4.1MS-102Intermediate
Est: ~15 mins•Verified: 2026-08

Purview Data Loss Prevention (DLP): Credit Cards & PII

Design and implement Microsoft Purview Data Loss Prevention (DLP) policies to detect, restrict, and block sensitive financial, healthcare, and PII data.

Tags:#Purview#DLP#Data Loss Prevention#Compliance#Encryption#MS-102
01

Overview

Microsoft Purview Data Loss Prevention (DLP) identifies, monitors, and automatically protects sensitive information across Microsoft 365 services—including Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, and Windows/macOS Endpoints.

The engine operates using:

  1. Sensitive Information Types (SITs): Built-in and custom pattern matchers based on regular expressions, checksum algorithms, and keyword proximity (e.g., Credit Card Numbers, US/EU Social Security Numbers, Passports).
  2. Policy Tips: Real-time user educational banners in Outlook, Word, Excel, and Teams informing users that their content violates corporate policy before they click send.
  3. Automated Enforcement: Blocks external sharing, restricts access to files, applies encryption, and notifies compliance officers of critical policy violations.

---

02

When to Use: Core Policy Archetypes

Target Data TypeWorkloadAction / Enforcement
Credit Card Numbers / Financial InfoExchange Online & TeamsBlock external recipients; show policy tip with business justification override.
Personally Identifiable Information (PII)OneDrive & SharePointRestrict external sharing; permit internal collaboration.
Source Code / Confidential IPWindows Endpoints (Endpoint DLP)Block copying to USB drives, unapproved cloud browsers, or network shares.

---

03

Prerequisites

Licensing:

  • Microsoft 365 E5 or Microsoft 365 E5 Compliance (for full multi-workload and Endpoint DLP).
  • Microsoft 365 E3 (includes basic DLP for Exchange, SharePoint, and OneDrive).

Administrative Roles:

  • Compliance Administrator or DLP Compliance Management role in the Microsoft Purview portal (purview.microsoft.com).

---

04

Portal Path

TEXT
Microsoft Purview Portal (https://purview.microsoft.com)
└── Data loss prevention
    ├── Policies (Create, edit, manage state: Test / Turn on)
    ├── Alerts (Investigate active high-volume leak alerts)
    └── Classifiers
        └── Sensitive info types (View built-in SIT definitions)

---

05

Step-by-Step Implementation

Step 1: Create a Financial Data DLP Policy

  1. Sign in to Microsoft Purview portal (purview.microsoft.com) > Data loss prevention > Policies.
  2. Click Create policy.
  3. Choose category: Financial > Template: U.S. Financial Data (or Financial Data containing Credit Card Number, ABA Routing, and Account Numbers).
  4. Name: DLP-FinancialData-Protect-External.

Step 2: Select Locations & Workloads

Under Locations, toggle on:

  • Exchange email
  • SharePoint sites
  • OneDrive accounts
  • Teams chat and channel messages
  • Devices (Endpoint DLP)

Step 3: Define Policy Rules (Low vs High Volume)

  1. Configure High volume of content detected (10 or more instances):
  • Condition: Content contains Credit Card Number (Count: 10 to Any).
  • Recipient condition: Recipient is located External to the organization.
  • Action: Block people from sharing and restrict access to shared content > Select Block everyone.
  • User notifications: Check Notify users in Office 365 service with a policy tip.
  • User overrides: Do not allow overrides (High volume indicates bulk data exfiltration).
  • Incident reports: Send high-severity alert to compliance mailbox (compliance-alerts@contoso.com).
  1. Configure Low volume rule (1 to 9 instances):
  • Allow user override with Business justification required.

Step 4: Staging Mode (Test with Notifications)

  1. Under Policy mode, select Run the policy in simulation mode > Check Show policy tips while in simulation mode.
  2. Run in simulation for 14 days to observe legitimate business workflows before switching policy to Turn it on immediately.

---

06

PowerShell Automation

Connect to Security & Compliance PowerShell:

PowerShell
Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Query all Purview DLP policies and their operational states
Get-DlpCompliancePolicy | Select-Object Name, Mode, Workload, Enabled

# Inspect individual DLP rules and sensitive information types
Get-DlpComplianceRule -Policy "DLP-FinancialData-Protect-External" | 
    Select-Object Name, Comment, BlockAccess, Severity

---

07

Microsoft Graph Automation

Query DLP Incident Alerts via Microsoft Graph:

PowerShell
Connect-MgGraph -Scopes "SecurityAlert.Read.All"

# List active high-severity DLP alerts generated across all workloads
Get-MgSecurityAlert_v2 -Filter "category eq 'DataLossPrevention'" -Top 5 | 
    Select-Object id, title, severity, status, createdDateTime

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
Creating an email in Outlook containing test credit card numbers displays a yellow Policy Tip banner.
Attempting to send credit cards to an external email address is rejected with a Non-Delivery Report (NDR).
Sharing a OneDrive file containing credit cards to an external user revokes sharing link automatically.
In Microsoft Teams, typing a credit card in external chat instantly blocks message with *"This message was blocked by policy"*.
High-volume leaks generate an immediate incident in Purview Alerts.
09

Diagnostic Logs & Channels

Tool / LocationPathPurpose
Purview Activity ExplorerData loss prevention > Activity explorerGranular audit trail capturing every DLP match, file copy, print event, and email send.
DLP Alerts DashboardData loss prevention > AlertsIncident triage portal displaying user, matched SIT, confidence level, and surrounding text metadata.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
Policy tip not showing in OutlookOutlook desktop cached old policy; policy propagation takes up to 24 hours.Force policy sync by restarting Outlook or test via Outlook on the Web (OWA).
False positive on 16-digit order numbersNumber matched credit card regex but lacked checksum validation.Increase Confidence level in the SIT to High (requires Luhn checksum validation).
Endpoint DLP blocks local copyingDevice was targeted by device policy without excluding approved software paths.Configure Endpoint DLP settings in Purview to exclude approved enterprise tools.

---

11

Production Best Practices

Production Best Practice

Always Start in Simulation Mode:

Deploying a DLP policy directly in "Enforce / Block" mode on day one can halt critical business operations. Always run in Simulation Mode with Policy Tips for 2–3 weeks to educate users and identify legitimate business processes that require overrides.

---

12

MS-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. DLP Workloads: Microsoft Purview DLP covers Exchange, SharePoint, OneDrive, Teams, Windows/macOS endpoints, PowerBI, and non-Microsoft cloud apps via Defender for Cloud Apps.
  2. Luhn Algorithm: Credit card sensitive info types validate using the Luhn checksum algorithm; random 16-digit numbers will fail validation if confidence is set to High.
  3. Policy Precedence: When multiple rules match in a single DLP policy, the rule with the most restrictive action or highest priority takes precedence.

---

13

Official Documentation

PREVIOUS TOPIC3.3 Defender XDR: Incident Correlation, AIR & Advanced HuntingNEXT TOPIC4.2 Purview Sensitivity Labels & Rights Encryption