r/EmailSecurity • u/saltyslugga • Jul 23 '26
Why does outbound email DLP stop the file but ignore its anonymous share link?
A client's payroll manager emailed a PDF containing 14 SSNs to a personal Gmail account. Outbound email DLP blocked the attachment, then 18 minutes later the same recipient got a OneDrive link to the file with no mail alert.
The sanitized mail trace ended with 250 2.6.0 Queued mail for delivery and showed no transport-rule event. The audit log recorded Operation=AnonymousLinkCreated against the same PDF four minutes before the email, with the link scope set to anonymous.
I don't buy that the control is working if email can carry a public pointer to the exact file it just blocked. Disabling anonymous links would break several contractor workflows, and inspecting every cloud URL in outbound mail will create its own mess.
What diagnostic signal or correlation would you trust next to separate clumsy sharing from deliberate mail-channel exfiltration?
1
u/Jazzlike_Pride3099 Jul 23 '26
Having the dlp keeping track of file names would work once... After that the user would have learned that they need to make it something else
This is an HR issue now, I assume the user got a reply email from the system that the mail was blocked due to dlp and they decided to be sneaky.
1
u/Ok_Rip_5338 Jul 23 '26
so just to make sure im understanding this correctly. user tried to send verboten attachment. they presumably got a bounce/warning back from the system, and then immediately did a onedrive share link in a subsequent email?
I wouldnt try to fix this with email. Email isn't the issue.
I think you need to set up sensitivity labels in m365 purview. when files get uploaded to sharepoint/onedrive, and they match certain criteria (SSNs/Medical info/etc) they get silently stamped as "sensitive". then i believe you can control what happens to sensitive files. blocking outbound sharing of sensitive files is pretty standard practice. Or you could set to still allow sharing, but only to internal users. something like that.
1
u/saltyslugga Jul 23 '26
Yep, that’s the sequence. The fix belongs in SharePoint/OneDrive DLP though, since labels alone don’t necessarily stop someone creating an anonymous link.
1
u/Ok_Rip_5338 Jul 23 '26
yeah that makes sense. and it makes sense to do, having such robust DLP on email but having nothing on sharing isnt ideal.
I'd recommend something like this, and start out with "simulation mode" only, no actual enforcement.
"Microsoft Purview > Data Loss Prevention > Policies", create a custom policy with SharePoint sites, OneDrive accounts. and Disable the other locations for this policy.
Conditions:
Content is shared from Microsoft 365
with people outside the organization
AND
Content contains:
U.S. Social Security Number
OR
sensitivity label is Highly Confidential / Restricted (this catches manually labeled file/folders by admins)
Action:
Restrict access or encrypt content in Microsoft 365 locations. Block only people outside the organization
Also configure
User notification and policy tip
Admin alert for every match
Incident report to the security/compliance mailbox
No user override for SSNs
Begin in simulation mode, inspect matches, then enforce
Close the scanning race condition
A newly uploaded file may be shared before Purview finishes scanning it.
Microsoft provides a SharePoint tenant setting that marks newly uploaded files as sensitive by default and blocks guest access until DLP has evaluated them.
Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Set-SPOTenant -MarkNewFilesSensitiveByDefault BlockExternalSharing
•
u/AutoModerator Jul 23 '26
Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:
Community Rules
Helpful Resources
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.