Switch a data loss prevention (DLP) policy straight to blocking and you risk stopping legitimate work; leave it in test mode forever and it protects nothing. In this post I'll take a Microsoft Purview DLP policy from template to enforcement: building it, running it in simulation mode with policy tips, tuning it until the matches make sense, adding devices through endpoint DLP, and turning it on in stages.
Prerequisites#
- Permissions. Microsoft lists the Information Protection admin role as the requirement for working with simulation mode.
- Licensing. DLP for Exchange, SharePoint and OneDrive comes with more plans than DLP for Teams chat or devices, so check the Microsoft 365 service descriptions before you choose locations.
- A clear target. Know which sensitive info types or labels represent your data, and who can judge whether a match is real.
- For devices: Windows 10 or 11, or macOS on one of the three latest releases, able to reach the Purview cloud service (through your proxy if you use one).
Step-by-step#
1. Create the policy from a template#
In the Microsoft Purview portal, go to Solutions › Data loss prevention › Policies › Create policy. On What info do you want to protect? choose Enterprise applications & devices, then pick a template category and regulation (for example Privacy › GDPR Enhanced) or Custom policy. After naming the policy and choosing admin units, select locations. Start with Exchange email, SharePoint sites and OneDrive accounts, and add Devices once onboarding is done (step 5).
2. Review the rules before you test#
Choose to customize the advanced DLP rules and read every rule the template created:
- Conditions: Content contains sensitive info types, with confidence level and instance counts, often combined with Content is shared from Microsoft 365 with people outside your organization.
- Actions: Restrict access or encrypt the content in Microsoft 365 locations, blocking everyone or only people outside the organization.
- User notifications and overrides: policy tips in Outlook and Office apps, optionally with an override that requires a business justification.
- Incident reports: a severity level, and whether admins are alerted on every match or only above a volume threshold.
A pattern that works well is a low-volume rule that only notifies plus a high-volume rule that blocks; some templates already split their rules that way.
3. Run it in simulation mode#
On the Policy mode page choose Run the policy in simulation mode. Two checkboxes deserve a decision:
- Show policy tips while in simulation mode lets users see tips without anything being blocked. It's a cheap way to measure reactions, but tell people first.
- Turn the policy on if it's not edited within fifteen days of simulation enforces the policy automatically. Leave it clear on your first policy so nothing goes live unattended.
Exchange, Teams and devices are evaluated in real time as content is sent or moved, so mail only counts if it's sent during the simulation. SharePoint and OneDrive also scan content that already exists; the scan status reaches Completed only when they're the policy's only locations.
4. Review the matches and tune#
Open the policy's simulation results, check matched items per location and rule, and open individual items to see why they matched. Activity explorer shows the underlying DLP rule-match events.
| What you see | Tuning lever |
|---|---|
| Invoice or part numbers matching as card or ID numbers | Require high confidence, raise the minimum instance count, or use a custom info type or exact data match for your own data |
| Legitimate sharing with a known partner | An exception for the partner's domain, or a notify-only rule for that flow |
| A system account or process causing most matches | An exception agreed with the data owner, never a blanket exclusion of a whole location |
| Classification matters more than patterns | Use sensitivity labels as the condition |
| Constant overrides on one rule | Read the justifications; the rule is probably too broad |
After each change, let the simulation gather fresh results before judging it. Check the policy from PowerShell too:
Connect-IPPSSession
Get-DlpCompliancePolicy | Format-Table Name,Mode
Get-DlpCompliancePolicy -Identity "DLP - Customer data" -DistributionDetail |
Format-List Name,Mode,DistributionStatus,DistributionResultsGood looks like DistributionStatus showing Success with no errors in DistributionResults, and Mode showing a test value while the policy is still in simulation.
5. Onboard devices for endpoint DLP#
Go to Settings › Device onboarding › Onboarding, pick a deployment method (Intune, Group Policy, Configuration Manager, a local script for a handful of test devices, or the VDI package) and deploy the package. Windows devices already onboarded to Microsoft Defender for Endpoint share the same onboarding, so they don't need a second package; see onboarding Windows devices with Intune. Onboarded devices appear under Settings › Device onboarding › Devices and start reporting audit activity to Activity explorer.
Then add the Devices location, often in a separate device-focused policy, and choose Audit only, Block with override or Block for activities such as copying to USB storage or network shares, copying to the clipboard, printing and uploading to cloud services. If you scope a device policy by users and devices together, explicitly exclude those that don't meet the requirements to avoid unintended enforcement.
6. Enforce in stages#
When the data owners agree with the matches, edit the policy and change Policy mode to turn it on. Enforce notify-only rules first, then Block with override on high-volume rules, and full blocking only where the business has signed off. Send alerts to the team that will act on them, and review them on the DLP Alerts page or in the Microsoft Defender portal.
Verify#
- From a pilot account, email dummy data that matches your rule to an external test mailbox: the policy tip appears while you compose, and the configured action applies on send.
- Share a matching test file from a test SharePoint site with an external user: access is restricted as configured.
- On an onboarded Windows device, copy a matching test file to a USB drive: the user sees a notification and the configured action applies.
- Activity explorer shows the rule-match events, high-severity rules raise alerts, and
Get-DlpCompliancePolicyshowsModeasEnable.
Tips and gotchas#
- Simulation isn't invisible when tips are on. Users see them, so announce the pilot.
- One purpose per rule. Rules that mix unrelated info types are hard to tune and hard to explain.
- VDI quirk: USB storage in virtual desktops is treated as a network share, so include the copy-to-network-share activity.
- DLP isn't device control. To block USB storage outright, use Defender device control; endpoint DLP is content-aware.
- Labels make DLP sharper. See rolling out sensitivity labels.
