T Techclick ← All lessons
Zscaler · ZIA · Batch 11 · Lesson 8

ZIA DLP + CASB — content vs tenant

Compliance asks: “If someone uploads the customer sheet to a personal OneDrive, do we stop it?” URL Filtering only sees the domain. A Credit Cards dictionary fires on every test log. This lesson is the production model — dictionaries, engines, EDM/IDM, tenant restriction — and the Web Insights fields that close the ticket.

20 min read · L2 primary · Quiz at end

⚡ Quick Answer

ZIA DLP + CASB lesson: dictionaries vs engines, EDM and IDM, Cloud App Control tenant restriction, and how to prove a hit in Web Insights DLP fields.

After this page you can

Quick answer (say this out loud)

Cloud App Control answers “which app, which tenant, which activity.” DLP answers “what data is in the payload.” Dictionaries detect (predefined, Pattern and Phrases, Exact Data Match, Indexed Document Match). You do not hang a regex on the rule — you put dictionaries in a DLP Engine with All (AND), Any (OR), Exclude (AND NOT), or Sum, then the rule references up to four engines. Actions are Allow, Block, or Confirm. Tenant restriction is a Tenant Profile (Tenant Directory ID) on a Cloud App Control rule — not a DLP dictionary. Prove it on Analytics → Web Insights → Logs.

Hero · inspect before the SaaS split
Laptop upload inspected by a cloud node before corporate or personal storage
Notice: the same upload can be allowed to the corporate tenant and blocked to personal storage. That split is Cloud App Control + Tenant Profiles. The spreadsheet contents are DLP.

1. Why this ticket exists

URL Filtering keeps people off bad sites. Threat Protection keeps malware out. Legal will still ask one question: if an employee posts the customer table to personal webmail or a personal cloud drive, do we know, and do we stop it?

That is two different jobs. Cloud App Control can allow, caution, block, or isolate an app — and, with a Tenant Profile, tell corporate Microsoft 365 from a personal login on the same domain. DLP inspects the body and attachments after SSL inspection and matches dictionaries inside an engine. Neither one replaces the other.

HTTPS that is not decrypted is invisible to content DLP. If SSL Inspection is bypassed for onedrive.com, the DLP rule you spent a week on never sees the file. Fix inspection first; then build dictionaries.

Visual · Path A vs Path B
Decision diamond splitting Path A locked vault from Path B open locker
Caption in the diagram is mood only. Path A = sanctioned tenant + activity control. Path B = personal or unsanctioned destination. DLP still inspects the payload on both.

2. Mental model

ZIA data protection is a stack. Memorize the order before you open the portal.

1 · Dictionary

The detector. Predefined (Credit Cards, SSN, Aadhaar, …), custom Pattern and Phrases, Exact Data Match (EDM), or Indexed Document Match (IDM).

2 · Engine

The expression. Combine dictionaries with All (AND), Any (OR), Exclude (AND NOT), Sum, plus a match count per dictionary. This is what the rule references.

3 · DLP rule

Who / where / which apps. Criteria include DLP Engines (Any, or up to 4), URL Categories, Cloud Applications, file types, users. Action: Allow, Block, Confirm.

4 · Tenant + at rest

Tenant Profiles on Cloud App Control pick the SaaS tenant. SaaS Application Tenants + Data at Rest Scanning find files already stored — they never had to cross the tunnel today.

Visual · Detect → Engine → Rule → Log
Four-panel pipeline labeled Detect, Engine, Rule, Log
Help’s real order: dictionaries never sit alone on a policy. The engine is the Boolean. The rule is the action. The log is the proof.
Say this out loud

Provision the detector. Combine it in an engine. Scope the rule. Restrict the tenant. Then open Web Insights and name the engine that fired.

Hard words, once

DLP Dictionary — a named detector. DLP Engine — Boolean (and Sum) over dictionaries; this is what the rule lists. EDM — Exact Data Match: Index Tool hashes your structured rows; inspection looks up hashes. IDM — Indexed Document Match: Index Tool fingerprints documents; match accuracy catches excerpts. Tenant ProfileTenant Directory ID (and options such as Allow Personal Office 365 Domains) attached to Cloud App Control. Confirm — user must justify or cancel; both are logged. Match Only — still evaluates on Allow and Block; used when you want the engine to count without changing the action story.

3. Decision flow

Read the diagram first. Then pick the control. Do not start in “Add DLP Rule” if the problem is “personal vs corporate login.”

Flow 1 · which control owns this ticket
Start with the question, not the menu Sensitive data leaving / already in SaaS? User, app, direction, inspectable? Crossing ZIA right now? No · already in the tenant SaaS Application Tenants + Data at Rest Scanning DLP OAuth · not the tunnel Activity or content? Activity / tenant Cloud App Control + Tenant Profile (Directory ID) Allow · Caution · Block · Isolate Content DLP Engine on DLP rule Allow / Block / Confirm SSL Inspection must be on for HTTPS content DLP Bypass the SaaS host and the engine never sees the file. Encrypted / password-protected files also skip payload inspection. Most tickets need Cloud App Control AND DLP — tenant first, then content.

