Admins’ Microsoft Purview Data Loss Prevention (DLP) policies containing two specific predicates may not be enforced

Title: Admins’ Microsoft Purview Data Loss Prevention (DLP) policies containing two specific predicates may not be enforced
User impact: Admins’ DLP policies containing two specific predicates may not be enforced.
More info: This problem manifests only after modifying or creating DLP policies containing the “DocumentContainsWords” and “DocumentMatchesPatterns” predicates after this issue was introduced on approximately Monday, September 18, 2023, at 12:00 AM UTC. We recommend that customers refrain from modifying existing policies containing these predicates until we’ve addressed this problem to ensure proper DLP policy enforcement.
Current status: Based on additional testing, we’ve isolated a recent update in the Exchange Online Protection environment that has introduced a code regression and is resulting in this impact specifically for admins who modify or create DLP policies containing both the “DocumentContainsWords” and “DocumentMatchesPatterns” predicates. The Title, User impact, and scope of impact fields of this communication have been updated to reflect our improved understanding of this event. Based on our improved understanding of the problem, we’ve developed a code fix that we’re currently testing to ensure it won’t cause any unintended consequences before implementation.
Scope of impact: This issue may affect any admin’s DLP policies containing the “DocumentContainsWords” and “DocumentMatchesPatterns” predicates that have been modified or created since approximately Monday, September 18, 2023, at 12:00 AM UTC.
Start time: Monday, September 18, 2023, at 12:00 AM UTC
Root cause: A code regression introduced in a recent Exchange Online Protection service update may be preventing DLP policies containing the “DocumentContainsWords” and “DocumentMatchesPatterns” predicates from being properly enforced if the policy has been modified or created after the update was implemented.
Next update by: Monday, October 2, 2023, at 1:30 AM UTC

Comments

No comments yet. Why don’t you start the discussion?

Leave a Reply

Your email address will not be published. Required fields are marked *