See the solution below:
Explanation:
Modify the high-count rule in the U.S. Financial Data policy. This rule begins at ten detected instances.
Disable the Microsoft 365 user-override option while preserving the blocking restriction.
Step-by-Step Solution with Explanation:
* Sign in to the Microsoft Purview portal.
* Navigate to:
Solutions # Data Loss Prevention # Policies
* Search for and select:
U).S. Financial Data
* Select Edit policy .
* Continue to the Policy settings or Customize advanced DLP rules page.
* Locate the high-count rule:
U).S. Financial: Scan content shared outside - high count
* Select the rule and then select Edit .
* Verify that the sensitive-information condition uses a minimum instance count of 10 . The rule normally covers:
* Credit card numbers
* U.S. bank account numbers
* ABA routing numbers
* Leave the sensitive-information types and sharing condition unchanged.
* Under Actions , verify that the rule restricts or blocks access to the sensitive content.
* Expand User overrides .
* Clear or disable:
Allow override from Microsoft 365 services
* If subordinate override settings are displayed, ensure that options allowing an override with business justification or reporting a false positive are also disabled.
* Save the rule.
* Verify the final rule configuration:
High-count rule setting
Required value
Minimum sensitive-data instances
10
Restriction action
Block/restrict access
Allow override from Microsoft 365 services
Off
Business-justification override
Off
* Select Next through the remaining policy pages.
* Keep the policy enabled, review the changes, and select Submit .
* Select Done .
Do not modify the low-count rule, which handles smaller quantities. Microsoft's U.S. Financial Data template separates low-count detections from a high-count rule beginning at ten instances. Disabling the override option on the high-count rule prevents users from bypassing the restriction. Microsoft: DLP template rule definitions Microsoft: DLP rules without user overrides