Microsoft 365 Data Loss Prevention (DLP) is a security feature designed to identify, monitor, and protect sensitive information across Microsoft 365 services like SharePoint Online, OneDrive, Exchange, and Teams. It helps prevent accidental or malicious sharing, leakage, or loss of sensitive data such as personally identifiable information (PII), financial data, or health records by enforcing policies that detect sensitive content and optionally block or restrict its access or sharing.fidelissecurity+2
How DLP Works in M365
- It
uses predefined or custom sensitive information types to scan content in
real-time.
- When
sensitive data is detected, DLP policies can automatically trigger
protective actions like blocking sharing, encrypting content, or alerting
admins.
- DLP
provides reporting and alerts to help manage compliance.
Applying DLP to SharePoint Online using PowerShell
To apply DLP policies to SharePoint Online, you typically
create and manage the policies in Microsoft Purview compliance portal, but you
can use PowerShell to assign existing DLP policies to SharePoint sites.
Here is an example approach using PowerShell with Exchange
Online Management Shell and SharePoint Online:
Step 1: Connect to Exchange Online (required for DLP
cmdlets)
powershell
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com
Step 2: Get list of DLP policies
powershell
Get-DlpPolicy
Step 3: If you need, create a new custom DLP policy
(requires detailed rules normally created via Compliance portal)
Step 4: Apply a DLP policy to SharePoint Online locations
You can assign locations for DLP policies like SharePoint
sites:
powershell
Set-DlpComplianceRule -Identity "YourDLPComplianceRuleName"
-SharePointSites @("https://yourtenant.sharepoint.com/sites/yoursite")
Note: Most DLP policies are managed through the Microsoft
Purview compliance center GUI for policy creation and assignment. PowerShell is
mainly used for policy management or automation like enabling/disabling
policies or updating locations.
Summary
- DLP
in M365 protects sensitive data from leakage by enforcing policies across
SharePoint and other services.
- PowerShell
cmdlets like Get-DlpPolicy and Set-DlpComplianceRule can manage and assign
DLP policies programmatically.
- Creating
and customizing DLP rules is generally done via the Microsoft Purview
compliance center for granular control.
xamples of SharePoint Data Loss Prevention (DLP) policy
rules to block sensitive file sharing typically involve these components:
Example DLP Policy Use Case
- Goal:
Block sharing of sensitive items (e.g., Social Security Numbers, credit
card data, or documents labeled "Confidential") from SharePoint
and OneDrive sites to external users.
- Exceptions:
Do not block sharing for members of HR or specific internal groups.
- Actions:
Block or restrict access, send alerts to security teams, notify users when
sharing is blocked.
Elements of a Typical SharePoint DLP Policy Rule
|
Description |
Configuration in DLP Rule |
|
Users to monitor |
All users, except excluded groups (e.g., Human Resources) |
|
Locations to monitor |
SharePoint sites and OneDrive accounts |
|
Sensitive content types |
US Social Security Number (SSN), Credit Card Number,
Custom sensitivity labels like "Confidential" |
|
Condition 1 |
Content is shared with people outside the organization |
|
Condition 2 |
Content contains specified sensitive info types or
sensitivity labels |
|
Actions |
Block external sharing or restrict access; notify security
team via email alerts |
|
User notification |
Provide policy tips and email alerts informing users of
sharing restrictions |
Scenario Summary
- When
a file containing sensitive data is shared externally, the DLP policy
detects the content based on sensitive information types and the sharing
scope.
- The
policy blocks external access to that file.
- The
user attempting to share receives an alert notification.
- The
security or compliance team is notified by email of the incident for
investigation.
- This
prevents sensitive data from being leaked outside the organization via
SharePoint Online.
How to Customize
- Add
multiple conditions joined by AND/OR for granular control.
- Use
sensitivity labels as content conditions for better integration.
- Configure
incident reports and notifications.
- Define
exceptions carefully to avoid business disruption.
This example is from Microsoft's official guidance on how
DLP policies monitor SharePoint/OneDrive content for sensitive data and block
unauthorized sharing, with alerting for compliance monitoring and user
education.
Specific sensitive information types (SITs) you should
include in your Data Loss Prevention (DLP) rules for SharePoint Online depend
on your organization's compliance needs and data risks, but typically include
the following categories:
Common Sensitive Info Types for DLP Policies
- Personally
Identifiable Information (PII):
- Social
Security Numbers (SSN)
- Passport
numbers
- Driver's
license numbers
- Personal
addresses, phone numbers, email addresses
- Financial
Information:
- Credit
card and debit card numbers
- Bank
account numbers
- Payment
card industry data
- Health
Information (Protected Health Information - PHI):
- Medical
record numbers
- Health
insurance information
- Genetic
or biometric data
- Government
Identifiers:
- Tax
Identification Numbers
- National
ID numbers
- Passport
and visa numbers
- Authentication
Data:
- Passwords
- Account
credentials
- Confidential
Business Data:
- Intellectual
property including trade secrets, patents
- Customer
data and contracts
- Financial
forecasts and business strategies
- Special
Categories Under Regulations (e.g., GDPR Special Category Data):
- Racial
or ethnic origin
- Political
opinions
- Religious
or philosophical beliefs
- Genetic
data and biometric data for ID purposes
- Data
about sexual orientation or sex life
Why Include These?
These data types are frequently targeted for theft or
accidental exposure and have legal and regulatory protections that require you
to monitor and prevent unauthorized sharing or leakage.
How to Use in DLP
- Use
built-in Microsoft 365 sensitive info types for easy policy creation.
- Customize
and combine multiple info types in rules tailored to your organization's
specifics.
- Include
classification labels or tags as additional conditions.
These sensitive info types align with Microsoft Purview's
built-in classifiers designed to detect and protect such information in your
SharePoint Online environment.
