Purview Dlp

---
name: purview-dlp
description: "Expert agent for Microsoft Purview DLP. Covers sensitive info types, trainable classifiers, exact data match, endpoint DLP, M365 policy configuration, Adaptive Protection, Copilot/AI Hub leak prevention, and Activity Explorer. WHEN: \"Purview DLP\", \"M365 DLP\", \"sensitivity labels\", \"trainable classifier\", \"exact data match\", \"endpoint DLP\", \"compliance portal\", \"Activity Explorer\", \"Copilot DLP\", \"MIP\"."
license: MIT
---

# Microsoft Purview DLP

This skill covers Microsoft Purview Data Loss Prevention across the full M365 ecosystem. It covers DLP policy configuration, sensitive information types, trainable classifiers, exact data match (EDM), endpoint DLP, Adaptive Protection integration, and Copilot/AI Hub data leak prevention.

## How to Approach Tasks

1. **Identify the workload** — Exchange, SharePoint, OneDrive, Teams, Endpoints (Windows/macOS), Power BI, Fabric, or Copilot/AI Hub
2. **Classify request type:**
   - **Policy design/configuration** — Load `references/architecture.md`, apply policy guidance
   - **Detection tuning** — Identify the SIT or classifier; tune confidence/count thresholds
   - **Endpoint DLP** — Understand OS and M365 Apps version; apply endpoint-specific guidance
   - **Incident investigation** — Use Activity Explorer and Content Explorer guidance
   - **Copilot/AI protection** — Apply AI Hub and Adaptive Protection guidance
3. **Load context** — Read `references/architecture.md` for deep architecture knowledge
4. **Provide specific guidance** — Include portal navigation paths, PowerShell commands, or API calls as appropriate

## Core Expertise

### Sensitive Information Types (SITs)

Purview includes 300+ built-in SITs. Each SIT has:
- **Pattern**: Regex + keyword proximity + checksum validators
- **Confidence levels**: Low (65%), Medium (75%), High (85%)
- **Supporting evidence**: Keywords that boost confidence when near the primary match

**Key built-in SITs:**

| SIT Name | Description | Key Validator |
|---|---|---|
| U.S. Social Security Number (SSN) | 9-digit SSN | Format + keyword proximity |
| Credit Card Number | Visa, MC, Amex, Discover | Luhn algorithm |
| U.S. / U.K. Passport Number | Passport identifiers | Format + keyword |
| U.S. Bank Account Number | Bank routing + account | ABA routing checksum |
| SWIFT Code | Bank SWIFT/BIC code | Format validation |
| U.S. Individual Taxpayer ID | ITIN | Format check |
| Azure SAS Token | Azure storage SAS | Pattern match |
| Azure Connection String | Connection strings with keys | Pattern match |
| All Full Names | Named entity SIT — ML-based | Neural model |
| All Medical Terms | Named entity SIT — ML-based | Neural model |

**Named Entity SITs** (ML-based, require enhanced protection):
- All Full Names, All Physical Addresses, All Medical Terms and Conditions
- Higher accuracy for complex entities; higher compute cost
- Require Enhanced classification to be enabled in settings

**Creating custom SITs:**
1. Compliance portal → Data classification → Sensitive info types → Create
2. Define primary element: regex, keyword list, dictionary, or function
3. Add supporting elements (boosters) within character proximity
4. Set confidence levels (Low/Medium/High) per combination
5. Test with test samples before production deployment

**Tuning SIT confidence:**
```
When to lower confidence threshold:
  → Catching too few true positives (missing real sensitive data)
  → High-value data where FP is acceptable cost

When to raise confidence threshold:
  → Too many false positives disrupting users
  → Well-defined data type with reliable validators

Minimum count tuning:
  → Set min_count > 1 for data types that appear in bulk (credit card processing = 100+ cards acceptable)
  → Set min_count = 1 for SSN (even 1 SSN in an outbound email is a risk)
```

### Trainable Classifiers

ML models trained on document corpora. Used when content cannot be described with regex patterns.

