Enterprise DLP
How Does Email DLP Work?
Table of Contents
How Does Email DLP Work?
Learn more about the Email DLP architecture and how emails are transported to and
from Enterprise Data Loss Prevention (E-DLP) for inspection.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
|
To prevent sensitive data exfiltration, Enterprise Data Loss Prevention (E-DLP) needs to perform inline
inspection of all outbound emails. To do this, Enterprise DLP uses an inbound and
outbound connector to transport outbound emails to and from Enterprise DLP for
inspection and verdict rendering. You must also create email transport rules to specify
the actions Microsoft Exchange or Gmail take based on the verdicts rendered by Enterprise DLP.
Enterprise DLP adds an email header to the email after inspection to indicate that
Enterprise DLP has already inspected the email. If Enterprise DLP renders
a Block or Quarantine verdict
for inspected email, an email header to indicate the verdict is added as well. Emails
that are already inspected are not transported to Enterprise DLP a second time and
Microsoft Exchange or Gmail take action based on the existing email headers.
After Enterprise DLP inspects an email, it's returned back to Microsoft Exchange or
Gmail for further action based on the rendered verdict.
The email flow for inline inspection of emails using Enterprise DLP is as
follows:
- An email is sent from within your organization to a recipient outside your organization.The outbound email can be sent from a desktop mail client, a web-based mail client, or a mobile device.
- The email transport rule instructs Microsoft Exchange or Gmail to forward the outbound email to Enterprise DLP for inspection.
- Enterprise DLP inspects the email subject line, body, and attachments against your Email DLP policies and renders a verdict.Enterprise DLP adds email headers to mark that it's been inspected and what verdict was rendered.Enterprise DLP does not support inspection of document links contained in either the email subject or body.
- The email is returned back to Microsoft Exchange or Gmail.
- Microsoft Exchange or Gmail takes action based on their respective transport rules.
- Microsoft Exchange or Gmail send the allowed email to the intended recipient if allowed.An email is allowed if Enterprise DLP did not detect any sensitive data or if the email was quarantined and approved.
Which Components of the Email Does Email DLP Inspect?
Enterprise DLP supports inspection of the following email
components.
- Email subject
- Email body
- Email attachmentsEnterprise DLP supports the inspection of the following types of email attachments.
- All supported file types up to 20 MB in size
- .eml files and up to five levels of nested .eml email files
Microsoft Exchange—User must click Forward as Attachment. Enterprise DLP requires this is setting to inspect the email file attachments. Forwarding email file attachments using any other method isn't supported and prevents Enterprise DLP for inspecting .eml attachments.Gmail—Only MIME email file attachments are supported. Gmail does not support Forward as Attachment functionality. Users must attach the nested email file in .eml format.
Which Regions Does Email DLP Support?
Enterprise DLP supports Email DLP in the following regions:
- Germany (Europe)
- India
- Singapore (APAC)
- United States
What Microsoft Exchange Online Licenses Are Required for Email DLP?
Email DLP supports any Microsoft Exchange Online license, including Microsoft 365
Defender, Microsoft 365, and Office 365 E5 licenses for inline inspection of
outbound emails using Enterprise DLP.
The type of Microsoft Exchange Online license you have active determines the
supported Email DLP functionality available to your Microsoft Exchange Online
deployment.
Enterprise DLP does not support the MSDN license for Email DLP. MSDN does
not support the use of inbound connectors to route emails, which
Enterprise DLP requires to forward outbound emails back to Microsoft
Exchange after inspection.
What Functionality Do Microsoft Exchange Licenses Support?
Email DLP supports the following functionality based on your active Microsoft
Exchange license.
- Any Microsoft Exchange Online licenses except MSDN
- Inspect outbound emails
- Block outbound emails containing sensitive data
- Send outbound emails containing sensitive data for admin approval
- Send outbound emails containing sensitive data for manager approval
- Microsoft 365 Defender licenseSee the Microsoft 365 Defender prerequisites for more information.
- Inspect outbound emails
- Block outbound emails containing sensitive data
- Send outbound emails containing sensitive data for admin approval
- Send outbound emails containing sensitive data for manager approval
- Send outbound emails containing sensitive data to hosted quarantine for approval
- Microsoft 365 or Office 365 E5 license
- Inspect outbound emails
- Block outbound emails containing sensitive data
- Send outbound emails containing sensitive data for admin approval
- Send outbound emails containing sensitive data for manager approval
- Send outbound emails containing sensitive data to hosted quarantine for approval
- Encrypt outbound emails containing sensitive data before they are sent to the recipient