Read top → bottom. Diamond = decision. Left = already stored (SaaS API). Right = in motion. Activity is not content.

4. How to choose

One detector does not cover every leak. Pick the tool that matches the data shape, then wrap it in an engine.

ControlUse whenDo not use whenWhat it matches
Predefined dictionary Regulator formats: Credit Cards, US SSN, India Aadhaar, IBAN, cloud keys. Zscaler maintains the pattern. You only care about your customer rows, or a board deck excerpt. Pattern + built-in validators (e.g. Luhn on cards). Alone, a Credit Cards dictionary is noisy.
Pattern and Phrases Internal labels, project codenames, custom ID formats you can write as words, phrases, or a pattern. You try to paste a regex onto the DLP rule itself. Rules do not take raw regex. Tokens / phrases / patterns inside a named dictionary. Tune match count in the engine.
EDM Structured rows you own: customer PAN + name + email. “Only our 1.2M records.” Free-text excerpts, slide decks, source trees. Stale CSV with no refresh job. Hash lookup from an EDM index template built in the Index Tool. Primary field is the unique key in classic templates.
IDM Unstructured originals: board deck, M&A draft, contract. You need partial-document hits. Row-shaped databases. You expect 100% match on a heavily templated legal form (raise match accuracy). Document fingerprint. Set match accuracy on the custom IDM dictionary.
Cloud App Control + Tenant Profile Personal vs corporate Microsoft / Google login. Block upload to an unsanctioned tenant while allowing the corp tenant. You need to know what was in the file. Tenant control does not read PAN digits. App + activity (upload / download / post) + Tenant Directory ID.
Data at Rest Scanning Files already in SharePoint / Drive / Box from last quarter. Public shares. Off-tunnel BYOD that never hit ZIA. You need a real-time block of this morning’s upload. That is inline DLP + Cloud App Control. SaaS Application Tenant (OAuth) + Data at Rest DLP policy. Connector health is the silent failure.

5. Runbook — dictionary → engine → rule → tenant

Side A builds detectors. Side B hangs them on an inline DLP rule. Side C restricts the SaaS tenant and (if licensed) authorizes the SaaS tenant for at-rest scan. Activate after each side.

Side A — Dictionaries and engines

Primary source: Zscaler Help About DLP Dictionaries, Adding Custom DLP Dictionaries, Understanding DLP Engines, Adding Custom DLP Engines.

  1. Open Dictionaries & Engines

    Path (current Help): Policies → Data Protection → Common Resources → DLP Dictionaries & Engines. Older clouds still show Policy → Data Loss Prevention. You will see predefined dictionaries, custom dictionaries, and DLP Engines as separate objects.

  2. Reuse or clone a predefined dictionary first

    Credit Cards, Social Security Number (US), Aadhaar Card Number (India), and similar predefined dictionaries are maintained by Zscaler. Clone if you need a tighter match count later — do not invent a second Luhn regex unless Help’s dictionary cannot express the format.

  3. Add a custom dictionary only when needed

    Add Dictionary → choose type: Pattern and Phrases, Exact Data Match, or Indexed Document Match. Pattern and Phrases is words / phrases / patterns. EDM and IDM require an index template from the Index Tool before the dictionary is useful.

  4. EDM: Index Tool → template → dictionary

    Export the sensitive table, normalize columns the same way users will type them (strip spaces on PANs). In the Index Tool create an EDM index template. Classic templates still treat the primary field as the unique key the policy is based on. Hash upload — the Service Edge looks up hashes, not plaintext rows. Rebuild the index on a schedule; a six-week-old snapshot will not see last week’s customers.

  5. IDM: Index Tool → template → match accuracy

    Upload the protected documents to an IDM index template. On the custom dictionary, set match accuracy (Help: Defining IDM Match Accuracy for Custom DLP Dictionaries). Lower accuracy catches excerpts (pasted paragraphs). Higher accuracy reduces hits on templated legal text.

  6. Build the engine — this is the Boolean

    Add DLP Engine. Root operators: All (AND), Any (OR), Sum. Nested operators also include Exclude (AND NOT). Each dictionary gets a match count. Sum is for count-based dictionaries (Credit Cards, SSN, …) — you set the total matches that fire the group. Example production shape: All( Credit Cards match count ≥ 2 , Any( Cardholder-related phrase dictionary ) ). That is an engine, not a “composite dictionary.”

admin.zscalerthree.net · Policies → Data Protection → Common Resources → DLP Dictionaries & Engines → DLP Engines
Training mock · not live

Policies / Data Protection / Common Resources / DLP Engines / Add DLP Engine

Add DLP Engine

PCI-CC-Strict
Enabled
All (AND)
All (
  Dictionary: Credit Cards   Match Count: 2
  Any ( Phrase: cardholder · expiry · CVV )
)
Cancel Save

Root may be All, Any, or Sum. Exclude (AND NOT) is for nested expressions. Rules reference this engine — not the dictionaries directly.

