DLP explained: Microsoft Purview policies
Data loss prevention (DLP) in Microsoft Purview stops sensitive content from leaving through the channels people use every day: email, SharePoint, OneDrive, Teams, devices and cloud apps. The decision rule for exams: a sensitivity label protects the item itself, a retention setting controls how long it lives, and a DLP policy controls what users may do with it and where it may go. If a scenario says “prevent”, “block” or “stop sharing”, DLP is the answer.
What a DLP policy is made of
Microsoft’s policy configuration overview walks through what to monitor, administrative scoping, locations, conditions and actions, and the deployment guidance adds the policy state. Four of those decisions settle most exam scenarios; make them in this order.
| Decision | What you choose | Examples |
|---|---|---|
| Where | The locations the policy watches | Exchange email, SharePoint sites, OneDrive accounts, Teams chat and channels, Windows and macOS devices, on-premises repositories, Fabric and Power BI workspaces |
| What | The conditions that make content sensitive | A sensitive information type, a sensitivity or retention label, content shared with people outside the organisation |
| Then what | The action when the condition is met | Audit only, block, block with override, restrict access, user notification, alert |
| How hot | The policy state | Keep it off, simulation, simulation with policy tips, turn it on |
Conditions and actions live in an object called a rule. A policy holds one or more rules, and each rule has a priority. This matters because one policy can say “block when there are many matches” in one rule and “warn the user” in another.
Two details are easy to miss. DLP does deep content analysis (patterns, checksums, nearby keywords, classifiers), not a plain text search. And every DLP-monitored activity is written to the audit log by default and shows up in Activity explorer, so audit-only is a real, useful action and not a null setting.
A worked example: card numbers in email
Intent statement: “Credit card numbers must not be emailed outside the company, but finance staff with a legitimate reason may proceed.”
- Where: Exchange email.
- Rule 1 (priority 0, highest): content contains 10 or more credit card numbers and goes to an external recipient. Action: block, and generate a high-severity alert.
- Rule 2 (priority 1): content contains 1 to 9 credit card numbers and goes to an external recipient. Action: block with override, which lets the sender continue after giving a business justification, and sends a notification.
- State: start in simulation and read the matches in the simulation dashboard and Activity explorer before enforcing anything.
A message with 12 card numbers matches both rules. Rules are processed starting from the highest priority, and on hosted locations such as Exchange the highest-priority rule with the most restrictive action is the one enforced; the other matches are still logged. Actions that block or restrict access are also halting: once one fires, later rules in the pipeline stop being processed. A message with 3 numbers matches only Rule 2, so the sender sees a policy tip and can override.
Rollout is part of the answer
Microsoft recommends an incremental deployment, and exam scenarios mirror it. Set the state of a finished policy to keep it off, then move it up one stage at a time:
- Simulation mode: no actions are enforced, events are audited, scope can be broad.
- Simulation mode with policy tips: still no enforcement, but users see tips and emails. Scope it to a pilot group.
- Turn it on right away: full enforcement across the intended locations.
Newly enabled policies take roughly an hour to take effect, so a “it still does not work” complaint minutes after saving is not a fault. One more detail: stop processing more rules does not work in simulation mode, so a simulation can show matches that a live policy would never reach.
How conflicts resolve
- Within a policy, rules run from highest priority down.
- Across policies on hosted locations, every matching policy is evaluated and the most restrictive action wins; matches that are not enforced are still logged.
- On endpoint devices, the effective result is the combination of the most restrictive action per activity. Ties go to the higher-priority policy, then the higher-priority rule, then a policy that is on over one in simulation, and no-override over allow-override.
Which exams test this
| Exam | How the topic appears | Where on this site |
|---|---|---|
| SC-401 | Implement data loss prevention and retention (30 to 35 percent): designing, creating and managing DLP policies, roles, rule and policy precedence, DLP for Adaptive Protection, Defender for Cloud Apps file policies, plus Endpoint DLP settings and monitoring. Responding to DLP alerts sits in the risks, alerts and activities domain | DLP and Endpoint DLP guide |
| SC-900 | Describe the capabilities of Microsoft compliance solutions (20 to 25 percent): one objective asks you to describe DLP, at the level of what it does rather than how to configure it | Compliance solutions guide |
| AB-900 | Understand data protection and governance tasks for Microsoft 365 and Copilot (35 to 40 percent): the features of Purview DLP, and identifying and responding to the alerts DLP generates | Data protection and governance guide |
| SY0-801 | Security operations (27 percent): DLP is listed as a content filter among mitigating controls and as a monitoring tool. Vendor-neutral and a minor topic; Purview itself is not tested. The V8 exam launches on November 17, 2026 | Security operations guide |
How exam questions are built around DLP
The standard trap is the wrong Purview tool. “Prevent” points to DLP, “protect the file wherever it travels” to a sensitivity label, “keep for seven years” to retention, and “detect risky behaviour over time” to Insider Risk Management. Read the verb before the nouns. The sensitivity labels topic covers the contrast from the other side.
The second trap is action strength. “Users must be able to continue with a reason” means block with override. “Gather data before affecting anyone” means simulation or audit only. “Under no circumstances” means block without override.
Third, location prerequisites. A policy on devices does nothing for devices that are not onboarded, and non-Edge browsers need extra support for Endpoint DLP. Fourth, precedence scenarios give two policies or rules and ask what the user experiences: apply priority, then most restrictive action.
Two practice questions
Question 1. A new DLP policy blocks the external sharing of files that contain national ID numbers. The compliance team wants to see how many files it would match and educate a pilot team with policy tips, without blocking anyone yet. Which policy state should be used?
- A. Turn it on right away
- B. Keep it off
- C. Run the policy in simulation mode and show policy tips
- D. Run the policy in simulation mode without policy tips
Show answer
Answer: C
Simulation mode with policy tips enforces no actions but shows users tips and notification emails, and the scope can be limited to a pilot group. Turn it on right away enforces the block immediately. Keep it off produces no matches and no tips. Plain simulation mode without tips audits matches but does not educate the pilot users.
Question 2. Email containing customer bank account numbers must not go to external recipients, but a sender with a legitimate business need must be able to proceed after stating a reason, and the reason must be recorded. Which action should the DLP rule use?
- A. Audit only
- B. Block with override
- C. Block without override
- D. Apply a retention label
Show answer
Answer: B
Block with override blocks by default, lets the user override with a justification and records it for review. Audit only never stops the message. Block without override gives the user no way to proceed. A retention label controls how long content is kept and does not control sending.
Go deeper
- Learn about data loss prevention, Microsoft Learn
- Data loss prevention policy reference, Microsoft Learn
- Create and deploy a data loss prevention policy, Microsoft Learn
- Related on this site: sensitivity labels explained, how to read a skills outline, how to study for certification exams