What is OneDrive sensitive data scanning?
It is one of Compliance Agent’s four scan areas. It helps you verify adherence to your organisation’s policies: it runs in your own Azure subscription, scans for the keywords and patterns your organisation defines, and reports. You define the rules; ready-made rule packs are optional and apply only if you turn them on. The product is not designed to examine a specific employee; the organisation decides what to do with the findings.
You narrow the scope in two ways: which user group is scanned and which date range. You can try the rules on sample text before scanning (Test rules); the sample text is not saved anywhere.
Which file types are read?
- Word, Excel and PowerPoint files
- CSV
- plain-text files
Images and scanned documents are not read. Text inside a photo or a scanned page therefore does not show up as a finding; take that into account when you judge the scope.
How are files shared outside the organisation shown?
Files shared outside the organisation are flagged next to the findings. So when a file matches a rule you can see, without searching separately, whether it is also open to people outside your organisation.
By default the results show only the matching rule. To see the full content, a duration, a reason and a ticket number are entered in Reveal; every view is written to the audit log. Limit access to the results to the fewest people necessary.
What happens to a file before an action?
Action modes stay off until an administrator turns them on; on a new installation only Safe Scan is possible. Once actions are on there are two modes: Selective Action (a person reviews the findings and the action is applied only to the files marked) and Direct Action (scan and action happen in a single run and stop at the hard action limit).
Before every action, a copy of that OneDrive file is placed in your own Azure storage and kept for 90 days by default. If the copy cannot be made, no action is applied to that file. The copy stays in your own storage; keep access to those copies limited too.
Can an action in OneDrive be reversed?
No. An action in OneDrive cannot be reversed; the product has no feature that reverses it. To get a copied file back you take it from your own storage. That is why an action is protected in four layers: modes; the hard action limit, which caps the number of items processed in a single run (there is no button to exceed it; raising it is an administrator step and is recorded); roles; and the audit log. If the audit log cannot be written, the action is refused.
Employee permission and Safe Scan: how to start
No scan can run without the employee’s permission. Each employee gives permission through a personal link your organisation sends, carrying your logo and your text. In the product you see who has given permission and who is pending. This permission does not replace your duty to inform employees and is not a legal ground.
Suggested order:
- Prepare your notice and policy (see the before you scan list).
- Try the rules on sample text and narrow the scope.
- Run a Safe Scan and review the results.
- Consider an action only if you need one and your administrator has turned the action modes on.
Short questions
Does Inthouse see the content of the files? No; results, logs, the audit log and configuration stay in your own Azure storage. As with every Azure Managed Application, Inthouse has management access to the deployed resources; details are on Security and data.
Do I need E5 for OneDrive? No; you need no E5, no additional Microsoft licence tier and no paid Microsoft API.
To see it live, request a demo. Related pages: How it works · Teams scanning · Exchange Online scanning · FAQ.