How to create a DLP policy in Microsoft Purview

Creating a DLP policy in Microsoft Purview is a wizard that ends with rules of the form if content in these locations contains this sensitive information at this confidence, then do these things. The practical version: choose the locations, pick the sensitive information types (credit card numbers, national IDs, whatever the data-protection assessment listed), write two rules — a low-volume one that warns, a high-volume one that blocks external sharing — and run the whole thing in simulation mode before it enforces anything.

DLP's architecture, the sensitive information type system, trainable classifiers, and how DLP interacts with sensitivity labels are covered in the Purview DLP deep dive. This page builds one policy well.

Prerequisites

• Compliance Administrator or the DLP Compliance Management role in Purview.
• Licensing per the FAQ; confirm which locations your plan covers.
• A named data-protection owner who has agreed what the policy should catch and what happens on match. DLP without a business owner ends up disabled within a month.
• Decide the policy tip text and the user override rule: can a user override with a business justification (usual for internal sharing) or not (usual for external sharing of high-volume matches)?
• If Teams is in scope: Teams DLP needs the Teams location and applies to chat and channel messages, not files (files follow the SharePoint/OneDrive rules).

Steps

1. Start from a template or custom

Purview portal → Solutions → Data loss prevention → Policies → Create policy. Choose a template if one matches (Financial → PCI Data Security Standard, Privacy → GDPR variants by country) — templates pre-select sensitive information types and give you two rules with sensible thresholds. Choose Custom when the types are specific to you. Name it DLP-PCI-CreditCard-External and describe the intent.

2. Admin units and locations

Skip admin units unless you have delegated compliance per region. Under Locations, enable Exchange email, SharePoint sites, OneDrive accounts, and Teams chat and channel messages. Leave Devices off for the first policy unless Endpoint DLP is already onboarded. Scope to All for each; use includes/excludes later if a department needs a different policy.

3. Define the rules

Choose Create or customize advanced DLP rules and build two:

Rule 1 — Low volume: warn

• Conditions: Content contains → Sensitive info types → Credit Card Number, instance count 1 to 9, confidence High. Add Content is shared from Microsoft 365 → with people outside my organization.
• Actions: none, or Restrict access or encrypt → leave unticked; the point is the tip.
• User notifications: on; policy tip text explaining what was found and why it matters; email notification to the user.
• User overrides: allow, require business justification.
• Incident reports: severity Low; send to the DLP owner; alert every time is noisy — use aggregate with a threshold.

Rule 2 — High volume: block external

• Conditions: same type, instance count 10 or more, High confidence, shared externally.
• Actions: Restrict access or encrypt the content in Microsoft 365 locations → Block everyone for SharePoint/OneDrive; for Exchange, Block users from sending email (or Block only people outside).
• User notifications: on, with tip text that names a contact.
• User overrides: off, or on with justification if the data-protection owner accepts the risk.
• Incident reports: severity High, alert every time, to the DLP owner and security operations.

Order matters: rules are evaluated top-down and the first match with Stop processing more rules wins — put the block rule first.

4. Policy mode: simulation

Choose Run the policy in simulation mode and tick Show policy tips while in simulation mode. Finish. The policy takes up to an hour to distribute and starts logging matches.

5. Read the simulation results

Data loss prevention → Policies → the policy → Simulation results, and Activity explorer filtered on DLP rule matched. For two weeks: which users, which locations, which items. False positives cluster around invoices with long reference numbers, HR files with national IDs where the type is wrong, and test data. Tighten confidence or instance counts, add exception conditions (a specific sender group, a document property) rather than exempting whole users.

6. Turn it on

Edit policy → Policy mode → Turn the policy on immediately. Tell the people who will hit it — with the tip text they will see and who to call.

Verify

• Send an email to an external address with a test card number (Microsoft publishes test values; 4111 1111 1111 1111 passes Luhn) in the body: rule 1 tips appear in Outlook on the web before sending.
• Upload a file with 10+ test numbers to a SharePoint site and share externally: the sharing link is blocked with the rule 2 tip; the DLP owner receives the High alert in Alerts.
• Reports → DLP policy matches shows both rules firing in the expected proportions; the audit log records DlpRuleMatch events for each.

Roll back

Switch the policy back to simulation mode — matches keep logging, nothing blocks — or turn it off. Do not delete it; you lose the tuning. If one rule is the problem, disable just that rule (Edit → Advanced DLP rules → the rule → toggle). Changes propagate within an hour; Exchange mail already held by a block is released only if you also clear the Exchange transport rule the policy generated, which happens automatically on policy mode change.