🔐 Purview Course · Module 4 of 6
Data Loss Prevention (DLP)
SC-400 Exam Alignment
SC-400
Skill: Create and configure DLP policies — Understand DLP policy anatomy (rules, conditions, actions), configure DLP for Exchange, SharePoint, OneDrive, Teams, and endpoint devices, manage policy tips and user overrides, and investigate DLP alerts and policy matches in Activity Explorer.
- A DLP policy consists of locations (where to scan) + rules (conditions to match + actions to take)
- Rules are evaluated in priority order — the first rule that matches determines the action; lower priority number = higher precedence
- Know the difference between “Block” (prevent the action), “Block with override” (user can override with business justification), and “Audit” (log only)
- Endpoint DLP requires devices to be onboarded to Microsoft Defender for Endpoint AND Microsoft Purview. Available on Windows 10/11 and macOS.
Exam Tip: SC-400 tests DLP policy mode differences: Simulation mode (test only, no user-facing action) vs Active mode (policy enforced). Always deploy in simulation first to review matches, then switch to active. Also know that DLP policies for Teams only apply to Teams messages — not files stored in Teams (those are stored in SharePoint/OneDrive and covered by SharePoint/OneDrive DLP rules).
Data Loss Prevention policies are the enforcement layer that acts when sensitive data is detected. While sensitivity labels classify data and SITs identify it, DLP policies respond — blocking, alerting, notifying, or restricting actions when sensitive content is about to be shared in ways that violate your organisation’s data handling policies. A well-designed DLP programme combines all three layers working together.
🏗️ DLP Policy Anatomy
Every DLP policy has three core components: locations, rules, and settings.
| Component | What You Configure |
|---|---|
| Locations | Where the policy applies: Exchange Online, SharePoint Online, OneDrive accounts, Teams chats and channel messages, Endpoint devices (Windows/macOS), On-premises repositories, Power BI, Microsoft Fabric |
| Rules | Each rule has conditions (what to detect) + exceptions + actions (what to do on a match). A policy can have multiple rules with different thresholds and actions. |
| Policy mode | Simulation (audit only — no user-facing impact), Turn it on right away (active enforcement), or Keep it off (disabled) |
📋 DLP Rule Conditions
Rules detect sensitive content using one or more conditions. Conditions can be combined with AND/OR logic.
| Condition Type | Examples |
|---|---|
| Content contains | Sensitive information types (e.g. “Credit Card Number” with minimum confidence 75%), sensitivity labels, trainable classifiers |
| Content is shared | “With people outside my organisation” — triggers when sending externally; “Only with people inside my organisation” — triggers on internal sharing of specific content |
| Sender / Recipient | Sender is a member of a specific group; Recipient domain is / is not a specific domain; Recipient is an internal/external user |
| Count threshold | “Content contains at least X instances” — use a low threshold rule for policy tips and a high threshold rule for blocking, in the same policy |
⚡ DLP Rule Actions
| Action | What Happens | User Experience |
|---|---|---|
| Audit only | Match is logged — no action taken. No user notification. | Invisible to user — only visible in DLP reports and Activity Explorer |
| Show policy tip to user | User sees an inline notification about the policy but can still proceed | Yellow warning banner in Outlook, Word, SharePoint |
| Block | The action (send email, upload file, share link) is completely prevented | Error message shown — action cannot be completed. No override option. |
| Block with override | Action is blocked but user can override by providing a business justification or by marking as false positive | Block message with options: “Override this” or “Report as false positive” |
| Restrict access or encrypt | For SharePoint/OneDrive: removes sharing access. For email: can apply encryption automatically. | Existing shares are revoked; new shares blocked. |
| Send incident report | Sends an email alert to compliance team with details of the policy match | No user impact — admin notification only |
💡 Layered Rules Strategy
Best practice is to create multiple rules within the same DLP policy:
• Rule 1: 1–4 instances of credit card numbers → Show policy tip, send incident report
• Rule 2: 5+ instances of credit card numbers → Block with override, notify compliance team
• Rule 3: 10+ instances → Block (no override allowed), high-severity alert
Rules are evaluated in priority order — the first matching rule wins.
