Enforce a DLP policy for sensitive data in Exchange, SharePoint and OneDrive

Description

A Microsoft Purview data loss prevention (DLP) policy is turned on (not in simulation) on the Exchange email, SharePoint sites and OneDrive accounts locations, scoped to all users and sites. Its rules detect at least the sensitive information types in {{ dlp_sensitive_info_types }} and:

• block sharing of matching content with people outside the organization;
• show a policy tip and send an email notification to the user;
• send an incident report or alert to the team that handles DLP events.

Teams chats are covered by CB-M365-DATA-002 and devices by CB-M365-DATA-003.

The list of sensitive information types replaces US identifiers used in other baselines (SSN, ITIN) with French and European ones; add the types that match your sector (health insurance number, tax number). Microsoft 365 E3 covers DLP for Exchange, SharePoint and OneDrive; Teams and endpoints need E5 Compliance.

Rationale

Most data leaks in Microsoft 365 are an email or a sharing link sent to the wrong person, by mistake or on purpose. A DLP policy stops the most damaging categories (bank details, national identifiers, card numbers) before they leave, and the notification teaches users the rule at the moment it applies. GDPR requires appropriate technical measures for personal data; payment card numbers fall under PCI DSS.

Impact

False positives block some legitimate exchanges (for example a supplier's IBAN sent to an external accountant). Run the policy in simulation with notifications for two to four weeks, tune instance counts and confidence levels, and allow users to override with a justification where the business accepts it.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global Reader (or a member of a role group with View-Only DLP Compliance Management).
2. Browse to Solutions > Data Loss Prevention > Policies.
3. Open each policy and check:
   • Status (policy mode) is On, not In simulation or Off;
   • Locations include Exchange email, SharePoint sites and OneDrive accounts, scoped to all users, groups and sites;
   • a rule with the condition Content contains > Sensitive info types lists every type in {{ dlp_sensitive_info_types }}, with the condition Content is shared from Microsoft 365 > with people outside my organization;
   • the action Restrict access or encrypt the content blocks external recipients or external access;
   • User notifications and Policy tips are on, and Incident reports or alerts go to a monitored address.
4. Alternative in Security & Compliance PowerShell: Get-DlpCompliancePolicy | Format-List Name,Mode,ExchangeLocation,SharePointLocation,OneDriveLocation and Get-DlpComplianceRule | Format-List Name,ParentPolicyName,Disabled,ContentContainsSensitiveInformation,AccessScope,BlockAccess,BlockAccessScope,NotifyUser,GenerateIncidentReport.
5. Fail if no policy with Mode = Enable covers the three locations, if a listed type is missing, or if the external sharing is only audited and not blocked, or if users are not notified.

Remediation

1. Sign in to the Microsoft Purview portal as at least a Compliance Administrator (or DLP Compliance Management role).
2. Browse to Solutions > Data Loss Prevention > Policies > Create policy.
3. Choose Enterprise applications & devices or the Custom template, name the policy, for example DLP - Sensitive data external sharing.
4. Select the Exchange email, SharePoint sites and OneDrive accounts locations, all users and sites.
5. Create a rule: Content contains > Sensitive info types with the types in {{ dlp_sensitive_info_types }}; Content is shared from Microsoft 365 > with people outside my organization; action Restrict access or encrypt the content > Block only people outside your organization; turn on User notifications, Policy tips and Incident reports.
6. Save in Run the policy in simulation mode with Show policy tips while in simulation mode, review the matches in Activity explorer for two to four weeks, then set the policy to Turn the policy on immediately.
7. PowerShell alternative: New-DlpCompliancePolicy -ExchangeLocation All -SharePointLocation All -OneDriveLocation All -Mode TestWithNotifications, New-DlpComplianceRule with -ContentContainsSensitiveInformation, -AccessScope NotInOrganization, -BlockAccess $true, -NotifyUser, then Set-DlpCompliancePolicy -Mode Enable.

Rollback

Set the policy back to simulation mode (Set-DlpCompliancePolicy -Mode TestWithNotifications) or turn it off.

References

• Learn about data loss prevention Microsoft, vendor-doc, accessed 2026-10-24
• Create and deploy data loss prevention policies Microsoft, vendor-doc, accessed 2026-10-24
• Sensitive information type entity definitions Microsoft, vendor-doc, accessed 2026-10-24
• Get-DlpCompliancePolicy Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Security Suite baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DATA-002 Enforce a DLP policy for sensitive data in Teams chats and channels
• related CB-M365-DATA-003 Block restricted apps and unallowed Bluetooth apps from sensitive files with endpoint DLP
• related CB-M365-DATA-004 Enforce a DLP policy for Microsoft 365 Copilot
• related CB-M365-COLLAB-003 Restrict SharePoint external sharing to authenticated guests

People and lifecycle