Skip to main content

Detect a pdf signed by DocuSign in the DLP based on metadata.

 

Is there a way to detect a file signed by DocuSign in Purview DLP's?

 

Sample Sudo code below, (assuming DocuSign signed pdf file has some property which Purview can detect, which I can use in ContentPropertyContainsWords condition. )

 

# script to create 'HK Test Delete after Aug07'
New-DlpCompliancePolicy `
-Name 'HK Test Delete after Aug07' `
-Comment 'HK Test Delete after Aug07' `
-Mode 'TestWithoutNotifications' `
-ExchangeLocation All `
;
New-DlpComplianceRule `
-Name 'TST - HK Test Delete after Aug07' `
-Policy 'HK Test Delete after Aug07' `
-AdvancedRule '{
"Version": "1.0",
"Condition": {
"Operator": "And",
"SubConditions": s
{
"ConditionName": "AccessScope",
"Value": "NotInOrganization"
},
{
"ConditionName": "ContentPropertyContainsWords",
"Value": e
"SignedBy:DocuSign",
"SignedAtIPLocation:142.250.73.78"
]
}
]
}
}' `
-AlertProperties '{
"AggregationType": "None"
}' `
-AttachmentIsNotLabeled $false `
-BlockAccess $true `
-BlockAccessScope 'PerUser' `
-Comment 'HK Test Delete after Aug07' `
-ContentIsNotLabeled $false `
-ContentIsShared $false `
-Disabled $false `
-DocumentIsPasswordProtected $false `
-DocumentIsUnsupported $false `
-EnforcePortalAccess $true `
-EvaluateRulePerComponent $false `
-ExceptIfContentIsShared $false `
-ExceptIfDocumentIsPasswordProtected $false `
-ExceptIfDocumentIsUnsupported $false `
-ExceptIfHasSenderOverride $false `
-ExceptIfProcessingLimitExceeded $false `
-GenerateAlert 'true' `
-HasSenderOverride $false `
-MessageIsNotLabeled $false `
-NotifyEmailExchangeIncludeAttachment $true `
-NotifyEmailOnedriveRemediationActions 'NotSet' `
-NotifyOverrideRequirements 'None' `
-NotifyPolicyTipDisplayOption 'Tip' `
-NotifyUserType 'Email, PolicyTip' `
-ProcessingLimitExceeded $false `
-Quarantine $false `
-RemoveRMSTemplate $false `
-ReportSeverityLevel 'Low' `
-RestrictBrowserAccess $false `
-StopPolicyProcessing $true `
-NotifyUser 'LastModifier' `
-NotifyPolicyTipCustomText 'Document Signed by DocuSign eSignature Platform from IP 142.250.73.78 can not be sent outside the organization.' `
;

 

 

Looking for all properties DocuSign exposes as metadata which could be detected in MS Purview.


Does DocuSign provide vendor (DocuSign) managed sensitive Information Types built for MS Purview, which can be leveraged in such cases?

 

reference:

Sensitive information type entity definitions | Microsoft Learn


Reply