DLP & Compliance in Microsoft 365: Complete Administration Guide
🛡️ What is DLP?
💡 Overview
Data Loss Prevention (DLP) in Microsoft Purview identifies, monitors, and automatically protects sensitive information across Exchange Online, SharePoint, OneDrive, Teams, and endpoints. A DLP policy detects content that matches defined conditions — such as credit card numbers or personal identifiers — and applies actions like blocking sharing, showing policy tips, or notifying admins.
⚙️ Creating a DLP Policy
Choose Locations and Template
Go to Microsoft Purview portal → Data Loss Prevention → Policies → Create policy. Select a template (e.g. Financial, Privacy) or start with a custom policy, then choose the locations to protect (Exchange, SharePoint, OneDrive, Teams, Devices).
Define Conditions and Actions
Add conditions using Sensitive Information Types or sensitivity labels, set the instance count and confidence level, then define actions — restrict access, encrypt, block external sharing — plus user notifications and incident reports.
Test Before Enforcing
Always run the policy in simulation mode first to review what would be flagged, then turn it on once you’re confident there are no false positives disrupting business workflows.
🔢 Blocking Random Numbers with a Custom SIT
⚠️ Common Interview Scenario
“Create a DLP policy to block emails containing random numbers (e.g. account numbers with a specific pattern).” Built-in SITs won’t match a custom pattern — you need a Custom Sensitive Information Type (Custom SIT) built with a regular expression, then reference it in the DLP policy.
Connect-IPPSSession # Verify existing sensitive information types: Get-DlpSensitiveInformationType | Select-Object Name, Publisher # Create a DLP compliance policy New-DlpCompliancePolicy -Name "Block Account Numbers" -ExchangeLocation All -Mode Enable # Add a rule that blocks messages containing the custom SIT New-DlpComplianceRule -Name "Block Account Number Rule" -Policy "Block Account Numbers" -ContentContainsSensitiveInformation @{Name="Custom Account Number"} -BlockAccess $true
🔍 Sensitive Information Types (SIT) vs Custom SIT
| Type | What It Is | When Used |
|---|---|---|
| Built-in SIT | 300+ Microsoft-defined patterns (credit cards, SSN, passport numbers, IBAN) | Standard regulated data — fastest to deploy |
| Custom SIT | Your own pattern built from regex, keyword lists, and confidence levels | Organisation-specific data — employee IDs, project codes, account numbers |
| Exact Data Match (EDM) | Matches against an uploaded hashed table of actual sensitive values | Very high accuracy needs — near-zero false positives |
🏷️ Sensitivity Labels & Microsoft Information Protection (MIP)
💡 MIP Overview
Microsoft Information Protection (now Microsoft Purview Information Protection) is the framework for classifying and protecting data using sensitivity labels. Labels travel with the file or email, applying encryption, watermarks, and access restrictions wherever the content goes.
Typical Label Behaviour
| Label | Typical Behaviour |
|---|---|
| Public | No protection — content approved for external release |
| Internal | Visible marking (header/footer); sharing intended for employees only |
| Confidential | Encryption applied; access restricted to authenticated internal users; external forwarding blocked |
Auto-Labeling
✅ Two Types of Auto-Labeling
- Client-side auto-labeling: Applied while the user works in Office apps — recommends or applies a label when sensitive content is detected
- Service-side auto-labeling: Applied automatically to content at rest in SharePoint/OneDrive and emails in transit — no user interaction required
🔒 Encryption at Rest and in Transit
💡 How Microsoft 365 Encrypts Data
- Data in transit: Protected using TLS 1.2+ between clients, servers, and datacenters — this covers Outlook-to-Exchange Online, browser-to-SharePoint, and datacenter-to-datacenter traffic
- Data at rest: Protected using BitLocker and distributed key management (DKM) at the disk level, plus per-file encryption in SharePoint/OneDrive where each file is encrypted with its own key
- Service encryption: An additional layer using Microsoft-managed keys by default, upgradable to Customer Key for organisations that need to control and revoke their own encryption keys
- Message-level encryption: Microsoft Purview Message Encryption adds email-specific encryption controlled by sensitivity labels, independent of transport-level TLS
📧 Blocking External Email with a Transport Rule
Connect-ExchangeOnline # Block emails with the Confidential label from going to external recipients New-TransportRule -Name "Block Confidential External" ` -MessageContainsDataClassifications @{Name="Confidential"} ` -SentToScope NotInOrganization ` -RejectMessageReasonText "Confidential content cannot be sent externally."
📊 PII Dashboard in Microsoft Purview
💡 Where to Find It
In the Microsoft Purview portal, use Data Classification → Content Explorer to see exactly which files and emails contain PII across the organisation, and Activity Explorer to track label changes and DLP policy matches over time. These dashboards require the Content Explorer Content Viewer / List Viewer role groups.
💡 Best Practices & Recommendations
- Always start DLP policies in simulation mode and review matches before enforcing
- Use policy tips to educate users at the moment of violation instead of silently blocking
- Keep the number of top-level sensitivity labels small (3–5) so users can choose correctly
- Combine DLP with auto-labeling so protection doesn’t depend on user discipline
- Review DLP reports and Activity Explorer weekly to tune false positives
- Document every custom SIT regex and test it against real sample data before production
🎓 Common Interview Questions
📚 References & Further Reading
- 🔗 Learn about data loss prevention — Microsoft Learn
- 🔗 Create a custom sensitive information type — Microsoft Learn
- 🔗 Learn about sensitivity labels — Microsoft Learn