Data Loss Prevention- simulation mode for DLP policies

Data Loss Prevention- simulation mode for DLP policies

Simulation mode in DLP provides DLP admins with an isolated experience to try a DLP policy, assess its impact, and build confidence in the policy efficacy to eventually reduce the time to policy enforcement. Simulation mode is an enhancement to the existing test mode behavior to help Admins evaluate new policies confidently.

When this will happen:

Rollout is expected to be complete by late November. 

How this will affect your organization:

1. There will not be any change to end user policy enforcement from the policies that are currently in test mode.
2. Once Simulation mode is enabled (from the DLP settings page), existing test mode policies will come up in the new simulation experience –
   • Summary of policy matches across locations will be available in a single console.
   • A flat list of all matching items with the ability to view file preview, matched conditions etc.
   • Alerts generated by simulation policies are not mixed with enforced policies in the main alerts queue.
3. Any alerts generated from policies running in simulation will be limited to the DLP simulation experience and not included in the DLP alerts page to prevent disruption to production alerts investigation, allowing admins to assess and finetune the policy without any impact to the production policy.

What you need to do to prepare:

1. During public preview, simulation mode experience can be enabled from the DLP settings page.
2. Once generally available, all existing test mode policies will be available with simulation experience.