{
  "id": "CB-M365-DATA-002",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-002",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-002.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-002.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DATA-002",
    "title": "Enforce a DLP policy for sensitive data in Teams chats and channels",
    "finding": {
      "title": "Sensitive data can be posted in Teams chats and channels without control",
      "description": "No enforced DLP policy covers Teams, so bank, identity or card numbers can be sent to external participants or guests in a chat message."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "dlp",
      "purview",
      "data-protection",
      "teams",
      "gdpr"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams",
        "Microsoft Purview E5 Compliance"
      ]
    },
    "description": "A Microsoft Purview DLP policy is turned on for the **Teams chat and channel messages** location,\nscoped to all users. It detects at least the sensitive information types of CB-M365-DATA-001,\nblocks messages that contain them when external users or guests take part in the conversation,\nand shows a policy tip to the sender.\n",
    "rationale": "Teams is now a primary channel for exchanges with partners, through external access and guests.\nA DLP policy on Exchange and SharePoint alone leaves this channel open: the same IBAN or\nidentity card number blocked in an email can be pasted in a chat.\n",
    "impact": "Messages that match are hidden from external participants and the sender sees a notice. Tune\nthe rules in simulation first to avoid blocking internal conversations.\n",
    "notes": "Microsoft creates a default Teams DLP policy in some tenants; it can satisfy this control if it is\nturned on and covers the required sensitive information types.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global\n   Reader.\n2. Browse to **Solutions** > **Data Loss Prevention** > **Policies**.\n3. Find a policy whose **Locations** include **Teams chat and channel messages** for all users,\n   with **Status** = **On**, a rule that detects the sensitive information types of\n   CB-M365-DATA-001, the action **Restrict access or encrypt the content** for people outside the\n   organization, and policy tips enabled.\n4. Alternative in Security & Compliance PowerShell: `Get-DlpCompliancePolicy | Where-Object\n   { $_.TeamsLocation } | Format-List Name,Mode,TeamsLocation,TeamsLocationException`.\n5. Fail if no policy with `Mode` = `Enable` covers Teams for all users.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Purview portal as at least a Compliance Administrator.\n2. Edit the policy of CB-M365-DATA-001 to add the **Teams chat and channel messages** location,\n   or create a dedicated policy with the same rules.\n3. Set the action to block external access and enable policy tips.\n4. Run in simulation with policy tips, review **Activity explorer**, then turn the policy on.\n5. PowerShell alternative: `Set-DlpCompliancePolicy -Identity <policy> -AddTeamsLocation All`,\n   then `Set-DlpCompliancePolicy -Identity <policy> -Mode Enable`.\n",
      "rollback": "Remove the Teams location or set the policy back to simulation.\n"
    },
    "references": [
      {
        "title": "Default DLP policy for Teams",
        "url": "https://learn.microsoft.com/purview/dlp-teams-default-policy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Create and deploy data loss prevention policies",
        "url": "https://learn.microsoft.com/purview/dlp-create-deploy-policy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.3.2v1",
        "relation": "partial",
        "note": "Covers the Teams location only; other locations are in CB-M365-DATA-001 and CB-M365-DATA-003."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1567"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DATA-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}