**Built-in trainable classifiers:**

| Classifier | Use Case |
|---|---|
| Financial documents | Bank statements, financial reports, account summaries |
| Tax documents | W-2, 1099, Schedule forms |
| Source code | Code files across multiple languages |
| HR documents | Performance reviews, offer letters, resumes |
| Legal affairs | Contracts, agreements, privilege documents |
| Medical / Health | Clinical documentation, discharge summaries |
| Project documents | Project plans, status reports |
| Customer complaints | Customer service communications |

**Classifier accuracy considerations:**
- Classifiers have inherent FP/FN rates; always test before enforcing
- Review simulation mode results for 2-4 weeks minimum
- Classifiers may need retraining if your document corpus differs significantly from Microsoft's training data
- Custom trainable classifiers: provide 50+ positive seed documents + 200+ negative examples

**Creating a custom trainable classifier:**
1. Compliance portal → Data classification → Trainable classifiers → Create custom classifier
2. Upload positive seed content (SharePoint library, 50-500 documents)
3. Wait for initial training (24-48 hours)
4. Test with 100+ additional samples; review prediction quality
5. Publish when precision/recall is acceptable
6. Add to DLP policy conditions

### Exact Data Match (EDM)

EDM fingerprints actual records from a sensitive data source (HR database, customer PII list). Only fires when actual data values appear, not just patterns.

**EDM Setup Workflow:**
```
1. Define Schema
   → Compliance portal → EDM → Create EDM schema
   → Define fields: First Name, Last Name, SSN, Date of Birth, etc.
   → Mark fields as searchable (indexed) vs. non-searchable

2. Hash and Upload Data
   → Export data as pipe-delimited .csv (no headers if schema defines them)
   → Use EDM Upload Agent tool:
       EdmUploadAgent.exe /hashonly /dataStoreName <name> /dataFile data.csv /hashLocation hashes/
   → Upload hashes (not source data) to the service:
       EdmUploadAgent.exe /upload /dataStoreName <name> /hashLocation hashes/

3. Create EDM SIT
   → Data classification → Sensitive info types → Create EDM-based SIT
   → Reference the schema; define match element (primary field)
   → Configure additional match (require 2+ fields to match = lower FP)

4. Use EDM SIT in DLP Policy
   → Add EDM SIT as a condition in DLP policy
   → Recommended: require match + corroborating evidence (additional fields)
```

**EDM refresh automation:**
```powershell
# Schedule via Task Scheduler - run on the system with EDM Upload Agent
$action = New-ScheduledTaskAction -Execute "EdmUploadAgent.exe" `
    -Argument "/hashonly /dataStoreName EmployeePII /dataFile C:\edm\employees.csv /hashLocation C:\edm\hashes"

$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 2am

Register-ScheduledTask -TaskName "EDM-Weekly-Refresh" -Action $action -Trigger $trigger
```

### DLP Policy Configuration

**Policy locations available:**

| Location | What It Covers |
|---|---|
| Exchange email | Outbound email (SMTP); email attachments |
| SharePoint sites | Files stored in SharePoint; sharing events |
| OneDrive accounts | Personal OneDrive files; external sharing |
| Teams chat and channel messages | Teams messages; file shares in Teams |
| Endpoint devices | Windows 10/11, macOS endpoints (requires onboarding) |
| Microsoft Fabric and Power BI | Power BI reports, Fabric workspaces |
| Microsoft 365 Copilot (AI Hub) | Copilot prompts and responses |
| On-premises repositories | File shares, SharePoint on-prem (requires scanner) |
| Third-party apps | Via Defender for Cloud Apps (CASB) integration |

**Policy creation via Compliance Portal:**
```
Microsoft Purview compliance portal (compliance.microsoft.com)
→ Data loss prevention
→ Policies
→ + Create policy

Steps:
1. Choose template or custom
2. Name and describe policy
3. Select locations (workloads)
4. Configure conditions (SITs, classifiers, EDM, labels)
5. Configure actions (notify user, block, encrypt, restrict access)
6. Set policy mode: Simulation → Active
7. Review and create
```

**Policy conditions examples:**
```
Condition: Content contains any of these sensitive info types
  → Credit Card Number [High confidence] [min count: 1]
  → U.S. Social Security Number [Medium confidence] [min count: 1]

Condition: Content is shared with people outside my organization

Condition: Sensitivity label is "Highly Confidential"
  → Combines label-based protection with content inspection

Condition: From domain is NOT in [approved-partner.com, trusted-vendor.com]
  → Allows known partners while blocking unknown external recipients
```

**Policy actions:**
```
For Exchange (email):
  → Block sending the message
  → Block sending but allow override with justification
  → Send notification to user
  → Generate incident report (send to security team)
  → Encrypt the email (apply OME)
  → Restrict access (sender only / specified people)

For SharePoint/OneDrive:
  → Block access to the content
  → Block people from sharing
  → Notify the user
  → Generate incident report

For Endpoint:
  → Audit (log only)
  → Block with override
  → Block
  → Per activity: restrict to allowed apps, allowed printers, allowed domains
```

### Endpoint DLP

Endpoint DLP extends DLP enforcement to Windows 10/11 and macOS devices managed by Intune or onboarded to Defender for Endpoint.

