O365 Gatelet fails to block uploads when saving directly via O365 application

Products

• CASB Advanced Threat Protection
• CASB Audit
• CASB Gateway
• CASB Gateway Advanced
• CASB Security Advanced
• CASB Security Advanced IAAS
• CASB Security Premium
• CASB Security Premium IAAS
• CASB Security Standard
• CASB Securlet IAAS
• CASB Securlet SAAS
• CASB Securlet SAAS With DLP-CDS

Issue/Introduction

• O365 Gatelet fails to block when saving directly from SaaS app to O365 volume (OneDrive).

• The Gatelet does block 'uploads' and 'downloads' as expected (tested in OneDrive).

• However, per screen prints below, if you create a new file in O365 (ex: Word, Excel, etc.) and save the new file directly to the SaaS, it doesn't block.

• The event is captured and shown in CloudSOC Investigate yet a block never occurred (where the file contained content that should have blocked the upload/saving to O365).

Cause

This is currently a known limitation for O365 and CloudSOC O365 Gatelet. 

Resolution

• A feature request has been submitted to have this functionality added for support. 

• If you would like to vote for the feature request, please open a Support case and reference this article.

• The current workaround (available for DLP customers) is to use DLP Agent on the client machine. The DLP Agent will block the data in motion event as expected before it can be uploaded/'saved directly to' O365.