Connect Microsoft Exchange and Enterprise DLP

1. Contact your email domain provider to update your SPF record to add the required Enterprise DLP service IP addresses.

   Add the IP addresses for the region where you host your email domain. You can update your SPF record with multiple regional IP addresses if you have email domains hosted in multiple regions.

   • APAC
     35.186.151.226 and 34.87.43.120
   • Europe
     34.141.90.172 and 34.107.47.119
   • India
     34.93.185.212 and 35.200.159.173
   • United States
     34.168.197.200 and 34.83.143.116
2. (Best Practices) Confirm that Active Directory is properly configured so that email senders have a manager to approve or reject quarantined emails.

   Microsoft Exchange Active Directory is required to assign a manager to a sender. You can create a transport rule to quarantine and send the email for approval by the sender's manager. To successfully quarantine a sender's email if sensitive data is detected by Enterprise DLP, a sender must have a manager assigned.

   If you did not assign a manager to a user, then Microsoft Exchange sends the quarantined email to the intended recipient. Microsoft Exchange requires that you assign a user a manager to approve or reject the email.
3. (Best Practices) Save Evidence for Investigative Analysis with Enterprise DLP.

   Palo Alto Networks recommends configuring evidence storage so you can download emails for investigative analysis when your review Email DLP incidents.
4. Set up the Cloud Identity Engine (CIE).

   Palo Alto Networks recommends using CIE so you can create targeted Email DLP policies.
5. Create the Microsoft Exchange connectors and transport rules, and create the Email DLP Policy.

   Palo Alto Networks recommends setting up all connectors, transport rules, and Email DLP policy rules to ensure enforcement begins as soon as you successfully connect Microsoft Exchange Online to Enterprise DLP.

   • Create a Microsoft Exchange Outbound Connector
     The outbound connector controls the flow of emails forwarded from Microsoft Exchange to Enterprise DLP.
   • Create a Microsoft Exchange Inbound Connector
     The inbound connector controls the flow of emails forwarded to Enterprise DLP back to Microsoft Exchange.
   • Create Microsoft Exchange Transport Rules
     Transport rules allow Microsoft Exchange to forward emails to Enterprise DLP and specify the actions Microsoft Exchange takes based on the hosted quarantine, admin approval, manager approval, encrypt, or block transport rules verdicts rendered by Enterprise DLP.
   • Add a Enterprise DLP Email Policy
     The DLP email policy specifies the incident severity and the action Enterprise DLP takes when matching traffic is inspected and sensitive data is detected.
6. Obtain Your Microsoft Exchange Domain and Relay Host.
7. Log in to Strata Cloud Manager.
8. Select ManageConfigurationSaaS SecuritySettingsApps Onboarding.
9. Search for Exchange and click Microsoft Exchange.

10. In the Email DLP Instance, click Add Instance.
11. In the Setup Connectors and Rules page, click Continue to Next Section since you have already configured the outbound connector, inbound connector, and transport rules.
12. In the Configure Smart Host page, add the email domains and relay hosts.

    Enterprise DLP requires adding one or more email domains and relay hosts to ensure Enterprise DLP can successfully forward inspect emails back to Microsoft Exchange.

    1. Enter an Email Domain and its corresponding Relay Host you obtained in the previous step.

       Obtain Your Microsoft Exchange Domain and Relay Host if you don't have the Microsoft Exchange email domain and relay host immediately available.
    2. (Optional) Add any additional email domains and relay hosts as needed.
    3. Connect.
13. Microsoft Exchange is now successfully connected and onboarded.

14. Configure the Email DLP settings.

    • Edit the snippet settings to configure if and how Enterprise DLP stores and masks snippets of sensitive data that match your data pattern match criteria.
    • Edit the policy evaluation timeout settings to configure what Enterprise DLP does when Email DLP policy evaluation exceeds the configured timeout.
    • Configure evidence storage to save evidence for investigative analysis.