**Onboarding endpoints:**
```
Option 1: Intune (MDM)
  → Intune admin center → Endpoint security → Microsoft Purview DLP onboarding

Option 2: Defender for Endpoint
  → Defender portal → Settings → Endpoints → Onboarding
  → Same onboarding package enables Endpoint DLP

Option 3: SCCM/Group Policy (legacy)
  → Deploy onboarding script via SCCM or GPO
```

**Endpoint DLP activities monitored:**

| Activity | Description | Can Block |
|---|---|---|
| Upload to cloud | Uploading files to web via browser | Yes (per domain) |
| Copy to USB / removable media | Copying files to USB drives | Yes |
| Copy to network share | Copying to UNC paths | Yes |
| Print | Printing files to any printer | Yes (per printer group) |
| Copy to clipboard | Copying content to clipboard | Yes (per app) |
| Copy to unallowed app | Moving data to unauthorized apps | Yes (per app group) |
| Remote desktop | Copying files via RDP clipboard | Yes |
| Screen capture | Taking screenshots (macOS) | Limited |

**Sensitive app groups and domain groups:**
```
Browser allowed domains:
  → Settings → Endpoint DLP settings → Browser and domain restrictions
  → Add allowed upload domains (e.g., company SharePoint, approved vendors)
  → Block uploads to all other domains for sensitive content

Unallowed app groups:
  → Define which apps are "unallowed" (personal email apps, personal cloud sync clients)
  → DLP will block copy/paste of sensitive data into these apps

Printer groups:
  → Define approved printers (office fleet) vs. unallowed printers
  → Block printing sensitive data to personal home printers or unknown printers
```

**macOS Endpoint DLP requirements:**
- macOS 11 (Big Sur) or later
- Microsoft Purview compliance extension for Safari, Chrome, Firefox
- Full Disk Access permission granted to Microsoft Defender
- Intune or JAMF enrollment required

### Adaptive Protection

Adaptive Protection integrates Insider Risk Management (IRM) risk scores with DLP enforcement. Higher-risk users automatically receive stricter DLP policies.

**How it works:**
```
1. Insider Risk Management assigns risk levels to users:
   Risk Level: Elevated → High → Severe (based on IRM policy triggers)

2. Adaptive Protection creates dynamic DLP policy conditions:
   IF user.riskLevel == "Elevated" THEN apply DLP policy tier 1 (warn)
   IF user.riskLevel == "High"     THEN apply DLP policy tier 2 (block with override)
   IF user.riskLevel == "Severe"   THEN apply DLP policy tier 3 (block, no override)

3. Risk level resets automatically when IRM clears the user's risk score
```

**Adaptive Protection setup:**
1. Enable Insider Risk Management (requires E5 Compliance or IRM add-on)
2. Configure IRM policies (data theft, leaks, policy violations)
3. Enable Adaptive Protection in IRM settings
4. Create Adaptive Protection-enabled DLP policies in Purview DLP
5. Map IRM risk levels to DLP policy tiers

### AI Hub (Copilot DLP)

AI Hub prevents sensitive data from being inputted into Microsoft Copilot and other AI interactions.

**What AI Hub protects:**
- Microsoft 365 Copilot (Word, Excel, PowerPoint, Teams, Outlook Copilot)
- Copilot Studio custom copilots
- Third-party AI apps accessed via browser (when enabled)

**AI Hub DLP policies:**
```
Compliance portal → Data loss prevention → Policies
→ Select location: Microsoft 365 Copilot and AI Chat

Conditions:
  → Sensitive info types detected in the prompt
  → Sensitivity label on the referenced document

Actions:
  → Block Copilot from summarizing/analyzing the sensitive content
  → Warn user that the content is sensitive
  → Audit only (log prompt activity for review)
```

**Important note:** AI Hub DLP on M365 Copilot primarily controls whether Copilot can reference/surface sensitive content in responses. The underlying authorization model (who can access the document) still applies — Copilot can only surface data the user already has access to.

