Communication Compliance

Communication Compliance is a Microsoft 365 solution that helps organizations detect, capture, and act on inappropriate messages in email, Microsoft Teams, Yammer, and third-party sources. It is part of the Microsoft Purview compliance portal. The primary purpose is to address regulatory compliance requirements (e.g., SEC, FINRA, GDPR) and internal policies related to workplace harassment, insider trading, confidential information sharing, and other communication risks.

Unlike Data Loss Prevention (DLP), which focuses on preventing data leaks, Communication Compliance is designed for supervision and review of communications. It allows organizations to define policies that automatically detect specific types of content, assign reviewers, and escalate issues. The solution is built on Microsoft 365's compliance backbone, leveraging advanced classifiers, machine learning models, and integration with eDiscovery and audit logs.

Communication Compliance operates through a pipeline of policy definition, message ingestion, classification, alert generation, and review. Here is the step-by-step mechanism:

1. Policy Creation: An administrator creates a policy in the Microsoft Purview compliance portal. The policy specifies: - Policy name and description - Users or groups to supervise (e.g., all users, specific distribution groups, or users in a certain role) - Detection conditions: These are the criteria that trigger a policy match. Conditions include: - Keyword lists: Specific words or phrases (e.g., 'insider trading', 'confidential') - Sensitive information types: Predefined or custom DLP sensitive info types (e.g., credit card numbers, Social Security numbers) - Trainable classifiers: Prebuilt classifiers for harassment, threats, profanity, or custom classifiers - Message direction: Inbound, outbound, or internal - Attachments: Whether messages with attachments are included - Size limits: Messages over a certain size can be excluded - Percentage of communications to review: A sampling rate (0-100%) to reduce volume - Reviewers: Designated users who will investigate and resolve alerts

3. Policy Evaluation: Each ingested message is evaluated against active policies. The evaluation includes: - Keyword matching: The system scans message body, subject, and attachments (if configured) for specified keywords. - Sensitive information detection: Uses the same Microsoft 365 DLP engine to identify sensitive data patterns. - Classifier analysis: Trainable classifiers (e.g., 'Harassment classifier', 'Threat classifier') analyze the message using machine learning models trained on large datasets. These classifiers produce a confidence score. If the score exceeds a threshold (default is 0.8 or 80%, configurable), the message is flagged. - Sampling: If the policy has a sampling percentage less than 100%, the system randomly selects only that percentage of matching messages for alert generation.

- The message content (subject, body, attachments) - Sender and recipient information - Timestamp - Policy name and matched condition - Classification details (e.g., which sensitive info type was found)

5. Review and Remediation: Designated reviewers access the Communication Compliance dashboard in the Microsoft Purview compliance portal. They can: - Tag the message: Options include 'Compliant', 'Non-compliant', 'Questionable', or 'Resolved' (customizable). - Escalate: Send the alert to another reviewer or to eDiscovery for further investigation. - Notify: Send a notification to the sender or manager. - Remove: If the message is a violation, the reviewer can request removal from the user's mailbox (requires additional permissions). - Resolve: Mark the alert as resolved after investigation.

To create a Communication Compliance policy, you can use the Microsoft Purview compliance portal or PowerShell. Example PowerShell cmdlets:

# Create a new policy
New-ComplianceTag -Name "InsiderTradingPolicy" -Comment "Detect insider trading keywords"
New-CommunicationCompliancePolicy -Name "InsiderTrading" -PolicyType "Supervision" -GroupsToSupervise @("All Users") -Direction "Outbound"

# Add a condition for keywords
New-CommunicationComplianceRule -Name "InsiderTradingRule" -Policy "InsiderTrading" -KeywordQuery "insider trading OR confidential OR material nonpublic"

To verify, check the Communication Compliance dashboard for alerts and use Get-CommunicationCompliancePolicy to list policies.

In a large financial services firm, Communication Compliance is used to monitor trader communications for insider trading and market manipulation. The firm creates a policy that supervises all employees in the trading department. The policy uses keyword lists containing terms like 'material nonpublic information', 'insider trading', and 'pump and dump'. It also uses the sensitive information type for stock symbols to detect potential tips. The policy is set to sample 20% of flagged messages to manage volume. Reviewers are compliance officers who triage alerts daily. When a trader sends an email with the phrase 'confidential deal' to an external party, an alert is generated. The reviewer investigates, finds no actual violation, and tags it as compliant. The firm also integrates third-party data from Bloomberg chat via a connector, so all communications are captured in one dashboard.

In a healthcare organization, Communication Compliance monitors for inappropriate patient information sharing in Teams chats. The policy uses the sensitive information type for medical record numbers and keywords like 'HIPAA violation'. Supervised users include all clinical staff. The policy is set to 100% sampling due to high regulatory risk. When a nurse sends a patient's name and diagnosis in a Teams message, the system flags it. The reviewer (privacy officer) sees the alert, determines it was a genuine error, and notifies the nurse's manager. The message is tagged as non-compliant and escalated for training.

Common misconfigurations include: (1) Not assigning reviewers, so alerts go uninvestigated. (2) Setting sampling too low, missing critical violations. (3) Forgetting to enable supervision for Teams messages (requires enabling the Teams connector). (4) Not training classifiers adequately, leading to high false positives. Performance wise, the system can handle millions of messages per day, but alert volume can overwhelm reviewers if policies are too broad. Best practice is to start with a small pilot and refine conditions.