Skip to content

Commit 584b2ec

Browse files
SagarSatheSagarSathe
authored
Merge pull request #929 from microsoft/Feature-35023-new
Data - 35023 - OCR configuration for sensitive information detection
2 parents b401eb1 + 0e80a84 commit 584b2ec

2 files changed

Lines changed: 212 additions & 0 deletions

File tree

‎src/powershell/tests/Test-Assessment.35023.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
When OCR (Optical Character Recognition) is not configured, organizations cannot detect sensitive information hidden within images embedded in documents, emails, and files across Microsoft 365 workloads. This creates a significant security gap because sensitive data frequently appears in scanned documents, screenshots, faxes, invoices, and other image-based content that text-only detection cannot identify. Without OCR, data loss prevention (DLP) policies, auto-labeling policies, and insider risk management policies cannot scan images for credit card numbers, personally identifiable information (PII), trade secrets, or other sensitive information types, leaving image-based sensitive data unprotected and unclassified. OCR configuration is a tenant-level setting that extends existing sensitive information type and trainable classifier detection to images across Exchange, SharePoint, OneDrive, Teams, and endpoint devices. Configuring OCR requires Azure pay-as-you-go billing for Microsoft Syntex, after which compliance administrators can enable OCR for specific locations and workloads. OCR enables DLP, auto-labeling, records management, and insider risk management policies to scan images for sensitive content automatically without requiring additional policy configuration.
2+
3+
**Remediation action**
4+
5+
- Set up Azure billing for Microsoft Syntex (required for OCR) at [Set up Microsoft Syntex billing in Azure](https://learn.microsoft.com/en-us/microsoft-365/syntex/syntex-azure-billing)
6+
- Use [OCR Cost Estimator](https://learn.microsoft.com/en-us/purview/ocr-cost-estimator) to estimate charges ($1.00 per 1,000 items)
7+
- Sign into [Microsoft Purview portal](https://purview.microsoft.com/) as Compliance Admin
8+
- Navigate to Settings > Optical Character Recognition (OCR)
9+
- Select locations for OCR scanning (Exchange, SharePoint, OneDrive, Teams, Endpoint)
10+
- Click Enable and save changes (takes ~1 hour to take effect)
11+
12+
**Learn More:**
13+
- [Configure your OCR settings](https://learn.microsoft.com/en-us/purview/ocr-learn-about#configure-your-ocr-settings)
14+
15+
**To configure OCR for automatic detection of sensitive information within images:**
16+
17+
1. Verify Azure billing prerequisites by working with your Global Administrator to ensure a Microsoft Syntex pay-as-you-go Azure subscription is set up and linked to your Microsoft 365 tenant. Follow [Set up Microsoft Syntex billing in Azure](https://learn.microsoft.com/en-us/microsoft-365/syntex/syntex-azure-billing). Use the [OCR Cost Estimator](https://learn.microsoft.com/en-us/purview/ocr-cost-estimator) to estimate expected charges based on your organization's image volume ($1.00 per 1,000 items scanned).
18+
19+
2. Access OCR settings in the Microsoft Purview portal by signing in as a Compliance Administrator or Global Administrator, then navigating to Settings > Optical character recognition (OCR).
20+
21+
3. Select workload locations for OCR scanning. Choose from Exchange (email scanning), SharePoint (site file scanning), OneDrive (personal file scanning), Teams (chat/channel message scanning), and Endpoint devices (Windows/macOS document scanning). Start with high-risk locations (Exchange for email-based threats, SharePoint for shared content) to maximize security impact while managing costs.
22+
23+
4. Enable OCR by clicking the enable button in the OCR configuration page. Configuration changes take effect approximately one hour after being saved. Wait one hour, then re-run the assessment to verify OCR is active: `Get-OcrConfiguration` should return Enabled = true and IsOcrUsageBlocked = false.
24+
25+
**Best Practices:**
26+
- Start with OCR enabled for Exchange and SharePoint to cover high-risk content types (email, shared documents)
27+
- Consider scoping OCR to high-risk user groups or departments to reduce scanning costs and focus on sensitive data locations
28+
- Allow 1-2 weeks for OCR to process historical content before evaluating effectiveness
29+
- Combine OCR with DLP policies that include image-based sensitive information types (credit card numbers, PII, etc.)
30+
- Regularly review OCR costs and scanning activity in the Purview portal
31+
- Use endpoint OCR cautiously due to device resource impact and bandwidth requirements (default limit: 1,024 MB/device/day)
32+
- Ensure adequate Azure subscription budget allocation for OCR scanning charges
33+
- Consider using trainable classifiers combined with OCR for complex image content detection
34+
35+
36+
<!--- Results --->
37+
%TestResult%

