cirsec Baselines
Esc
Microsoft 365 tenant · Data protection

Enforce a DLP policy for sensitive data in Teams chats and channels

When it fails: Sensitive data can be posted in Teams chats and channels without control. No enforced DLP policy covers Teams, so bank, identity or card numbers can be sent to external participants or guests in a chat message.

CB-M365-DATA-002mediumactivemanualprofile baseline

Description

A Microsoft Purview DLP policy is turned on for the Teams chat and channel messages location, scoped to all users. It detects at least the sensitive information types of CB-M365-DATA-001, blocks messages that contain them when external users or guests take part in the conversation, and shows a policy tip to the sender.

Microsoft creates a default Teams DLP policy in some tenants; it can satisfy this control if it is turned on and covers the required sensitive information types.

Rationale

Teams is now a primary channel for exchanges with partners, through external access and guests. A DLP policy on Exchange and SharePoint alone leaves this channel open: the same IBAN or identity card number blocked in an email can be pasted in a chat.

Impact

Messages that match are hidden from external participants and the sender sees a notice. Tune the rules in simulation first to avoid blocking internal conversations.

Applies when

Requires: Microsoft Teams, Microsoft Purview E5 Compliance

Audit

  1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global Reader.
  2. Browse to Solutions > Data Loss Prevention > Policies.
  3. Find a policy whose Locations include Teams chat and channel messages for all users, with Status = On, a rule that detects the sensitive information types of CB-M365-DATA-001, the action Restrict access or encrypt the content for people outside the organization, and policy tips enabled.
  4. Alternative in Security & Compliance PowerShell: Get-DlpCompliancePolicy | Where-Object { $_.TeamsLocation } | Format-List Name,Mode,TeamsLocation,TeamsLocationException.
  5. Fail if no policy with Mode = Enable covers Teams for all users.

Remediation

  1. Sign in to the Microsoft Purview portal as at least a Compliance Administrator.
  2. Edit the policy of CB-M365-DATA-001 to add the Teams chat and channel messages location, or create a dedicated policy with the same rules.
  3. Set the action to block external access and enable policy tips.
  4. Run in simulation with policy tips, review Activity explorer, then turn the policy on.
  5. PowerShell alternative: Set-DlpCompliancePolicy -Identity <policy> -AddTeamsLocation All, then Set-DlpCompliancePolicy -Identity <policy> -Mode Enable.

Rollback

Remove the Teams location or set the policy back to simulation.

References

Mappings

FrameworkIDRelationNote
NIST SP 800-53 Rev. 55.1.1AC-4related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.SECURITYSUITE.3.2v1partialCovers the Teams location only; other locations are in CB-M365-DATA-001 and CB-M365-DATA-003.

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1567
  • related CB-M365-DATA-001 Enforce a DLP policy for sensitive data in Exchange, SharePoint and OneDrive

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr