Data Loss Prevention Policies (DLP) in Microsoft 365

Organizations need to protect all sensitive information and prevent its unintentional or careless disclosure. The sensitive information can be financial data, credit card numbers, social security numbers, health records or any particular data. The organization wants to prevent such information from leaking outside. With Microsoft 365 Security and Compliance Center including the Data Loss Prevention (DLP) policy, one can prevent leakage. It can identify, monitor and protect information across Office 365. We will cover some basics of DLP in Microsoft 365.

What is DLP policy in Office 365?

A data loss prevention (DLP) policy is a practice organizations use and one of Microsoft Purview’s tools. This practice helps organizations to prevent their users from inappropriately sharing their sensitive data which may include data related to their health, credit cards, etc., to unwanted people. With a DLP Policy, you can protect sensitive items to Microsoft 365 services which include SharePoint, OneDrive accounts, Exchange, etc.

DLP helps in the following:

Identifies sensitive information: One can identify any document containing sensitive information such as a credit card number which might be stored in any OneDrive for Business site. This identifying sensitive information can be across SharePoint Online or OneDrive for Business. One can also create a DLP policy in the Exchange admin center and can be applied to emails and other mailbox items.
Prevent accidental sharing: Automatically block access to sensitive documents for everyone except the site administrator, document owner and the person who last modified the content.
Helps to stay compliant without interruptions: One can educate users about DLP policies and help them to remain compliant without blocking their work. DLP policy can send email notifications and show them a policy tip.
Even the Office desktop programs can include these capabilities like SharePoint Online and OneDrive for Business.
DLP reports: To get an idea of how one’s organization is complying with a DLP policy, one can see how many matches each policy and rule has over time.

Where are DLP Policies in Microsoft 365?

When you create a DLP policy, Microsoft Purview Center stores and maintains it. Once stored, the policy syncs to sources such as Word, PowerPoint, other Office desktop programs, Exchange Online, and Microsoft Teams channels.

What does a DLP policy contain?

DLP contains the content location to be protected. That is, where to protect the content. A location such as SharePoint Online, OneDrive for business sites.

A DLP policy can protect sensitive information across Office 365. The information location can be OneDrive for Business or SharePoint Online site.

It also explains when and how to enforce rules to protect content.

Conditions the content must match for the rule to be enforced.
Actions you set the rule to take automatically when the content matching condition is met.

One can use a rule to meet a specific protection requirement, for this use a DLP policy to group together common protection requirements, such as all of the rules needed to comply with a specific regulation.

Setting up DLP policies:

Admins can now easily set up DLP policies for SharePoint Online, OneDrive for Business from the Office 365 compliance center. Admins can get started with existing out-of-the-box templates for a simple set of conditions, actions, and exceptions. For DLP policies for email, one can go to the Exchange admin center.

DLP Policy Tips on OneDrive mobile apps

With more people working and collaborating on mobile devices, it’s become harder to secure an organization’s sensitive data.

To help organizations empower employees to work anywhere, at any time, Microsoft has extended Office 365 DLP Policy Tips to OneDrive mobile apps for Android, iOS, and Universal Windows.

Policy tips are contextual, user-facing notifications that educate people when they’re about to send, share or work with sensitive data. Now available on mobile, they will complement what is already available on the web and Office clients, including Outlook.

A mobile user will see a policy tip for documents that contain sensitive information. The tip, depending on the policies and user action, will provide information about what triggered a policy violation. It will also provide an option to override and submit a false positive report.