Microsoft Purview Data Loss Prevention applies policies to Exchange, SharePoint, OneDrive, Teams and Office apps. Policies contain rules with conditions and actions. Simulation mode tests a policy before enforcement. Policies take effect about an hour after activation. Email scanning includes new messages only.
Microsoft documents data loss prevention under the name Microsoft Purview. This feature protects sensitive items like credit card numbers and health records from sharing with the wrong people.
Facts follow the Microsoft Learn page Learn about data loss prevention. Planning steps appear in the DLP deployment strategy guide. This guide explains how the policies work.
What is Data Loss Prevention in Microsoft 365?
Microsoft defines data loss prevention as preventing users from inappropriately sharing sensitive data with people who should not have it. Administrators define DLP policies that identify, monitor and automatically protect sensitive information.
Microsoft states that DLP uses deep content analysis and not a plain text scan. Analysis includes keyword matches, regular expressions, internal function validation, secondary matches near the primary match and machine learning.
Which Locations does DLP Protect?
| Location | Policy scope can include or exclude |
|---|---|
| Exchange email | Distribution groups |
| SharePoint sites | Sites |
| OneDrive accounts | Accounts or distribution groups |
| Teams chat and channel messages | Accounts or distribution groups |
| Windows 10, Windows 11 and macOS devices | Users, groups and device groups |
| On-premises repositories | Repository file paths |
Microsoft also lists Word, Excel and PowerPoint, Fabric and Power BI workspaces and several non-Microsoft cloud apps, some in preview. On-premises repositories need the Microsoft Purview Information Protection scanner.
How do DLP Policies Decide on Actions?
Every policy needs five decisions. Choose what to monitor with a template or a custom policy. Choose administrative scope. Choose locations. Choose conditions. Choose actions.
- Conditions. Examples are an item with a sensitive information type, an item with a sensitivity label or an item shared outside the organization. Microsoft gives the example of 95 Social Security numbers sent to an external recipient.
- Actions. Actions depend on the location. They include a policy tip, a denied action with or without user override and an email notification.
- Rules. Microsoft calls the conditions and actions together a rule.
How to Deploy a Policy Safely?
- Plan the stakeholders, the sensitive categories and the goals.
- Prepare every location. Exchange needs only a policy while on-premises repositories need the scanner.
- Design the policy from your control goals.
- Start in simulation mode. Actions are not applied and the results show the impact.
- Tune the locations, conditions and users from the results.
- Enable enforcement and monitor the alerts.
Microsoft notes that the setting Stop processing more rules does not work in simulation mode. Allow about an hour for a new policy to apply.
Where do You See DLP Activity?
- Audit log. Microsoft 365 records every monitored DLP activity by default.
- Activity explorer. It shows the last 30 days of events like DLPRuleMatch.
- Alerts. Alerts appear in the DLP Alerts dashboard and in the Microsoft Defender portal. Dashboard retention is 30 days and Defender portal retention is six months.
- Reports. PowerShell cmdlets like Get-DlpDetailReport list the detections.
What does Microsoft Not Say?
Microsoft states that email DLP scans new messages and does not scan existing items in mailboxes or archives. SharePoint and OneDrive scan existing items too. Microsoft gives no license requirements on that page. It points to the Microsoft 365 licensing guidance instead.
Older posts describe Office 2016 desktop apps and an Office 365 Security and Compliance Center. Microsoft now documents these features under Microsoft Purview.
Related reading: why a breach plan needs DLP and which regulations shape DLP planning.
Frequently Asked Questions
What is DLP in Office 365?
DLP is the Microsoft Purview feature that identifies, monitors and protects sensitive information with policies. Microsoft now documents it under Microsoft Purview Data Loss Prevention.
Which Services does DLP Protect?
Exchange, SharePoint, OneDrive, Teams and Office apps. Devices and on-premises repositories also appear on the Microsoft list.
Does DLP Scan Old Emails?
No. Microsoft states that email DLP scans new messages and not existing mailbox items.
How Long does a DLP Policy Take to Work?
About an hour after activation, according to Microsoft.
Can You Test a Policy Without Enforcing It?
Yes. Simulation mode applies no actions and shows the impact.
Key Takeaways
- Microsoft Purview Data Loss Prevention protects sensitive data in Microsoft 365 locations.
- Policies contain rules with conditions and actions.
- Simulation mode shows the impact before enforcement.
- New policies need about an hour to apply.
- Email DLP scans new messages only.
Sources and References
Facts follow Microsoft Learn.
- Learn about data loss prevention (Microsoft Learn) learn.microsoft.com