17.1 DLP Policies for Microsoft 365 Workloads

Microsoft Purview Data Loss Prevention (DLP) is a compliance feature that identifies sensitive information across Microsoft 365 services and enforces rules that prevent it from being shared inappropriately. For the MS-102 administrator, DLP is a central Domain 4 skill: you must be able to configure policies that span Exchange Online, SharePoint Online, OneDrive for Business, Teams chat and channel messages, Power BI, and Microsoft 365 Copilot prompts and responses.

What DLP Protects

DLP policies scan content for sensitive information types (SITs) — built-in classifiers like U.S. Social Security Number, credit card number, or EU debit card number — and for sensitivity labels (such as Confidential or Highly Confidential) that you publish through Purview Information Protection. When a policy's conditions are met, the configured action fires: audit the event, show a policy tip, block the action, or block with a user override.

The supported workload locations for Microsoft 365 DLP are:

---

Creating a DLP Policy in the Purview Compliance Portal

Author policies in the Microsoft Purview compliance portal under Data loss prevention → Policies → + Create policy. The wizard walks through five decision points.

Step 1 — Choose a Template or Start Custom

Templates pre-configure SITs and conditions for common regulatory regimes. Frequently used templates include:

• U.S. Financial Data — U.S. PII, U.S. bank account, ABA routing numbers
• HIPAA / U.S. Health Insurance Act — protected health information identifiers
• GDPR / EU General Data Protection Regulation — EU national ID, passport, debit card numbers
• Custom policy — start from scratch when no template fits

Step 2 — Select Workloads / Locations

Choose where the policy applies. You can scope to all instances of a workload or to specific include/exclude lists:

• Exchange Online — all mailboxes, or include/exclude distribution groups
• SharePoint Online — all sites, or include/exclude site URLs
• OneDrive — all accounts, or include/exclude specific users
• Teams chat and channel messages — all users, or include/exclude groups
• Power BI — all workspaces, or include/exclude specific workspaces (Power BI DLP requires the workspace to be in a Premium capacity in supported configurations)
• Microsoft 365 Copilot — prompts and responses, scoped to include/exclude users or groups

A single policy can cover multiple workloads, but each workload has its own configurable action set. For example, the same policy can block sharing a SharePoint file and encrypt a Teams message.

---

Conditions and Matching Logic

DLP conditions decide when a rule fires. A rule can combine:

• Content contains — one or more SITs, sensitivity labels, or keyword dictionaries
• Matching logic — Match any (any one of the listed SITs triggers) or Match all (every listed item must be present)
• Minimum instance count — require at least N occurrences of a SIT before the rule fires (e.g., at least 5 credit card numbers), useful to avoid noise from a single identifier
• SIT confidence level — High / Medium / Low — higher confidence reduces false positives
• Document property / metadata conditions — file size, extension, sensitivity label applied

You can also chain conditions with AND/OR grouping, for example: content contains (SSN OR passport number) AND shared with (external recipients).

---

Actions, Notifications, and Overrides

When a rule matches, the policy can take one of the following actions:

User notifications (policy tips) surface a banner in the M365 app — Outlook, SharePoint, OneDrive, or Teams — telling the user why content was flagged and what to do. A policy tip can include a link to your internal compliance training.

User overrides let a user bypass a block with a stated business justification. The override is captured in the alert and reviewed by compliance officers; override abuse is a common finding in DLP audits.

---

Policy Mode and Precedence

Every policy has a mode:

• Test with policy tips — evaluates and shows tips but does not enforce; recommended first phase
• Test without notifications — evaluates silently; useful for measuring match volume before informing users
• Turn on immediately — enforces from the moment the policy is saved

When multiple policies match the same content, policy precedence applies. Within a single policy, rules are evaluated top-down; the first matching rule wins. Across policies, the more restrictive rule (block) generally prevails over the less restrictive (audit). Scope carefully — include/exclude users, groups, distribution lists, and site URLs to avoid overlap.

---

DLP for Teams, Power BI, and Microsoft 365 Copilot

Teams DLP inspects both 1:1 and group chats plus Teams channel messages. Because Teams content flows through the Exchange transport pipeline for compliance, Teams DLP requires Exchange Online mailboxes for all monitored users. Supported actions include blocking the message from being sent and encrypting the message in transit.

Power BI DLP scans datasets for sensitive data that has been modeled into tables. When a SIT is detected in a dataset, the policy can trigger alerts that let administrators remediate by relocating the dataset, applying sensitivity labels, or restricting workspace access.

Microsoft 365 Copilot DLP is the newest workload and is critical for AI governance. Copilot grounds responses in Microsoft 365 content (SharePoint files, emails, Teams chats, and other graph-grounded sources). Copilot DLP inspects both the prompt the user submits and the response Copilot returns, blocking sensitive content from being surfaced in the response or leaked through the prompt. This prevents, for example, a user asking Copilot to summarize a Confidential HR document and having the response exposed in a shared Teams channel.

Real-World Configuration Walkthrough

Suppose Contoso wants to prevent credit card numbers from leaking through Copilot prompts. The administrator:

1. Creates a custom DLP policy scoped to the Microsoft 365 Copilot location
2. Adds a condition: content contains Credit Card Number SIT, min instance count 1, high confidence
3. Sets the action to Block with override and enables a policy tip: "This prompt contains credit card information and has been blocked. Override with a business justification if sharing is approved."
4. Runs the policy in test with policy tips for two weeks, reviews match volume in Activity explorer, then switches to enforce

This is the canonical Microsoft-recommended rollout pattern: test, measure, tune, enforce.

---

Key Takeaways

• DLP policies protect six Microsoft 365 workloads: Exchange Online, SharePoint Online, OneDrive, Teams, Power BI, and Microsoft 365 Copilot prompts/responses
• Conditions combine SITs, sensitivity labels, and keywords with Match any / Match all logic and a minimum instance count
• Actions include audit-only, block with override, block without override, and message encryption in Teams and Exchange
• Start in test with policy tips, measure matches, then enforce — this is the Microsoft-recommended deployment sequence
• Copilot DLP inspects both the user's prompt and Copilot's response, blocking sensitive content from being surfaced through groundings