Information Protection and DLP

Information Protection in Microsoft Purview refers to the capabilities that help you discover, classify, protect, and govern sensitive information wherever it lives or travels. Data Loss Prevention (DLP) is a subset of information protection that specifically prevents accidental or intentional sharing of sensitive data outside your organization. Together, they form a layered defense for data at rest, in use, and in transit.

Sensitivity labels are the core of information protection. They are metadata tags that can be applied to documents and emails to classify and protect data. Each label can enforce encryption, visual markings (headers/footers/watermarks), and access restrictions. Labels are published through label policies to users or groups. Users can apply labels manually, or automatic labeling can be configured using conditions like sensitive information types or trainable classifiers.

DLP policies are rules that inspect content for sensitive information and take protective actions. They can be applied to Exchange Online, SharePoint Online, OneDrive for Business, Teams chat and channel messages, and endpoints (Windows 10/11 devices).

- Locations: Where the policy applies (e.g., Exchange email, SharePoint sites, OneDrive accounts, Teams chat and channel messages, devices). - Conditions: Rules that define what sensitive information triggers the policy. Conditions include: - Sensitive info types: Predefined or custom (e.g., U.S. Social Security Number, Credit Card Number, Azure AD client secret). - Sensitivity labels: Triggers when a document with a specific label is shared externally. - Retention labels: Triggers for items with a specific retention label. - Trainable classifiers: Machine learning models that identify content like contracts or resumes. - Actions: What happens when a match occurs: - Block: Blocks the action (e.g., sending email, sharing file) with a policy tip to the user. - Block with override: Allows the user to override the block with a business justification. - Notify: Sends an email notification to the user and/or the administrator. - Incident report: Sends an alert to the compliance portal. - Exceptions: Conditions that exclude content from the policy (e.g., only apply if shared outside the organization). - Policy tips: User notifications that appear in Outlook, SharePoint, OneDrive, Teams, etc.

When a user attempts to share sensitive content, the DLP engine evaluates the content against active policies. For Exchange, this happens during transport. For SharePoint and OneDrive, it happens when a file is shared externally. For endpoints, it happens when a user attempts to copy to USB or upload to a personal cloud service. The evaluation includes scanning for sensitive info types, checking sensitivity labels, and applying conditions. If a match occurs, the configured action is enforced.

While SC-900 does not require command-line knowledge, understanding the portal configuration is key. To create a DLP policy:

To verify, use the DLP reports and alerts in the compliance portal. Test by sending an email with a test SSN to an external address and confirm it is blocked.

This integrated approach ensures data is classified and protected automatically.

A large financial services firm must comply with regulations like GDPR and PCI DSS. They use Microsoft Purview to protect client financial data. They create a sensitivity label 'Highly Confidential - Financial' that encrypts documents and restricts access to the compliance team. Auto-labeling is configured to detect patterns like IBAN numbers and apply the label automatically. A DLP policy blocks sharing of any document with this label outside the organization. In production, they run auto-labeling in simulation mode for two weeks to tune false positives. They also enable endpoint DLP on all Windows 10 devices to prevent copying labeled files to USB drives or personal cloud storage. A common issue is that users accidentally override the DLP block too often, so they configure the override to require a business justification and enable audit logging for overrides.

A healthcare provider uses Microsoft 365 for email and document collaboration. They must protect Protected Health Information (PHI) under HIPAA. They create a custom sensitive information type for medical record numbers. A sensitivity label 'PHI' is applied automatically via auto-labeling. DLP policies are created to block external sharing of any document with the PHI label or containing the custom sensitive info type. The DLP policy also sends an incident report to the security team. They deploy endpoint DLP to prevent printing or copying PHI to unapproved apps. Performance considerations: DLP scanning for sensitive info types can impact SharePoint upload speeds slightly, but the trade-off is acceptable. Misconfiguration example: If the DLP policy is set to block all external sharing, legitimate collaboration with business partners is blocked, so they use exceptions for specific partner domains.

A technology company uses sensitivity labels to classify source code and trade secrets. They use trainable classifiers to detect 'source code' patterns. DLP policies block sharing of source code-labeled documents via Teams chat. They also use Microsoft Defender for Cloud Apps to extend DLP to third-party apps like Salesforce. In production, they have multiple DLP policies for different departments (e.g., engineering vs. HR). Common pitfalls: Overlapping DLP policies can cause conflicts; they use priority ordering. Also, users may complain about false positives from auto-labeling; they use simulation mode extensively before enforcement.