Create an Email DLP Policy that Combines Content and Recipient Domains

In this example, create a policy that is used to detect keywords in documents within email attachments, which are sent to external email domains. There is also an exception added if the email is sent within the company. In this case, no violation should be triggered. 

The use case is, as a policy administrator for Skyhigh CASB Email DLP, you want to create a policy that detects certain, sensitive, content in outbound emails, but only if these emails are sent to external recipients. You also want to keep an allow list of email domains for the recipient, which allows me to disable the policy for specific recipient domains.

1. Choose Policy > DLP Policies.
2. Click Actions > Sanctioned Policy > Create New Policy. 
3. On the Description page, enter a name, description, and deployment type. For Services, select Microsoft Exchange Online. Then select the users the policy will apply to. 
4. On the Rules page, add the following:
   

 In this example, we are using multiple Keywords like "Confidential", "Proprietary" and "Internal Use Only".

4. Set the exception the same way, except the To field, add the domains from your company.

5. On the Responses page, enter any responses. 
6. Click Save.