search

ASD-Blueprint / ASD-Blueprint-for-Secure-Cloud

Website for ASD's Blueprint for Secure Cloud
Other
54 stars 16 forks source link

X-Protective-Marking multi-values are not accepted in Purview DLP Policy #16

Open CryptikCrisis opened 3 months ago

CryptikCrisis commented 3 months ago

The ASD Secure cloud blueprint has a DLP policy configuration that intends to add the following protective marking header to messages when sensitivity labels are applied.

Defect - Purview Header Policy does not work 001

The X-Protective-Marking header is a multi-string value header which is not supported by Purview DLP policies. The result of the policy is that the last value entered is the value inserted into the mail header.

Expected behaviour:

When message MSIP label contains "UNOFFICIAL" then x-protective-marking should contain the following values

x-protective-marking: VER=2018.6, NS=gov.au, SEC=UNOFFICIAL

Actual behaviour:

x-protective-marking:SEC=UNOFFICIAL

RebelliousBadger commented 3 months ago

Hi CryptikCrisis,

Thank you for your above feedback on the Blueprint. We received a similar query via our inbox and this is an area we are looking to clarify as part of future releases.

In the interim, as you have suggested above please put quote marks " around the header name (X-Protective-Marking) and header value (VER=2018.6, NS=gov.au, SEC=UNOFFICIAL), ensuring to separate the two with a colon :

Essentially, the value should be entered as:

"X-Protective-Marking":"VER=2018.6, NS=gov.au, SEC=UNOFFICIAL"