Microsoft Purview DLP Policy
Microsoft Purview Data Loss Prevention (DLP) detects and prevents risky sharing, transfer, or
use of sensitive data across Microsoft 365 services and Windows/macOS endpoints - anchored to the
Zero Trust Data pillar.
When to use
Stopping exfiltration of sensitive content (PII, financial, IP, regulated data) across email,
collaboration, and endpoints with a defensible, tunable policy set.
Do not use this skill for risk-adaptive DLP keyed to Insider Risk (use purview-advanced-dlp)
or for Copilot-specific exclusion (use purview-copilot-oversharing).
Pick the right starting policy per workload
| Workload |
Start with |
Notes |
| Exchange Online |
Block external send of high-volume SIT matches |
Policy tips + override + justification |
| SharePoint / OneDrive |
Warn on external sharing of labelled content |
Service-side detection |
| Teams |
Warn on chat/channel post containing SITs |
Applies post-creation only |
| Endpoint (Windows/Mac) |
Audit USB copy, then warn, then block |
Needs onboarded devices + E5 Compliance |
| All |
Simulation mode for 7-14 days first |
No exceptions |
Rule of thumb: one policy per workload, severity-tiered actions, simulation always, exceptions
defined before block.
Approach
- Locations - Choose locations explicitly: Exchange, SharePoint, OneDrive, Teams, and
Endpoint (a single policy does not cover all locations by default). Endpoint DLP requires
onboarded devices and E5 Compliance.
Verify: each policy lists only the locations it intends to cover; Endpoint shows onboarded device count > 0.
- Conditions - Match on SITs, sensitivity labels, trainable classifiers, and content
volume thresholds (e.g., 5+ credit-card numbers); combine for precision.
Verify: a test document matches the rule with expected confidence and volume.
- Actions by severity - Low = audit only; Medium = warn with override + justification;
High = block + notify. Configure policy tips and incident reports.
Verify: each severity branch fires the intended action in a test event.
- Simulation first - Run in simulation mode (7-14 days), review matches in Activity
Explorer, tune false positives, then promote to enforcement.
Verify: simulation report shows match volume and false-positive rate within target before enforcement.
- Exceptions - Define trusted recipients/domains and business-justification overrides so
legitimate processes aren't blocked.
Verify: documented exception list reviewed by data owner; override workflow tested.
- Endpoint DLP onboarding - Onboard devices via Defender for Endpoint or Intune, confirm
policy reaches them, and start in audit before warn/block.
Verify: endpoint policy status shows successful sync per device.
- Operate - Route incidents to a shared compliance mailbox; review override justifications
weekly; tune monthly.
Verify: incident triage SLA defined and met; tuning log maintained.
Guardrails
- Never enable block without exception handling and a simulation period - blocks without
exceptions produce business escalations in hours.
- DLP precedence: policies evaluate in priority order; the most restrictive action wins -
document priorities and review when adding new policies.
- Complete data classification first - DLP without classification generates excessive noise
and tunes-out the team.
- Teams DLP applies only to messages posted after the policy is created (not retroactive) -
set expectations accordingly.
- Endpoint DLP needs onboarded devices and E5 Compliance per user - confirm licensing before
designing the policy.
Common anti-patterns
- Single tenant-wide policy covering all locations with the same conditions - either too noisy
or too narrow somewhere.
- Skipping simulation "because it's an obvious rule" - then breaking finance month-end.
- No exception path - business overrides the policy by emailing files to personal accounts.
- Block actions on day one of Endpoint DLP - users disable the agent in protest.
- Reviewing matches monthly instead of weekly - false positives bloom unchecked.
Example prompts
Help me build a Purview DLP policy to protect financial data in Exchange and SharePoint.How do I configure Endpoint DLP to block USB copy of sensitive files?What DLP simulation mode steps should I follow before enforcing a new policy?Design a DLP policy for GDPR that covers personal data across Microsoft 365.How do I tune a DLP rule to reduce false positives on credit card numbers using volume thresholds and Activity Explorer matches?
