🧾 Policy Overview
🧭 Name: E8-IBP-PCI Data Security Standard (PCI DSS)
🔐 Type: Data Loss Prevention (DLP) Simulation Policy
📍 Scope: Exchange, SharePoint, OneDrive for Business, Teams, On-Premises Scanner
🧪 Mode: TestWithoutNotifications (Audit)
📦 Target Locations: All Exchange, OneDrive, SharePoint, Teams, On-Premises Scanner
🔑 Minimum Licensing Requirement: Microsoft 365 Business Premium
🧠 Detection Logic
This policy detects the presence of credit card numbers in content shared outside the organization, in alignment with PCI DSS requirements.
Detection thresholds:
High volume rule: ≥10 instances
Low volume rule: 1–9 instances
Detection is scoped to
AccessScope: NotInOrganizationto flag external exposure.
📣 Notifications & Alerts
🔔 Alerts generated for Site Admin
📧 Notifications sent to Site Admin, Last Modifier, and Owner
📎 Email attachments included in notifications
🚫 No quarantine or access blocking (simulation mode only)