Microsoft Teams messages are not being scanned

Products

• CASB Securlet SAAS With DLP-CDS
• CASB Securlet SAAS
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard

Issue/Introduction

Microsoft O365 Securlet Teams Messages were not being scanned, not generating DLP incidents. All prerequisites for MS Teams scanning were met: 

• The client has enabled the "Teams Messages" check box in O365 Securlet during activation
• The client has deactivated/reactivated O365 Securlet to be on the new Graph API (required for MS Teams Message scanning)
• The client has configured the "Microsoft Teams" Application detection configuration and corresponding policy in DLP Enforce.

Cause

The client has two CloudSOC tenants, and the client had the O365 Securlets activated, using the same O365 account on two different CloudSOC tenants.

Microsoft only allows one Chat and Channel subscription at a time using the same MS O365 subscription.

CASB cannot activate MS Teams in O365 Securlet using the same O365 Office Account on two different CASB tenants.

Resolution

The Client deactivated the MS O365 Account on one of the two CloudSOC tenants.

Then on the DLP Enforce connected to that CloudSOC tenant, the MS Teams messaging policy/filter started functioning properly, and incidents were generated.