• O365 Gatelet fails to block when saving directly from SaaS app to O365 volume (OneDrive).
• The Gatelet does block 'uploads' and 'downloads' as expected (tested in OneDrive).
• However, per screen prints below, if you create a new file in O365 (ex: Word, Excel, etc.) and save the new file directly to the SaaS, it doesn't block.
• The event is captured and shown in CloudSOC Investigate yet a block never occurred (where the file contained content that should have blocked the upload/saving to O365).
This is currently a known limitation for O365 and CloudSOC O365 Gatelet.
• A feature request has been submitted to have this functionality added for support.
• If you would like to vote for the feature request, please open a Support case and reference this article.
• The current workaround (available for DLP customers) is to use DLP Agent on the client machine. The DLP Agent will block the data in motion event as expected before it can be uploaded/'saved directly to' O365.