What's the difference between DLP and sensitivity labels in Microsoft Purview?
A sensitivity label classifies content and can apply encryption, markings, and container controls — it's metadata that travels with the file. A DLP policy is a separate rule engine that inspects content and activity (sending, sharing, copying to USB) against a location, a condition, and an action, and a label is one of the conditions DLP can act on. Neither replaces the other: labels classify and protect the content itself, DLP watches what happens to it and can stop a risky action outright.
How they combine
- A DLP policy can trigger on the presence of a specific sensitivity label, not just a detected data pattern — "block external email containing Highly Confidential files" is a labels-as-DLP-condition rule.
- A label alone, without DLP, still marks and protects content but does nothing to stop a risky sharing action; DLP alone, without labels, has to rely purely on content-pattern detection rather than a user's own classification decision.
Rollout order that works
- Publish the label taxonomy in classification-only mode first.
- Build DLP policies in audit-only mode, referencing both content patterns and labels as conditions.
- Move DLP actions up its restriction ladder — audit only, notify, justify, block — once the audit findings are tuned.
Read next
- Microsoft Purview sensitivity labels — a deep dive— How Purview sensitivity labels classify and protect content, how to design a taxonomy that survives contact with users, and the rollout order that works.
- Microsoft Purview Data Loss Prevention — a deep dive— DLP policies detect and prevent sensitive data from leaving Microsoft 365. Here's the architecture and how to roll them out.
- Purview auto-labelling policies— How auto-labelling applies sensitivity and retention labels automatically based on content match — and the operational realities.