Data Loss Prevention: How to Get Started Without Blocking Work

Start data loss prevention by agreeing which data matters and where it lives, then write a small number of policies for the most sensitive types in email and file sharing, and run them in simulation mode before they block anything. Use what the simulation finds to tune out false positives, switch on policy tips that warn people in the moment, and only then move to blocking, one data type and one location at a time. Microsoft's own guidance for Purview DLP is to deploy policies in simulation mode and evaluate their impact before running them in more restrictive modes.

The steps below use Microsoft Purview DLP as the example, because its monitoring is native to the Microsoft 365 apps your staff already use. Our DLP solutions page covers how we deploy it across email, Microsoft 365 apps, endpoints and SaaS apps.

What does DLP do, and what does it not do?

A Purview DLP policy watches what people do with sensitive items in the locations you choose, and acts when a rule matches. Depending on how you configure the rule, it can:

• show a policy tip warning the user that they may be sharing something sensitive;
• block the action but let the user override it and record a justification;
• block the action with no override;
• for stored files, lock sensitive items and move them to a secure quarantine location.

Every activity DLP monitors is recorded in the Microsoft 365 audit log by default and shown in Activity explorer, so even a policy that only watches gives you evidence.

DLP also has limits worth knowing before you start:

• It only finds what you define. Detection comes from sensitive information types, labels and classifiers. If none of them describes your data, no policy will match it.
• Endpoint DLP needs a file on the device. Microsoft states that if data is never saved to a file on the local device, Endpoint DLP cannot scan or classify it. Its example is a user saving a Word document straight to a USB drive without storing it locally first.
• It is not device control. For controlling removable storage itself, Microsoft points to device control in Microsoft Defender for Endpoint.

Which data should you classify first?

A short list. Purview finds sensitive data mainly through sensitive information types, which are pattern-based classifiers, and Microsoft supplies a large set of built-in ones. That list includes types that matter in the UAE, such as the U.A.E. identity card number and the U.A.E. passport number, alongside the international banking account number (IBAN) and credit card numbers. Where your own data follows a pattern, such as customer account or contract numbers, you can create a custom type or copy and adjust a built-in one.

Who picks the list matters as much as the list. Microsoft's DLP planning guidance says IT cannot build a broad plan on its own without negative consequences, and that stakeholders should identify the regulations, laws and industry standards that apply and the business processes that use the data. If personal data is involved, our PDPL readiness plan helps you map what you hold.

If you do not yet know where sensitive data sits, Microsoft notes that some organisations start with a broad policy across all locations that only discovers and audits. A data discovery and classification audit finds where sensitive information lives, who can reach it and what is overshared, before any policy goes live.

Why start with email and file sharing?

They are the quickest locations to bring under policy. Microsoft explains that sensitive items in locations such as Exchange Online can be covered just by configuring a policy that applies to them, while on-premises file repositories need the Purview Information Protection scanner and devices must be onboarded first.

Licensing points the same way, so check yours before you design anything. Microsoft's Purview service description lists DLP for Exchange Online, SharePoint Online and OneDrive under Microsoft 365 Business Premium, E3 and E5, among other plans. Endpoint DLP and DLP for Teams are listed under E5-level plans and the Microsoft Purview Suite. Plans and inclusions change, so confirm against the current service description for your exact subscription.

A sensible first policy covers email and SharePoint or OneDrive sharing with people outside the organisation, for Emirates ID numbers, passport numbers, IBANs and card numbers. Built-in templates, such as financial data and privacy data for various countries and regions, give you a starting point to adjust.

How should you run simulation mode?

• Nothing is enforced. A policy in simulation mode runs as if it were enforced, without any actual enforcement, and its matches go to a separate dashboard so you see the impact before users do.
• Give it real business days. A simulation runs for up to 15 days. SharePoint and OneDrive items are evaluated whether existing or new, but for Exchange, Teams and devices only items that are new during the simulation are evaluated, so a quiet holiday week tells you little.
• Look in the right place. While a policy is in simulation, its alerts appear only in the simulation alerts tab. They do not reach the DLP alerts console or the Microsoft Defender portal, so whoever reviews alerts must check there.
• Record findings in time. Data from a simulation run is kept for 30 days.
• Tune what the results show. Adjust the locations and people in scope, the conditions and the sensitive information definitions. To change a policy already in production, Microsoft suggests copying it, tuning the copy in simulation, then switching the original off and enforcing the copy.

How do you move from warnings to blocking?

In stages, with the user experience written as carefully as the rules. Microsoft suggests using policy tips to raise awareness before moving a policy from simulation mode to more restrictive modes. A phased plan looks like this:

1. Simulate. One or two policies on email and file sharing, tuned until most matches are real.
2. Warn. Turn on policy tips and notifications so people see why an action matched and what to do instead.
3. Block with override. Users can still proceed with a business justification, which gives you a record of why sensitive data left.
4. Block. Only for the highest-risk combinations, such as many identity numbers in one message to an outside address.
5. Extend. Add Teams, endpoints and other locations, each one starting again in simulation.

Policies generally take effect about an hour after they are turned on, so do not judge a change in its first few minutes. Our own DLP rollouts follow the same three steps of monitor, warn and block, sequenced so business operations are not disrupted on day one.

Where do endpoints and insider risk fit?

After email and files are stable. Endpoint DLP extends policy to Windows 10 and 11, the three latest major macOS versions and certain Windows Server versions, once each device is onboarded. It can block, warn or audit actions such as copying protected files to USB storage, printing them or uploading them to restricted cloud services. Our endpoint DLP service starts with one clearly defined sensitive information type and one activity rather than everything at once.

Insider risk is a separate Purview solution. Microsoft Purview Insider Risk Management correlates signals to identify potential malicious or inadvertent insider risks such as data leakage and IP theft. Users are pseudonymised by default, and its analytics can show where risk sits before you configure any insider risk policy. Treat it as the next step once DLP is steady, and involve HR and legal before you switch it on.

How do you know the programme is working?

Track a few numbers from the first week and review them monthly:

• Matches per policy, and how many were real.
• Overrides, and whether the written justifications make sense.
• Repeat matches from the same team, which may point to a business process that needs a safer route rather than a careless person.
• Time from alert to review.

DLP helps prevent accidental sharing and makes deliberate leaks harder and more visible. It does not replace access control, encryption or staff awareness. For the sharing and consent settings that sit alongside it, see our list of Microsoft 365 security settings businesses leave open. To scope a DLP rollout for your business, contact our team.