Source: Zscaler Help · Understanding DLP Engines / Adding Custom DLP Engines. Values are training placeholders.

Side B — Inline DLP rule

Primary source: Zscaler Help Configuring DLP Policy Rules with Content Inspection.

  1. Confirm SSL Inspection covers the destination

    Content inspection of HTTPS requires decryption. If Cloud Apps or URL categories for webmail / file sharing are on an SSL bypass, stop and fix SSL Inspection first.

  2. Add DLP Rule

    Path: Policies → Data Protection → Policy (older: Policy → Data Loss Prevention) → Add DLP Rule. Set Rule Order (evaluated ascending: 1 before 2), Rule Name, status, optional Rule Label.

  3. Content Matching = DLP Engines

    Choose Select DLP Engines. Pick Any, or select up to 4 engines. That is a documented limit — if you need a fifth detector, fold it into an existing engine expression.

  4. Scope with AND criteria

    Help applies AND across URL Categories and Cloud Applications when both are set. Also set users / groups / departments / locations and file types. Example: Cloud Applications = webmail family, Groups = All except a documented exception group.

  5. Action, auditor, notification

    Allow — permit and log. Block — deny and log. Confirm — user justifies to continue or cancels; both are logged. Attach an auditor and a notification template if you want the email; Help says if you select neither, no notification is sent. Match Only applies to both Allow and Block.

  6. Pilot with Confirm, then flip to Block

    New PCI-to-personal-webmail rules go live as Confirm for a measured window (commonly two weeks in production practice). Tune match counts from the justification noise. Then change Action to Block. Check Evaluate All Rules on DLP Advanced Settings if your design needs more than first-match.

Training rule card — field names from Help, not a live tenant
Add DLP Rule
  Rule Order:        20
  Rule Name:         Block-PCI-to-personal-webmail
  Content Matching:  Select DLP Engines
  DLP Engines:       PCI-CC-Strict          (max 4 engines)
  URL Categories:    Webmail
  Cloud Applications:Gmail / Yahoo Mail / Outlook.com (as classified)
  Users / Groups:    All except documented exception group
  Action:            Confirm   → later Block
  Auditor:           secops-dlp@example.com
  Notification:      PCI-block-banner
  Match Only:        off

Side C — Tenant restriction + SaaS at rest

Primary source: Zscaler Help Adding Tenant Profiles, About Cloud App Control, Adding SaaS Application Tenants.

  1. Add Tenant Profile

    Path (current Help): Policies → Access Control → Internet & SaaS → Tenant Profiles → Add Tenant Profile. Older label: Administration → Tenant Profiles. For Microsoft Login Services, enter the corporate Tenant Directory ID (Entra tenant GUID). Decide Allow Personal Office 365 Domains explicitly — leaving this wrong is how personal OneDrive stays open.

  2. Attach the profile to Cloud App Control

    Cloud App Control rule (IT Services / File Sharing / the category Help shows for that app) → Tenant Profiles. Actions here are app actions: Allow, Caution, Block, Isolate, plus per-activity Allow/Block (upload, download, posting) where the category supports them. This is not DLP.

  3. Authorize SaaS Application Tenants for at-rest

    If the ticket is “files already in SharePoint with a public link,” add the SaaS Application Tenant (OAuth / admin consent) and write a Data at Rest Scanning DLP policy against the same engines. Inline DLP will never enumerate last year’s library.

admin.zscalerthree.net · Policies → Access Control → Internet & SaaS → Tenant Profiles
Training mock · not live

Policies / Access Control / Internet & SaaS / Tenant Profiles / Add Tenant Profile

Add Tenant Profile

MS365-corp-only
Microsoft Login Services
f4c77d8d-6bb8-41a2-0000-000000000000
Off — personal tenants blocked when this profile is attached
Cancel Save

Directory ID example shape from Help. Then attach this profile on the Cloud App Control rule — saving the profile alone does nothing.

Source: Zscaler Help · Adding Tenant Profiles (Microsoft Login Services · Tenant Directory ID · Allow Personal Office 365 Domains).

6. Runtime path

After go-live, one Gmail attachment or OneDrive PUT walks this path. If any box is skipped, the log will lie to you.