📱 DLP Locations in Detail
| Location | What It Covers | Key Notes |
|---|---|---|
| Exchange Online | Outbound and internal emails | DLP applies to sent messages — not to content at rest in mailboxes. Also covers shared mailboxes. |
| SharePoint Online | All files in SharePoint document libraries and lists | Scans at upload/modification and on schedule. DLP can restrict sharing links. |
| OneDrive accounts | Files in individual users’ OneDrive | Same engine as SharePoint. Can scope to specific accounts or include all users. |
| Teams chat and channel messages | Teams message bodies (text) only — not file attachments | Files in Teams are stored in SharePoint/OneDrive and covered by those locations. |
| Endpoint (Windows/macOS) | File activities on managed devices: copy to USB, upload to cloud services, print, copy to clipboard | Requires Defender for Endpoint onboarding. Works even when devices are offline. |
| On-premises repositories | File shares and SharePoint Server on-premises | Requires Microsoft Purview Information Protection scanner deployment on-premises. |
💻 Endpoint DLP
Endpoint DLP extends DLP protection to activities on Windows 10/11 and macOS devices. Unlike cloud-based DLP that monitors network traffic, Endpoint DLP monitors activities at the device level — even when the user is offline.
Monitored Endpoint Activities
| Activity | Example |
|---|---|
| Upload to cloud service or browser | User drags a file to a personal Dropbox, Google Drive, or uploads to a non-allowed website |
| Copy to USB removable media | User inserts a USB drive and copies a sensitive document to it |
| Copy to network share | User copies a file to an unmanaged network file share |
| User sends a sensitive document to any local or network printer | |
| Copy to clipboard | User copies content from a sensitive document to the Windows clipboard |
| Create an item | User saves a newly created document containing sensitive information |
| Rename an item | User renames a file containing sensitive information |
⚠️ Endpoint DLP Requirements
- Devices must be onboarded to Microsoft Defender for Endpoint
- The Microsoft Purview Compliance extension or built-in Windows Purview agent must be active
- Requires Windows 10/11 (Build 1809+) or macOS Catalina or later
- Requires Microsoft 365 E5 Compliance or equivalent add-on
🔔 Policy Tips & User Notifications
Policy tips are in-app notifications shown to users when DLP detects sensitive content as they work. They are the key user-education tool in a DLP programme.
| App | Where Policy Tip Appears |
|---|---|
| Outlook | Yellow notification bar above the message composition window, with the option to override or report false positive |
| Word, Excel, PowerPoint | Information bar at the top of the document when content triggers a DLP rule |
| SharePoint Online | When a user tries to share a document that matches a DLP rule — notification before completing the share |
| Teams | Inline message notification when a user sends a message matching a DLP rule |
PowerShell — DLP Policy Management
# List all DLP policies and their current mode Get-DlpCompliancePolicy | Select-Object Name,Mode,Workload,Enabled # Get detailed rules for a specific DLP policy Get-DlpComplianceRule -Policy 'PCI Credit Card Protection' | Select-Object Name,Priority,Actions # Create a new DLP policy in AuditAndNotify mode New-DlpCompliancePolicy -Name 'UK NI Number Protection' ` -ExchangeLocation All ` -Mode AuditAndNotify # Add a blocking rule to the policy New-DlpComplianceRule -Name 'Block external NI sharing' ` -Policy 'UK NI Number Protection' ` -ContentContainsSensitiveInformation @{Name='UK National Insurance Number';minCount=1;minConfidence=75} ` -ContentIsShared ShareWithExternalUsersOnly ` -BlockAccess $true # Promote policy from AuditAndNotify to full enforcement Set-DlpCompliancePolicy -Identity 'UK NI Number Protection' -Mode Enable
💡 Best Practices
- Always deploy new DLP policies in simulation mode first — review matches in Activity Explorer and the DLP policy matches report for 2–4 weeks before enforcing blocks
- Use “Block with override” rather than hard “Block” for initial enforcement — it trains users and provides business justification audit trails without completely disrupting legitimate workflows
- Target Endpoint DLP on USB and cloud service upload activities first — these are the highest-risk exfiltration paths
- Configure incident reports to a compliance DL (not individual email) for DLP alerts — this ensures continuity even when team members change
🎓 Interview Q&A
Q: Users are being blocked from sending legitimate HR documents containing employee NI numbers to an HR outsourcing provider. The DLP policy is working correctly for external threats but is disrupting valid business processes. What are the recommended solutions?
Option 1 — Exception rule for the HR outsourcing domain: Add a rule exception in the DLP policy that excludes messages sent to the HR provider’s email domain from the blocking rule. This creates a safe path for the specific business relationship without disabling the broader protection.
Option 2 — Change action to “Block with override”: Change the DLP action from “Block” to “Block with override” for messages with NI numbers. HR staff can then override the block for legitimate use cases by providing a business justification, which is logged in the audit trail.
