Question

Contoso's compliance team must prevent users from emailing messages containing credit card numbers to recipients outside the organization. Internal email between employees that contains credit card numbers must still be allowed. When an external send is attempted, the sender should see a policy tip and the message must be blocked, but the sender needs the ability to override the block with a business justification for legitimate cases. Which DLP policy configuration meets all requirements?

Accepted Answer

Scope the rule to Exchange Online, use the Credit Card Number SIT, add the condition 'Recipient is outside the organization', set the action to Block, enable a policy tip, and allow user override with a justification requirement.

Answer

Scope the rule to Exchange Online with the Credit Card Number SIT and set the action to Block with no override, applying it to all recipients.

Answer

Scope the rule to Exchange Online and SharePoint, use the Credit Card Number SIT, and set the action to encrypt the message when sent externally.

Answer

Create a mail flow (transport) rule in the Exchange admin center that rejects messages containing credit card numbers sent to external recipients.