‎src/powershell/tests/Test-Assessment.35023.ps1‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
<#
2+
.SYNOPSIS
3+
Validates that OCR configuration for sensitive information detection is enabled.
4+
5+
.DESCRIPTION
6+
This test verifies whether Optical Character Recognition (OCR) is configured at the
7+
tenant level and enabled for at least one supported workload location. OCR enables
8+
Microsoft Purview policies to detect sensitive information contained within images.
9+
10+
.NOTES
11+
Test ID: 35023
12+
Category: Information Protection
13+
Pillar: Data
14+
Required Module: ExchangeOnlineManagement
15+
Required Connection: Security & Compliance PowerShell
16+
#>
17+
18+
function Test-Assessment-35023 {
19+
[ZtTest(
20+
Category = 'Information Protection',
21+
ImplementationCost = 'Medium',
22+
MinimumLicense = ('Microsoft 365 E5'),
23+
Pillar = 'Data',
24+
RiskLevel = 'Medium',
25+
SfiPillar = 'Protect tenants and production systems',
26+
TenantType = ('Workforce'),
27+
TestId = 35023,
28+
Title = 'OCR is enabled for sensitive information detection',
29+
UserImpact = 'Low'
30+
)]
31+
[CmdletBinding()]
32+
param()
33+
34+
#region Data Collection
35+
Write-PSFMessage '🟦 Start' -Tag Test -Level VeryVerbose
36+
37+
$activity = 'Checking OCR configuration'
38+
Write-ZtProgress -Activity $activity -Status 'Running Get-OcrConfiguration'
39+
40+
$ocrConfig = $null
41+
$errorMsg = $null
42+
43+
# Q1: Get OCR configuration
44+
try {
45+
$ocrConfig = Get-OcrConfiguration -ErrorAction Stop | Select-Object -Property Enabled, ExchangeLocation, SharePointLocation, OneDriveLocation, TeamsLocation, EndpointDlpLocation, IsOcrUsageBlocked, OcrUsageBlockageReason
46+
}
47+
catch {
48+
$errorMsg = $_
49+
Write-PSFMessage "Failed to retrieve OCR configuration: $_" -Tag Test -Level Error
50+
}
51+
# Q2/Q3: Extract detailed properties if configuration exists
52+
$enabled = $false
53+
$exchange = $false
54+
$sharePoint = $false
55+
$oneDrive = $false
56+
$teams = $false
57+
$endpoint = $false
58+
$isBlocked = $null
59+
$blockReason = $null
60+
$billingStatus = $null
61+
$enabledLocationsCount = 0
62+
63+
if ($ocrConfig) {
64+
$blockReason = $ocrConfig.OcrUsageBlockageReason
65+
$enabled = $ocrConfig.Enabled
66+
$exchange = $ocrConfig.ExchangeLocation.Count -gt 0
67+
$sharePoint = $ocrConfig.SharePointLocation.Count -gt 0
68+
$oneDrive = $ocrConfig.OneDriveLocation.Count -gt 0
69+
$teams = $ocrConfig.TeamsLocation.Count -gt 0
70+
$endpoint = $ocrConfig.EndpointDlpLocation.Count -gt 0
71+
$isBlocked = $ocrConfig.IsOcrUsageBlocked
72+
73+
if ($exchange) { $enabledLocationsCount++ }
74+
if ($sharePoint) { $enabledLocationsCount++ }
75+
if ($oneDrive) { $enabledLocationsCount++ }
76+
if ($teams) { $enabledLocationsCount++ }
77+
if ($endpoint) { $enabledLocationsCount++ }
78+
79+
$billingStatus = if ($isBlocked) { 'Not Configured' } else { 'Configured' }
80+
}
81+
#endregion Data Collection
82+
83+
#region Assessment Logic
84+
$customStatus = $null
85+
$passed = $false
86+
87+
if ($errorMsg) {
88+
$passed = $false
89+
$customStatus = 'Investigate'
90+
