M365EXO-050: DLP restricts sharing of SSN, ITIN, and credit-card numbers (MS.EXO.8.4)
- Platform
- Entra ID / M365
- Category
- Advanced Threat Protection
- Severity
- High
- Zero Trust pillar
- Data (weight 2)
- Golden fixtures
- 5
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
SCuBA MS.EXO.8.4 requires that the Data Loss Prevention solution, at a minimum, restrict sharing of credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security Numbers (SSN) via email. This check inspects the DLP compliance rules collected from the tenant and confirms at least one enabled rule references each of those three sensitive information types. It reads DLP rules (not just policies); because Get-DlpComplianceRule cannot distinguish an unconfigured DLP solution from one that could not be read, an absent or empty rule set is reported as Not Assessed rather than a failure or a pass. A FAIL is only returned when rules are present but demonstrably do not cover one of the three required types.
Recommended value
At least one enabled DLP rule each for U.S. SSN, U.S. ITIN, and Credit Card Number sensitive information types, scoped to Exchange email
Remediation
In the Microsoft Purview compliance portal under Data loss prevention > Policies, create or extend a policy scoped to the Exchange email location with rules that detect the Credit Card Number, U.S. Social Security Number (SSN), and U.S. Individual Taxpayer Identification Number (ITIN) sensitive information types, and set the action to block or restrict external sharing. Enable the policy (not test mode) so the rules are enforced.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| empty | Not Assessed |
| no-data | Not Assessed |
| not-assessed | Not Assessed |
| partial | FAIL |
Framework mappings
- NIST SP 800-53
- SC-7, SI-4, AC-4