Create an Email DLP Policy that Combines Content and Recipient Domains

In this example, create a policy designed to detect specific keywords in documents attached to emails sent to external domains. This policy will include an exception whereby emails sent within the company will not trigger a violation.

As a policy administrator for Skyhigh CASB Email Data Loss Prevention (DLP), you aim to establish a policy that identifies sensitive content in outbound emails, but only when these emails are directed to external recipients. Additionally, you would like to maintain an allow list of recipient email domains, which will enable you to exempt certain domains from this policy.

1. Go to Policy > DLP Policies.
2. Click Actions > Sanctioned Policy > Create New Policy. 
3. On the Description page, enter a name, description, and deployment type. For Services, select Microsoft Exchange Online. Then select the users the policy will apply to. 
4. On the Rules page, add the following:
   
   

 In this example, we are using multiple Keywords like "Confidential", "Proprietary", and "Internal Use Only".

4. Set the exception the same way, except in the To field, add the domains from your company.

5. On the Responses page, enter any responses. 
6. Click Save.