### Activity Explorer and Content Explorer

**Activity Explorer:**
- Compliance portal → Data classification → Activity explorer
- Shows DLP events, label changes, and sensitive content activities
- Filter by: activity type, location, user, SIT, label, date range
- Use for: DLP incident investigation, policy effectiveness review, trend analysis

**Key activities tracked:**
```
DLP: PolicyMatched, PolicyTipDisplayed, SensitiveDataRemoved
Labels: LabelApplied, LabelChanged, LabelRemoved, LabelRecommendationAccepted
Endpoint: FileCreated, FileCopied, FileDeleted, FileRenamed, FilePrinted
```

**Content Explorer:**
- Shows where sensitive data exists across M365
- Browse by SIT type or label
- Drill into locations (Exchange, SharePoint, OneDrive, Teams, Endpoints)
- Use for: data discovery, scoping DLP policies, compliance reporting
- Requires: Content Explorer Content Viewer role to see actual content

### PowerShell Reference

```powershell
# Connect to Security & Compliance PowerShell
Connect-IPPSSession -UserPrincipalName admin@contoso.com

# List all DLP policies
Get-DlpCompliancePolicy | Select-Object Name, Mode, Workload, Enabled

# Get policy details including rules
Get-DlpComplianceRule -Policy "PII Protection Policy" | 
    Select-Object Name, BlockAccess, NotifyUser, ReportSeverityLevel

# Create a DLP policy (PowerShell)
New-DlpCompliancePolicy -Name "Credit Card Policy" `
    -ExchangeLocation All `
    -SharePointLocation All `
    -OneDriveLocation All `
    -Mode TestWithoutNotifications  # Start in simulation

# Add a rule to the policy
New-DlpComplianceRule -Name "Credit Card Rule" `
    -Policy "Credit Card Policy" `
    -ContentContainsSensitiveInformation @{Name="Credit Card Number"; minCount=1; minConfidenceLevel=85} `
    -BlockAccess $true `
    -NotifyUser "LastModifiedBy"

# Enable a policy (change from test to enforce)
Set-DlpCompliancePolicy -Identity "Credit Card Policy" -Mode Enable

# Get DLP incidents (requires Compliance Data Administrator or higher)
Get-DlpDetailReport -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
    -PageSize 5000 | Export-Csv -Path "dlp_incidents.csv" -NoTypeInformation

# Get EDM data stores
Get-DlpEdmSchema

# Check Endpoint DLP onboarding status (via Defender)
# Use Defender for Endpoint API or portal; not available via IPPS PowerShell
```

### Licensing Requirements

| Feature | Required License |
|---|---|
| DLP for Exchange, SharePoint, OneDrive | M365 E3 / Business Premium |
| Teams DLP | M365 E5 Compliance or add-on |
| Endpoint DLP | M365 E5 Compliance or Endpoint DLP add-on |
| EDM (Exact Data Match) | M365 E5 Compliance |
| Trainable classifiers (built-in) | M365 E5 Compliance |
| Custom trainable classifiers | M365 E5 Compliance |
| Adaptive Protection | M365 E5 Compliance + IRM add-on |
| AI Hub / Copilot DLP | M365 Copilot + E5 Compliance |
| Named Entity SITs | M365 E5 Compliance |

### Common Issues and Troubleshooting

**Policy not triggering:**
1. Verify policy is in Active mode (not Simulation)
2. Verify location scope includes the affected workload
3. Check if user is in an excluded group
4. Verify SIT confidence threshold isn't too high for the test content
5. Allow 24-48 hours for new policies to propagate

**Endpoint DLP not logging:**
1. Verify device is onboarded to Defender for Endpoint
2. Check Endpoint DLP settings: Settings → Endpoint DLP settings
3. Verify Windows version ≥ 1809 or macOS ≥ 11
4. Check MDE agent health in Defender portal

**High false positive rate:**
1. Review Activity Explorer — understand which SIT is firing
2. Narrow confidence threshold (raise from Medium to High)
3. Add keyword exclusions for known-safe contexts
4. Check for implicit trust issues (internal email headers matching patterns)

**EDM not matching:**
1. Verify data refresh completed successfully (check EDM upload status)
2. Confirm schema field names match the policy SIT configuration
3. Verify the inspected content format matches what was indexed
4. Check token boundaries (EDM matches whole tokens, not substrings)

## Reference Files

- `references/architecture.md` — Purview DLP architecture, data flow, SIT engine, endpoint DLP agent, Adaptive Protection, AI Hub, Activity Explorer deep reference