The recommended approach is typically Option 1 (domain exception) for trusted business partners — it’s precise and doesn’t require user action.
🎯 SC-400 Mock Test
Module 4 — Data Loss Prevention
5 questions · Scenario-based · Pass mark: 70%
Q1 of 5
A DLP policy is deployed to Teams locations to prevent sharing of credit card numbers. A user reports they can still send a Word document containing credit card numbers in a Teams message. What is the most likely explanation?
ATeams DLP does not support credit card detection
BThe DLP policy mode is set to Audit — it logs the event but does not block the user from sending
CThe credit card number confidence is set too high
DTeams DLP only applies to message text content — the Word file is an attachment stored in SharePoint/OneDrive, which requires a separate DLP policy for those locations
✅ D. Teams chat/channel message DLP only scans the message body text. File attachments sent in Teams are stored in SharePoint (for channel messages) or OneDrive (for chat messages) — they are covered by SharePoint/OneDrive DLP rules, NOT Teams DLP. To protect files shared in Teams, you need a separate DLP policy scoped to SharePoint Online and OneDrive accounts.
Q2 of 5
Which TWO prerequisites are required to enable Endpoint DLP on a Windows 11 device?
ADevice must be onboarded to Microsoft Defender for Endpoint AND the device must be Microsoft Entra ID joined or hybrid joined
BDevice must be running Windows Defender Antivirus AND have a Microsoft 365 E3 licence assigned to the user
CDevice must be enrolled in Intune AND the Azure Information Protection client must be installed
DDevice must have the Purview Information Protection scanner installed AND be in a hybrid Azure AD join configuration
✅ A. Endpoint DLP requires: (1) the device is onboarded to Microsoft Defender for Endpoint (this deploys the Purview DLP sensor), and (2) the device must be Entra ID joined, hybrid Entra ID joined, or Entra ID registered. Intune enrolment alone is not sufficient — Defender for Endpoint onboarding is the key requirement.
Q3 of 5
A DLP policy with two rules is configured: Rule 1 (priority 1) blocks messages with 5+ credit card numbers; Rule 2 (priority 2) shows a policy tip for 1+ credit card numbers. An email with 7 credit card numbers is sent. What happens?
ABoth rules match and both actions apply — the user sees a policy tip AND the email is blocked
BThe lowest priority rule applies first — the user sees a policy tip (Rule 2), and the email is sent
CRule 1 (highest priority — lowest priority number) is evaluated first and matches (7 ≥ 5) — the email is blocked. Rule 2 is not evaluated.
DNeither rule applies because both conditions must be true simultaneously
✅ C. DLP rules are evaluated in priority order — Rule 1 (priority 1 = highest) is checked first. Since 7 ≥ 5, Rule 1 matches and the block action is applied. Processing stops — Rule 2 is never evaluated. This is the intended design: you set high-impact actions in high-priority rules and lower-impact actions in lower-priority rules for smaller counts.
Q4 of 5
A compliance team wants to see all DLP policy matches across Exchange, SharePoint, and Teams in the past 30 days sorted by policy name. Which tool provides this?
ACompliance Manager → Improvement actions → DLP section
BData loss prevention → Reports → DLP policy matches (or Activity Explorer filtered by “DLP rule matched”)
CAudit → Search → filter by operation “DLP policy triggered”
DContent Explorer → filter by DLP matched items
✅ B. The DLP section in the compliance portal contains a dedicated Reports page showing DLP policy matches, false positives, overrides, and severity breakdowns. Activity Explorer can also be filtered to show “DLP rule matched” events across all locations.
Q5 of 5
You want to prevent users from copying sensitive files (labelled “Highly Confidential”) to USB drives on company laptops, even when the device is not connected to the internet. Which solution should you implement?
ASharePoint DLP policy with a rule to block files labelled “Highly Confidential” from being downloaded
BSensitivity label encryption — encrypted files cannot be read from a USB drive by unauthorised users
CExchange DLP policy with content matching the sensitivity label — blocks email with labelled attachments
DEndpoint DLP policy with a rule that blocks copying of files labelled “Highly Confidential” to removable media — works offline on Defender for Endpoint-onboarded devices
✅ D. Endpoint DLP is the only solution that works at the device level — monitoring and blocking file activities like USB copy even when the device is offline. It can detect sensitivity labels on files and block specific activities. SharePoint DLP (A) only prevents download from SharePoint — not what happens to the file after it’s on the device.
🔒
Locked — Pass Module 3 quiz to unlock this module.