Auditing sensitive data on Windows endpoints using the Azure Information Protection client

Getting an accurate visualization of sensitive data in your environment is a challenge that all companies face. This is even more of a challenge when you have thousands of employees that work remotely and do not connect to the corporate network on a regular basis.  The Azure Information Protection client has a new passive auditing capability that will help with this challenge.


 


In the latest GA version of the Azure Information Protection client (1.48.204.0), you can now discover sensitive information in any document that is opened in Office on a machine with the AIP client installed. This will allow you to do passive data discovery across all your endpoints, even if they are not connected to your corporate network when they are working on that content.  The image below shows a file that was labeled with an unprotected default label of General, yet contains Information Type Matches.


 


EndpointDiscovery.png


 


Once the AIP client is deployed throughout your environment, you will be able to run reports in the AIP Analytics activity pane or directly in Log Analytics to audit sensitive information that exists in unprotected documents.


 


EndpointDiscovery2.png


 


This allows you to identify the types of sensitive information that exist on endpoints so you can create recommended conditions to help guide your users to classify sensitive data appropriately.  You could also use this information to create automatic conditions to protect your mission critical sensitive information.  And the beauty of this is that the AIP client does this without hurting performance the way that active scanners can.


 


Because we are aware that there may be privacy concerns with this, we have made this an opt-in capability that must be configured using an Advanced Setting in the global or a scoped policy in the AIP console. This way you can either turn it on for the full tenant and disable it for areas with privacy concerns, or you can only roll it out to your scoped policy for critical areas like Human Resources, Legal, or Engineering.


 


The steps to enable this are straight-forward and can be found in the official documentation.  I will provide a quick primer below for convenience.


 



  1. Log into the AIP Console in the Azure Portal at https://aka.ms/AIPConsole

  2. In the left-hand blade, under Classifications, click on Policies

  3. In the Policies blade, right-click on either the Global or a Scoped Policy, and click Advanced settings
    Advanced Settings.png

  4. In the Advanced settings blade, under Name, type RunAuditInformationTypeDiscovery, and under Value, type true
    Audit.png

  5. Finally, click Save and close to finish enabling this amazing feature!


The result is analytics like the image shown in the beginning of this article.  Please let us know if you have any questions in the comments below.


 


Thanks,


 


The Information Protection Customer Experience Engineering Team


 


 

Leave a Reply

Your email address will not be published. Required fields are marked *

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.