Question
I set up an Auto Remediation Policy , but immediately after activation, sharing was stopped for some items.
How is the stop date for the Auto Remediation Policy calculated?
Answer
The stop date for the Auto Remediation Policy (hereafter referred to as the stop date) is calculated based on the [Date Shared Detected by File DLP] for files/folders (hereafter referred to as items) synchronized with File DLP.
Therefore, if there are items for which the stop date has already passed at the time the Auto Remediation Policy is activated, those items will be stopped immediately upon policy activation.
Note that the Auto Remediation Policy is inactive immediately after it is created.
After creating the policy, please check the items subject to stopping from the "Scheduled to Stop" tab list before activating the policy.
Example: If a policy to automatically stop sharing after 7 days is activated on 10/10
Item ① detected as externally shared on 9/1
If the policy is activated, since 7 days have already passed since detection at the time of activation, sharing will be stopped immediately.
Item ② detected as externally shared on 10/8
If the policy is activated, 7 days have not yet passed as of the activation date, but since the sharing was detected on 10/8, sharing will be stopped on 10/15, which is 7 days after detection.
Item ③ detected as externally shared on 10/15
Since this item was not shared as of the policy activation date, sharing will be stopped on 10/22, which is 7 days after File DLP detects external sharing.