Enterprise DLP, Microsoft Teams, and Non-File Inspection/Blocking

rickyboone — Fri, 21 Mar 2025 14:21:55 GMT

I'm working on testing an Enterprise DLP data profile that includes blocking traffic for non-file-based detections (e.g., PCI data in a Teams message). For file-based detections, the behavior is fairly straight-forward: the upload fails, Teams throws an error, user weeps. For non-file-based detections... Teams behaves strangely.

Teams will, seemingly indefinitely, continue to try and try to post the message that the firewall will block. It doesn't appear to have a sane retry or failure state like it does with file-based detections. It will also spam the firewall and E-DLP portal with events and evidence.

I'm curious if anyone has observed this behavior, or might have an idea of how to get Teams... if possible... to fail a bit more gracefully in cases like this.

topic Enterprise DLP, Microsoft Teams, and Non-File Inspection/Blocking in Enterprise Data Loss Prevention Discussions

Enterprise DLP, Microsoft Teams, and Non-File Inspection/Blocking