# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-DATA-002
title: Enforce a DLP policy for sensitive data in Teams chats and channels
finding:
  title: Sensitive data can be posted in Teams chats and channels without control
  description: No enforced DLP policy covers Teams, so bank, identity or card numbers can be sent to external participants or guests in a chat message.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [dlp, purview, data-protection, teams, gdpr]

applicability:
  requires:
    - "Microsoft Teams"
    - "Microsoft Purview E5 Compliance"

description: |
  A Microsoft Purview DLP policy is turned on for the **Teams chat and channel messages** location,
  scoped to all users. It detects at least the sensitive information types of CB-M365-DATA-001,
  blocks messages that contain them when external users or guests take part in the conversation,
  and shows a policy tip to the sender.
rationale: |
  Teams is now a primary channel for exchanges with partners, through external access and guests.
  A DLP policy on Exchange and SharePoint alone leaves this channel open: the same IBAN or
  identity card number blocked in an email can be pasted in a chat.
impact: |
  Messages that match are hidden from external participants and the sender sees a notice. Tune
  the rules in simulation first to avoid blocking internal conversations.
notes: |
  Microsoft creates a default Teams DLP policy in some tenants; it can satisfy this control if it is
  turned on and covers the required sensitive information types.

audit:
  manual: |
    1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global
       Reader.
    2. Browse to **Solutions** > **Data Loss Prevention** > **Policies**.
    3. Find a policy whose **Locations** include **Teams chat and channel messages** for all users,
       with **Status** = **On**, a rule that detects the sensitive information types of
       CB-M365-DATA-001, the action **Restrict access or encrypt the content** for people outside the
       organization, and policy tips enabled.
    4. Alternative in Security & Compliance PowerShell: `Get-DlpCompliancePolicy | Where-Object
       { $_.TeamsLocation } | Format-List Name,Mode,TeamsLocation,TeamsLocationException`.
    5. Fail if no policy with `Mode` = `Enable` covers Teams for all users.

remediation:
  manual: |
    1. Sign in to the Microsoft Purview portal as at least a Compliance Administrator.
    2. Edit the policy of CB-M365-DATA-001 to add the **Teams chat and channel messages** location,
       or create a dedicated policy with the same rules.
    3. Set the action to block external access and enable policy tips.
    4. Run in simulation with policy tips, review **Activity explorer**, then turn the policy on.
    5. PowerShell alternative: `Set-DlpCompliancePolicy -Identity <policy> -AddTeamsLocation All`,
       then `Set-DlpCompliancePolicy -Identity <policy> -Mode Enable`.
  rollback: |
    Remove the Teams location or set the policy back to simulation.

references:
  - title: Default DLP policy for Teams
    url: https://learn.microsoft.com/purview/dlp-teams-default-policy
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Create and deploy data loss prevention policies
    url: https://learn.microsoft.com/purview/dlp-create-deploy-policy
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "3.2.2"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.SECURITYSUITE.3.2v1
    relation: partial
    note: Covers the Teams location only; other locations are in CB-M365-DATA-001 and CB-M365-DATA-003.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-4
    relation: related
threats:
  - framework: mitre-attack
    id: T1567
related_controls:
  - id: CB-M365-DATA-001
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24