Office 365 Securlet Teams Remediation: Block Access did not work for no override

Products

• CASB Securlet SAAS
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard

Issue/Introduction

You have configured the Block Access Response rule in DLP but you noticed that DLP didn’t remove the message posted in a Teams chat that triggered the policy. 

You want to configure the block access response rule without the override option for the user, but in the techdoc only has "verdictDetails": "AllowOverrideWithJustification,AllowFalsePositiveOverride". 

Cause

The response rule is missing the verdictDetails in the custom payload which is mandatory and can not have an empty value such as "verdictDetails":""

Resolution

In the techdoc Microsoft Teams Content Inspection, the sample block access is:

{
 "action": "BlockAccess",
 "parameter": {
   "verdictDetails":"AllowOverrideWithJustification,AllowFalsePositiveOverride",
   "generalText": "This item was blocked by the Security Administration.",
   "complianceUrl" :"https://www.broadcom.com"
 }
}

If you do not wish to provided the override option, do not leave the verdictDetails empty or remove this field, instead put none as shown below:

{
  "action": "BlockAccess",
  "parameter": {
   "verdictDetails":"None",
    "generalText": "This file contained prohibited data (SSN#, DL#, PCI, HIPAA) for this storage location. If you feel this data was incorrectly identified OR if you have a valid business justification to upload sensitive data",
    "complianceUrl" :"https://www.example.com"
  }
}