How to whitelist emails with cloud (server-side) signature using DLP policy

Problem:

You’ve started using data loss prevention (DLP) policies in your Microsoft 365 organization. Even though you configured a special override in your custom DLP policy for emails with a cloud (server-side) signature added by the CodeTwo software, DLP still blocks them.

Solution:

Emails with a cloud (server-side) signature are blocked after they leave the CodeTwo service – when they are processed by DLP for the second time. At this stage, DLP removes the override flag that was applied via the DLP policy on the first processing of an email, and the email gets blocked.

To have 100% certainty that your emails stamped with a cloud signature are not blocked by DLP, you need to configure a custom DLP policy which is based on the header our software adds to each email it processes. Here’s how to do it:

1. Sign in to the Microsoft 365 compliance center.
2. Click Data loss prevention in the left-hand navigation menu and choose the Policies tab. Next, click the Create policy button (Fig. 1.).

Fig. 1. Accessing the wizard to create a new DLP policy.

3. In the wizard that opens, first choose the Custom type of policy (Fig. 2.) and name your policy.

Fig. 2. Choosing the custom type of the DLP policy.

4. On the third page of the wizard, select Exchange email as the only location to apply the policy (Fig. 3.).

Fig. 3. Defining the location to apply the policy.

5. Next, on the Advanced DLP rules page that is displayed, click Create rule to configure your custom rule.
6. Name your rule, click Add condition, and choose Header contains words or phrases from the list (Fig. 4.).

Fig. 4. Choosing the right condition type.

7. Fill in the text fields with appropriate information:
   • enter X-CodeTwoProcessed in the first field (Enter header),
   • enter true in the second field, and

   click the Add button (Fig. 5.).

Fig. 5. Defining the two conditions to whitelist emails with a cloud (server-side) signature.

8. Scroll further down and specify settings in the Additional options section:
   • select the If there’s a match for this rule, stop processing additional DLP policies and rules checkbox,
   • set rule’s priority to 0 (highest), and

   click Save to save the whole rule configuration (Fig. 6.).

Fig. 6. Configuring additional options and saving the rule.

9. The correct configuration of the rule should be the same as shown in Fig. 7.

Fig. 7. Overview of the correct rule configuration.

10. On the Test or turn on the policy page, select the second option (Turn it on right away) to enable the policy (Fig. 8.).

Fig. 8. The option to enable the policy right away.

11. On the last page of the wizard, review your settings – if you’re OK with them, click Submit and Done to save and apply your policy.
12. Now, your policy should be displayed on the Policies tab, and emails with a cloud (server-side) signature shouldn’t be blocked by DLP any longer. 

See also:

• How to add an exception for the CodeTwo software in a transport rule