Trellix Data Loss Prevention – SaaS capabilities include native support for Microsoft Entra ID (formerly Azure AD). This integration allows IT administrators to configure DLP policies with user conditions, and exceptions based on cloud-based users and groups.
This feature provides a seamless and consistent policy enforcement experience. You can now extend your existing data protection, application control, and device control rules to all endpoints, whether they are synced to an on-premises Active Directory or directly to Microsoft Entra ID.
You must have the following details from your Microsoft Azure portal to configure this feature:
Tenant ID (Directory ID)
Client ID (Application ID)
Client Secret (Application Password)
For more information, see KB article 000014786.
Note
Perform these steps if your environment manages users via both an on-premises directory and Entra ID. If your organization uses Microsoft Entra ID exclusively, you can skip this section.
In ePO - SaaS, go to Menu → Configuration → Directory Service and click New Server.
In the Description page, select Directory Services in Server type, then specify a unique name and optional description and click Next.
In the Details page, select Active Directory from the Directory Services list.
Enter the server name, username, and password for the domain from which you want to add users.
Click Test Connection to verify the connection is successful, and click Save to complete the registration.
In ePO - SaaS, go to Menu → Configuration → Directory Service and click New Server.
In the Description page, select Directory Services in Server type, then specify a unique name and optional description and click Next.
In the Details page, select Microsoft Entra ID from the Directory Services list.
Enter the Tenant GUID, Client ID, and Client ID Secret generated in Microsoft Azure portal.
You can set up a schedule that updates the changes in the mapped domain or Active Directory container. You can schedule it hourly or daily based on your requirements.
Click Test Connection to verify the connection to confirm the communication between your Entra ID and ePO - SaaS is successful, and click Save to complete the registration.
Synchronize your on-premises and cloud identities within Microsoft Entra ID to apply consistent DLP policies across your entire infrastructure.
On your local domain controller or dedicated sync server, launch the Microsoft Entra Connect wizard.
Click Configure on the Welcome page.
Select Customize synchronization options and click Next.
Enter your Microsoft Entra ID Global Admin (or Hybrid Identity Admin) credentials and click Next.
Select your on-premises directory. If prompted, ensure your Forest is selected and click Next.
Navigate to the Domain and OU filtering page, click Next if no changes are needed.
On the Ready to configure page, ensure the Start the synchronization process when configuration completes checkbox is selected.
Click Configure to begin the synchronization.
Verifying Synchronization Status - After the configuration completes, allow several minutes for the initial synchronization to populate. Confirm the connection and user status in the Microsoft Entra admin center:
Check Global Status: Go to Microsoft Entra ID → Hybrid management → Microsoft Entra Connect. Ensure the Sync status is displayed as Enabled.
Verify Individual Users: Go to Identity → Users → All users.
Locate a specific on-premises user.
Confirm the On-premises sync enabled attribute is set to Yes.
In ePO - SaaS, go to DLP Policy Manager → Definitions → Identity Server → Microsoft Entra ID.
Enter the Tenant GUID, Client ID, and Client ID Secret generated in Microsoft Azure portal.
Test the credential and click Save.
In ePO - SaaS, go to DLP Policy Manager → Definitions → End-User Group.
Click Actions → New Item.
Select either Add Users, or Add Groups.
From the Look in dropdown, select users based on the server type:
For Microsoft Entra ID: Click Add Users or Add Groups, select your Entra ID server, and search for specific cloud identities.
For Active Directory: Click Add Users or Add Groups, select your LDAP server, and browse your local Organizational Unit (OU) structure.
Click Save.
Use case: Applying User Definitions to DLP Rules
Goal: Apply unified DLP policies to protect sensitive information, regardless of whether the user is managed in Microsoft Entra ID or an on-premises directory.
In the Trellix ePO console, go to Menu → DLP Policy Manager → Rule Sets.
Open an existing rule set or click Actions → New Rule Set.
On the Data Protection tab, click Actions → New Rule and select a protection vector. For example, Web Protection or Printing Protection.
On the Condition tab:
Classification: Select the classification that matches your sensitive data. For example, a "Trellix" keyword category.
End-User Group: Select is any user (OR) and add the Entra ID or Active Directory user definitions you created.
Note
In environments managing both Microsoft Entra ID or an on-premises directory, add the user or group definitions from both sources to this field. This ensures the rule triggers consistently regardless of which directory service authenticates the user.
On the Reaction tab:
Set the Action to Block.
(Optional) Select User Notification to alert the user when a block occurs.
Ensure Report Incident is enabled.
Click Save and Apply the policy.
Once the policy is applied, the Trellix DLP agent enforces the rule based on the user's identity source.
Scenario: Web and Print Enforcement
Web Upload: A synchronized Entra ID or an on-premises Active Directory users attempts to upload a document containing the "Trellix" keyword to a personal Gmail account. The Web Protection rule blocks the upload.
Context: The protection vector (Web or Print), file name, and timestamp. The same user attempts to print the document. The Printing Protection rule identifies the unauthorized user/data combination and terminates the print job.
Every blocked attempt generates an incident in the DLP Incident Manager. Administrators can drill down into each event to view:
User Details: The specific Entra ID or AD account name.
Evidence: The exact content that triggered the classification.
Context: The protection vector (Web or Print), file name, and timestamp.