$testResultMarkdown = "⚠️ Unable to determine OCR configuration status due to permissions issues or query failure. Error: $errorMsg`n`n%TestResult%"
91+
}
92+
else {
93+
$hasConfig = $null -ne $ocrConfig
94+
$anyLocationEnabled = $enabledLocationsCount -gt 0
95+
96+
if (-not $hasConfig) {
97+
$passed = $false
98+
$testResultMarkdown = "❌ OCR is not configured.`n`n%TestResult%"
99+
}
100+
elseif (-not $enabled) {
101+
$passed = $false
102+
$testResultMarkdown = "❌ OCR is configured but disabled at the tenant level.`n`n%TestResult%"
103+
}
104+
elseif (-not $anyLocationEnabled) {
105+
$passed = $false
106+
$testResultMarkdown = "❌ OCR is enabled but not configured for any locations.`n`n%TestResult%"
107+
}
108+
elseif ($isBlocked) {
109+
$passed = $false
110+
$testResultMarkdown = "❌ OCR usage is blocked.`n`n%TestResult%"
111+
}
112+
else {
113+
$passed = $true
114+
$testResultMarkdown = "✅ OCR configuration is enabled at the tenant level for at least one workload, enabling policies to detect sensitive information within images.`n`n%TestResult%"
115+
}
116+
}
117+
#endregion Assessment Logic
118+
119+
#region Report Generation
120+
$mdInfo = ''
121+
122+
if (-not $errorMsg) {
123+
$reportTitle = 'OCR configuration status'
124+
$portalLink = 'https://purview.microsoft.com/'
125+
$portalPathSafe = Get-SafeMarkdown -Text 'Microsoft Purview portal > Settings > Optical character recognition (OCR)'
126+
127+
$configurationObjectStatus = if ($null -ne $ocrConfig) { 'Yes' } else { 'No' }
128+
129+
$tableRows = "| Configuration object exists | $configurationObjectStatus |`n"
130+
$tableRows += "| OCR enabled (Tenant-level) | $enabled |`n"
131+
$tableRows += "| Exchange location enabled | $exchange |`n"
132+
$tableRows += "| SharePoint location enabled | $sharePoint |`n"
133+
$tableRows += "| OneDrive location enabled | $oneDrive |`n"
134+
$tableRows += "| Teams location enabled | $teams |`n"
135+
$tableRows += "| Endpoint location enabled | $endpoint |`n"
136+
$tableRows += "| OCR usage blocked | $(if ($null -eq $isBlocked) { 'N/A' } else { $isBlocked }) |`n"
137+
$tableRows += "| Blockage reason | $(if ($blockReason) { $blockReason } else { 'None' }) |`n"
138+
$tableRows += "| Azure billing status | $(if ($billingStatus) { $billingStatus } else { 'N/A' }) |`n"
139+
140+
$ocrConfiguredStatus = if ($ocrConfig) { 'Configured' } else { 'Not Configured' }
141+
142+
$formatTemplate = @'
143+
144+
### {0}
145+
146+
| Setting | Value |
147+
| :------ | :---- |
148+
{1}
149+
150+
**Summary:**
151+
152+
- OCR configuration: {2}
153+
- Active locations: {3}
154+
155+
[{4}]({5})
156+
157+
'@
158+
$mdInfo = $formatTemplate -f $reportTitle, $tableRows, $ocrConfiguredStatus, $enabledLocationsCount, $portalPathSafe, $portalLink
159+
}
160+
161+
$testResultMarkdown = $testResultMarkdown -replace '%TestResult%', $mdInfo
162+
#endregion Report Generation
163+
164+
$params = @{
165+
TestId = '35023'
166+
Title = 'OCR is enabled for sensitive information detection'
167+
Status = $passed
168+
Result = $testResultMarkdown
169+
}
170+
171+
if ($customStatus) {
172+
$params.CustomStatus = $customStatus
173+
}
174+
Add-ZtTestResultDetail @params
175+
}

0 commit comments

Comments
 (0)