Flow 2 · one upload after Activate
1 · User POST / upload 2 · Forward ZCC / GRE / PAC 3 · SSL Inspect or DLP is blind 4 · Cloud App Tenant Profile? 5 · DLP Engine dicts + match count Engine hit? rule Action Allow · log permitted + recorded Confirm justify or cancel Block · log user notification 6 · Web Insights Engine · Dicts · Severity · Action NSS web fields you will name in SIEM: DLP Engine, DLP Dictionaries, DLP Severity, Action — plus user, URL, Cloud App. Endpoint DLP uses dlpenginenames / dlpdictnames / actiontaken / triggeredrulelabel.

Left → right, then down. If step 3 is bypass, steps 5–6 never populate DLP columns.

7. Traps + proof

Ops · the log is the close
Operations desk with green verification checks on a monitor
Green boxes are a feeling. The ticket closes when Web Insights shows the engine name, the dictionaries, DLP Severity, and Action for the pilot user.
SymptomLikely causeFix
50k Credit Cards alerts / day, mostly from build logs A single predefined dictionary with match count 1, no engine AND Wrap Credit Cards in an engine: All + higher match count + Any nearby phrase dictionary. Optionally add EDM so only your rows count.
Personal OneDrive upload succeeds; URL looks like onedrive.com No Tenant Profile on Cloud App Control, or Allow Personal Office 365 Domains left on Add Tenant Profile with corporate Tenant Directory ID. Attach it. URL Filtering cannot split tenants.
Rule exists; Insights has no DLP Engine / DLP Dictionaries SSL Inspection bypassed, or file encrypted / password-protected, or traffic never hit ZIA Confirm inspect for that Cloud App. Encrypted ZIP will not yield payload matches — pair File Type Control. Prove forwarding first.
New customer PAN does not fire EDM Index is a snapshot. Row was added after last Index Tool upload Rebuild / re-upload the EDM template on a schedule. Alert if last successful index is stale.
Board-deck excerpt pasted into a chatbot is missed You used EDM or a phrase dictionary. That is the wrong detector IDM template + lower match accuracy on the custom dictionary. EDM is rows, not prose.
SharePoint public-link report is empty for last month SaaS Application Tenant OAuth expired or last scan is old. Inline DLP never sees at-rest objects Re-authorize the tenant. Monitor connector / last-scan age. Write Data at Rest DLP separately.
Match preview in the log shows a full PAN Notification / Insights preview not redacted; NSS forwarded the same string Treat the log as a second leak. Use redacted previews and confirm NSS / SIEM columns do not store the raw match. Audit every DLP rule.
Unsafe vs safe

Unsafe: Block-from-day-1 on All Users + Credit Cards dictionary only. Monday is a ticket flood and SecOps mutes DLP.

Safe: Engine with All + match count → Confirm on a pilot group → read Web Insights → widen → Block. Tenant Profile on Cloud App Control so corporate OneDrive still works.

Pilot proof checklist

Knowledge check

Six judgment questions. Map each miss back to the section in the reason.

Q1

A user on a corporate laptop uploads a file to personal OneDrive. The CISO wants personal blocked and corporate allowed on the same domain. Which control actually splits the tenants?

Correct: b. Tenant restriction is Tenant Profiles on Cloud App Control. URL Filtering sees one domain. DLP reads content, not tenant ID. SSL bypass would hide the upload. Re-read the decision flow and Side C.
Q2

You must match only your 1.2 million customer card numbers, not every Luhn-valid 16-digit string. Which detector?

Correct: a. EDM is structured exact-row match. Predefined Credit Cards is any valid card pattern. IDM is documents. Isolate is an app action. Re-read How to choose.
Q3

A user pastes three paragraphs of last quarter’s board deck into a public chatbot. The file itself was never uploaded. What has a chance of firing?

Correct: c. IDM fingerprints documents and match accuracy is how excerpts hit. EDM is rows. File Type Control never sees a paste. Tenant ID is the Microsoft login, not the chatbot text. Re-read Side A IDM.
Q4

SOC is drowning in Credit Cards dictionary hits from developer logs. What is the Help-shaped fix?

Correct: b. Rules reference engines, not raw regex. All + match count is the false-positive killer. SSL bypass creates a blind spot. Re-read Side A engines.
Q5

A new rule will block PCI uploads to personal webmail next week. Least-damage rollout?

Correct: d. Confirm logs justifications without a Monday outage. Help’s actions are Allow, Block, Confirm — Confirm is the rehearsal. Re-read Side B.
Q6

How do you prove the pilot upload actually hit inline DLP?

Correct: c. Those four columns are the inline proof. Loading a site only proves forwarding. A green SaaS tenant is at-rest connector health, not this morning’s POST. Re-read traps + proof.

Sources

Related: URL Filtering & Cloud App Control · SSL Inspection & file type · Zscaler authentication · ZIA traffic flow · Batch 11 · Lesson 9 — ZPA architecture