📖 What is Data Loss Prevention (DLP)?
Data Loss Prevention (DLP) is a security framework that prevents the accidental or intentional sharing of sensitive information outside the organization. It monitors content in Exchange, SharePoint, OneDrive, and Teams, triggering alerts or blocking actions when sensitive data patterns are detected.
"Be sure to study the difference between 'policy tips' which warn the user, and 'block' actions which stop the data transfer entirely."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Data Loss Prevention (DLP)?
- ▸ Sensitive Information Types (SITs) use predefined or custom patterns, such as regular expressions, to identify sensitive data like credit card numbers or SSNs.
- ▸ Policy Actions allow administrators to choose between auditing, notifying users via policy tips, or completely blocking the sharing of sensitive content externally.
- ▸ Workload Integration ensures that a single DLP policy can be applied consistently across Exchange, SharePoint, OneDrive, and Microsoft Teams for unified protection.
- ▸ Policy Overrides enable users to bypass a block by providing a business justification, which is then logged for administrative review and auditing purposes.
- ▸ Policy Priority determines the order of evaluation when multiple policies apply to the same content, ensuring the most critical rules are processed first.
🎯 How does Data Loss Prevention (DLP) appear on the MS-102 Exam?
You may be asked to configure a policy that prevents users from emailing credit card numbers to external recipients while allowing internal sharing.
A scenario might describe a need to notify users in real-time when they upload sensitive documents to a public SharePoint site using policy tips.
Expect questions about selecting the correct action when a company wants to monitor sensitive data movement without interrupting the user's workflow via auditing.
❓ Frequently Asked Questions
What is the functional difference between a Policy Tip and a Block action?
A policy tip is a non-intrusive notification that warns the user their content contains sensitive data, whereas a block action physically prevents the user from sending or sharing the file.
Can custom Sensitive Information Types be created for organization-specific data?
Yes, administrators can create custom SITs using regular expressions (regex) or keyword lists to identify unique data patterns, such as internal project codes, not covered by default templates.
How does DLP interact with Microsoft Purview sensitivity labels?
DLP policies can be configured to trigger based on the presence of specific sensitivity labels, allowing administrators to protect data based on its classification rather than just pattern matching.