Microsoft Learn
1---2name: purview-dlp-policy3description: Guidance for designing baseline Microsoft Purview Data Loss Prevention (DLP) policies across Exchange, SharePoint, OneDrive, Teams, and Endpoint. Covers locations, conditions (SITs/labels/classifiers), severity-tiered actions, simulation mode, exception handling, Endpoint DLP onboarding, and tuning. WHEN: Purview DLP, data loss prevention policy, prevent data exfiltration, Endpoint DLP, DLP rule conditions, DLP simulation mode, block sensitive sharing, policy tips, DLP across Microsoft 365, tune DLP false positives.4license: MIT5---67# Microsoft Purview DLP Policy89Microsoft Purview Data Loss Prevention (DLP) detects and prevents risky sharing, transfer, or10use of sensitive data across Microsoft 365 services and Windows/macOS endpoints - anchored to the11Zero Trust **Data** pillar.1213## When to use14Stopping exfiltration of sensitive content (PII, financial, IP, regulated data) across email,15collaboration, and endpoints with a defensible, tunable policy set.1617Do not use this skill for risk-adaptive DLP keyed to Insider Risk (use `purview-advanced-dlp`)18or for Copilot-specific exclusion (use `purview-copilot-oversharing`).1920## Pick the right starting policy per workload21| Workload | Start with | Notes |22|---|---|---|23| Exchange Online | Block external send of high-volume SIT matches | Policy tips + override + justification |24| SharePoint / OneDrive | Warn on external sharing of labelled content | Service-side detection |25| Teams | Warn on chat/channel post containing SITs | Applies post-creation only |26| Endpoint (Windows/Mac) | Audit USB copy, then warn, then block | Needs onboarded devices + E5 Compliance |27| All | Simulation mode for 7-14 days first | No exceptions |2829Rule of thumb: one policy per workload, severity-tiered actions, simulation always, exceptions30defined before block.3132## Approach331. **Locations** - Choose locations explicitly: Exchange, SharePoint, OneDrive, Teams, and34 **Endpoint** (a single policy does not cover all locations by default). Endpoint DLP requires35 onboarded devices and E5 Compliance.36 *Verify: each policy lists only the locations it intends to cover; Endpoint shows onboarded device count > 0.*372. **Conditions** - Match on **SITs**, **sensitivity labels**, trainable classifiers, and content38 volume thresholds (e.g., 5+ credit-card numbers); combine for precision.39 *Verify: a test document matches the rule with expected confidence and volume.*403. **Actions by severity** - Low = audit only; Medium = warn with override + justification;41 High = block + notify. Configure policy tips and incident reports.42 *Verify: each severity branch fires the intended action in a test event.*434. **Simulation first** - Run in **simulation mode** (7-14 days), review matches in Activity44 Explorer, tune false positives, then promote to enforcement.45 *Verify: simulation report shows match volume and false-positive rate within target before enforcement.*465. **Exceptions** - Define trusted recipients/domains and business-justification overrides so47 legitimate processes aren't blocked.48 *Verify: documented exception list reviewed by data owner; override workflow tested.*496. **Endpoint DLP onboarding** - Onboard devices via Defender for Endpoint or Intune, confirm50 policy reaches them, and start in audit before warn/block.51 *Verify: endpoint policy status shows successful sync per device.*527. **Operate** - Route incidents to a shared compliance mailbox; review override justifications53 weekly; tune monthly.54 *Verify: incident triage SLA defined and met; tuning log maintained.*5556## Guardrails57- Never enable **block** without exception handling and a simulation period - blocks without58 exceptions produce business escalations in hours.59- DLP precedence: policies evaluate in priority order; the most restrictive action wins -60 document priorities and review when adding new policies.61- Complete data classification first - DLP without classification generates excessive noise62 and tunes-out the team.63- Teams DLP applies only to messages posted **after** the policy is created (not retroactive) -64 set expectations accordingly.65- Endpoint DLP needs onboarded devices and E5 Compliance per user - confirm licensing before66 designing the policy.6768## Common anti-patterns69- Single tenant-wide policy covering all locations with the same conditions - either too noisy70 or too narrow somewhere.71- Skipping simulation "because it's an obvious rule" - then breaking finance month-end.72- No exception path - business overrides the policy by emailing files to personal accounts.73- Block actions on day one of Endpoint DLP - users disable the agent in protest.74- Reviewing matches monthly instead of weekly - false positives bloom unchecked.7576## Example prompts77- `Help me build a Purview DLP policy to protect financial data in Exchange and SharePoint.`78- `How do I configure Endpoint DLP to block USB copy of sensitive files?`79- `What DLP simulation mode steps should I follow before enforcing a new policy?`80- `Design a DLP policy for GDPR that covers personal data across Microsoft 365.`81- `How do I tune a DLP rule to reduce false positives on credit card numbers using volume thresholds and Activity Explorer matches?`8283## Microsoft Learn84- Create & deploy a DLP policy: https://learn.microsoft.com/purview/dlp-create-deploy-policy85- Endpoint DLP: https://learn.microsoft.com/purview/endpoint-dlp-learn-about86- DLP policy reference: https://learn.microsoft.com/purview/dlp-policy-reference87- Test DLP policies (simulation): https://learn.microsoft.com/purview/dlp-test-dlp-policies88- Activity Explorer: https://learn.microsoft.com/purview/data-classification-activity-explorer89- DLP for Microsoft Teams: https://learn.microsoft.com/purview/dlp-microsoft-teams
vinayaklatthe