Hello Everyone,
I have a query regarding Netskope with Sensitivity Labels for Email DLP.
We’ve successfully integrated Netskope with Sensitivity Label Integration so that all labels are published into Netskope. For Cloud and Web traffic, DLP enforcement is working perfectly with label‑based rules.
Current Email DLP Setup
-
Created DLP Entities, Rules, and Profiles for all labels: Public, Restricted, Secret, Top Secret.
-
For Word documents, we extracted metadata via File → Info → Properties → Advanced Properties → Custom tab. And created a Regex Entity.
-
Example:
ClassificationContentMarkingHeaderText.*Restricted
-
Used these regex entities in SMTP DLP policies.
-
Real‑time protection policy adds headers for enforcement:
X-Netskope-Action: Block
-
This works fine for Word attachments (Emails) — detection and enforcement trigger correctly.
What I’ve Already Tested
-
GUID‑based approach: Extracted GUIDs from the MIP portal and created a custom regex Entity for e.g.:
MSIP_Label_4119f1cb-5a0c-41ad-b396-aec13f2b846d_Name→ This did not trigger in SMTP DLP, even though GUIDs are valid in Purview.
-
Regex on Word metadata: Works consistently (
ClassificationContentMarkingHeaderText). -
Excel & PowerPoint: Custom tab is empty, so metadata cannot be extracted the same way as Word. I’ve already inspected the OpenXML package (
docProps,customXml) but haven’t found a reliable property string to base regex on.
Excel & PowerPoint challenge
-
For these file types, the Custom tab is empty and I cannot extract metadata values like I can in Word.
-
How can we build regex entities for Excel and PowerPoint labels?
-
Is there a recommended method to extract classification metadata for these file types so we can enforce SMTP DLP consistently?
What I’ve Done So Far
-
Verified that Cloud/Web traffic label‑based DLP works fine.
-
For Email DLP, Word files are covered using regex on
ClassificationContentMarkingHeaderText. -
Tried GUID‑based regex but it bypasses.
-
Real‑time outbound policy is configured with header injection for enforcement.
Question: We’ve already integrated Netskope with Microsoft Purview Sensitivity Labels and built working SMTP DLP policies for Word documents using regex on ClassificationContentMarkingHeaderText.*Restricted. My query is: are there any other supported methods to create Email SMTP DLP rules based on MIP labels (such as GUID‑based detection or alternative metadata extraction), and for Excel and PowerPoint
