Recipient rules or exceptions do not work on the DLP endpoint agent when sending e-mails via Outlook Web Access (OWA)

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

You have deployed a policy to the endpoint agent that includes rules or exceptions based on recipients. However the rules do not trigger as expected when sending e-mail via Outlook Web Access (OWA).

Environment

DLP 15.X, 16.X

Cause

On the endpoint level, e-mails sent via OWA are been send via HTTP/HTTPS traffic.

HTTP request looks next ( info in log about example mail sent via OWA) :
 

Request Id #87
Detection Request Details :

    Session Command : Session Continue Request
    Session Id : {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
    Request Type : Data In Motion Request

Dim Detection Request Details :

    Process Id : 10944

        Process Path : C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Application Name : Microsoft Internet Explorer
    User : 0036800
    Domain : example.com
    Time Stamp : 06/17/2019 11:56:52
    Dim Event Type : HTTP(S)

HTTP(S) Details :

    URL : https://webmail.example.com/owa/ev.owa?oeh=1&ns=MailTips&ev=Get

Network Info Details :

    Source IP :
    Source Port : 0
    Source Domain :
    Destination IP :
    Destination Port : 0
    Destination Host Name : webmail.example.com

Note that the request details don't contain recipient information which is usually provided in the normal SMTP traffic. For OWA it's in the body of HTTPs post. Thus it can be recognized by keyword rule but not by recipient rule.

Resolution

Implement network prevent for mail.

If you implement network prevent for email ( making sure traffic from OWA goes via DLP detection server ) - MTA will transfer information containing e-mail details as normal SMTP communication thus rules/exceptions will work fine.