New version of Desktop Microsoft Teams Application is not triggering DLP response Rules.

Products

• Data Loss Prevention

Issue/Introduction

You created a policy to monitor file upload in Classic and New version of Microsoft Teams (Desktop and Online versions) but you are getting mixed result although you added Teams.exe in the Global Application Monitoring. See result below:

Teams	Desktop Application	Online Version
Classic	Blocks	Blocks
New	Allowed	Blocks

 

Environment

DLP 15.X

DLP 16.X

Cause

After running Procmon, it shows that, with the classic Teams, the process name is Teams.exe. But when you switch to the new version, the process name changes to msedgewebview2.exe.

Resolution

Add the new version binary name in the Global Application Monitoring so that DLP will recognize the new name: