Assign DLP policy to domain user

[mtmy-zul]

Hi team,

I am using DLPE-onprem. Is it possible to assign DLP policy to domain user instead of system/pc? This is because some of the employee sharing the PC but they are using different policy.

[Fotunba]

Hi,

I don't think it's possible (well so far). If you have hot desking /shared systems policy, create an exception group in your End-User group menu option, add users to exempts, in your rules, enable rule exceptions and add the group. They should be able to bypass the policy

[Dex · Accepted solution]

Hello @mtmy-zul 

Yes, it is possible to assign policies to domain users. I will try to explain in a general way:

First, you must have a registered LDAP server.

If you already have an active LDAP sync, create an end user group (DLP Policy Manager -> Definitions).

Within the new group, set the "Identify LDAP objects by SID (Security ID)" option and add users, groups, or OUs as needed.

After that, create a new rule set and a new rule, and in Condition -> End User: select "Belongs to one of the end user groups (OR)", click the three dots button and check your group and confirm all changes.

As a personal recommendation, create a new policy for testing purposes, assign the new rule set, and deploy the test policy to one system before deploying it to all systems.

When using rules by user group, consider this scenario: If two or more users are logged in, the least privileged user takes precedence.

[Fotunba]

@Dex thanks for this, but maybe I'm missing something. This new policy you've created still applies to the system and not directly to the user. The rule is applied to the user/user group and not the policy? This is still same as creating an exception on existing rule and add group with users to exempt. saves effort, time and managing multiple rules/policies

[Dex]

Hi @Fotunba.

You must apply the policy with rule sets (and rules) created for end-user groups in a general way, assigning the policy to the entire system tree or to the groups that you have defined.

In our environment, we have a general policy applied to all computers, and we create specific rules for groups of users. This allows the user to keep their permissions even if they use any other computer.

[Fotunba]

That's absolutely fantastic! 👍 in our environment we use Exceptions with AD security group (USB Allow, Adobe Allow, Printing Allow etc.)