Like
a
(0)

Report
Copy link

Link copied!

If you're building in SharePoint its a lot easier to handle this problem. I would advise a second environment specifically for the integrating Business Data with Social Media.

I would also ensure you have the centre of excellence spun up for your tenant and have a flow closely report on any new apps or flows in this environment. It will help to appease Infosec.
Plinderoth 42 on at

Like
a
(0)

Report
Copy link

Link copied!

The example was just an example and not an issue I have right now but thanks for your reply.

The real question was how the system handles two DLPs associated to the same environment and the answer seems to be that the most restricted DLP "wins". Which make sense the more I think about it.