How to use Policies in Dropbox Protect

Policies in Dropbox Protect help admins automatically detect and fix potential data risks across their organization. They run daily scans for conditions like files with open links, externally shared content, or inactive accounts.

How to use Policies

There are two ways to use policies after you’ve set up your requirements. You can use them together or on their own:

• Send an alert: Sends admins an email every 24 hours at 8:00 UTC that summarizes matching policies that need manual review.
• Automatically fix it: Performs automatic fixes daily on matching items at 8:00 UTC, with changes logged in Action history.
  • Depending on the size of your organization, automatic fixes can take a few hours to complete.

How Policies handle access managed at the top-level

When policies run automatic fixes, they only evaluate and act on items with directly added access. Items with access managed at the top level are skipped and aren’t actioned on.

This only applies to automations run via a policy. Since no fix is applied, these items are logged in Action history as Skipped. 

Learn more about top-level permissions.

How to access Policies

After you access Dropbox Protect, click Policies in the side panel.

How to manage policy requirements

There are 14 policy cards that can be edited and customized.

1. Click Set up on an inactive policy card or the gear icon on an active policy card.
2. Give your policy a unique name.
3. Click Edit mode.
4. Set all the applicable filters.
5. Click Save and close.
6. Select if you want to Send an alert, Automatically fix it or both.
   • If Send an alert is selected, you can enter the name or email of the admins to notify, select or deselect all, or remove them. By default, only the admin who sets up the alert is added.  
7. Type CONFIRM.
8. Click Activate on an inactive policy card or Update on an active policy card.

You can also edit an existing policy while reviewing the policy matches. Use the filters in the left side panel to preview what the matches will look like with the changes.

Be sure to click Edit when you’re ready to make changes and Save and close when you’re done.

What automatic fixes are available

Each policy card has a set automatic fix and can’t be changed.

How Alerts work

Every 24 hours at 8:00 UTC, an email summarizing policy matches that need manual review is sent to admins. The email also has a link to review the matches, and identifies who created the alert.

How to review and take action on policy matches

You can view policy matches by clicking View matches in the alert email or the matches on the policy card. From there, you can manually take action on the matches individually or in bulk.

1. Select the matches you want to action on.
2. Click the action you want to take:
   • Add link type
   • Remove link type
   • Add collaborator
   • Remove collaborator
   • Stop sharing
   • Delete
3. If applicable, select the action or enter the collaborator.
4. Type CONFIRM.
5. Click the action button.

How to deactivate a policy

1. Click the gear icon on an active policy card.
2. Scroll to the bottom of the policy card.
3. Type CONFIRM.
4. Click Deactivate in the bottom left of the policy card.
5. Then click Deactivate again in the pop-up.