Data Loss Prevention

DLP policies enforce the decisions that labels represent. A file labeled Confidential or Restricted (or CUI (Basic), CUI//SP-CTI, or CUI//SP-EXPT in GCC High) should be blocked from leaving via unauthorized channels: DLP is what does the blocking. Policies operate across Exchange, SharePoint, OneDrive, Teams, and Endpoint (Windows devices).

Policy Priority and Execution Order

Purview evaluates DLP policies in priority order, lowest number first. When a policy match triggers, evaluation continues unless the policy includes a Stop processing more policies rule. Assign priorities deliberately:

Priority Range	Category
0–3	Credential protection, highest risk, always enforce
4–8	Restricted / CUI//SP-CTI and CUI//SP-EXPT: encrypt, block, alert
9–14	Confidential / CUI (Basic): alert and policy tip
15–20	PII / Finance SIT-based alerts
21–25	Internal label alerts
26+	Endpoint controls and policy tips

Credential Protection

Credentials (passwords, API keys, connection strings) shared externally represent an immediate breach risk. These policies operate independently of sensitivity labels.

Priority	Policy	Workload	Rollout	Action
0	Exchange: AD Credential Alert	Exchange	Test group → All users	Alert + block send
1	OneDrive: AD Credential Alert	OneDrive	Test group → All users	Alert + restrict access
2	SharePoint: AD Credential Alert	SharePoint	Simulation → Enforced tenant-wide	Alert + restrict access
3	Teams: AD Credential Alert	Teams	Test group → All users	Alert only

Rule condition: Content contains SIT → General Password OR Software Development Credentials OR Azure Active Directory Client Secret

Rule action (Exchange): Block the email from being sent; notify the user with a policy tip explaining why.

Rule action (OneDrive/SharePoint): Restrict access to matching content; notify the appropriate owner. DLP restriction is not the same as permanently deleting sharing links.

Rollout method depends on whether the workload supports user/group scoping

Exchange, OneDrive, and Teams DLP all support scoping a policy to a user or group of senders: deploy Enforced to a small test group, observe real friction, then expand. Test-group enforcement produces real user behavior data (override rates, policy-tip responses, helpdesk volume) that simulation mode cannot.

SharePoint DLP is site-scoped. Use simulation to understand matches, then enforce on selected pilot sites before expanding. A user test group alone does not limit a site-scoped policy's effects to those users.

Restricted / CUI: External Sharing Alerts

Any external sharing of content at the highest classification tier should generate an alert and, optionally, block the action.

Priority	Policy	Workload	Action
4	Exchange: Restricted External Sharing Alert	Exchange	Alert + override with justification
5	OneDrive: Restricted External Sharing Alert	OneDrive	Alert + restrict access
6	SharePoint: Restricted External Sharing Alert	SharePoint	Alert + restrict access

Rule condition: Content is labeled → Restricted (or CUI//SP-CTI OR CUI//SP-EXPT in GCC High, selected as sublabels and never the CUI parent, which would pull CUI (Basic) into the block tier) AND Content is shared → With people outside the organization

Rule action: Generate an incident report to the compliance team; notify the user; require override justification.

In GCC High the Exchange policy at priority 4 holds two rules rather than one, because the two Specified sublabels differ in one setting: the CUI//SP-CTI rule blocks with override and business justification, since a distribution statement can authorize a recipient of Controlled Technical Information; the CUI//SP-EXPT rule blocks with no override. OneDrive and SharePoint block absolutely for both sublabels, so one rule with both selected is enough there. Policy priorities and counts do not change.

GCC High (CMMC)

CUI Authorized Transfer Controls

CMMC AC.L2-3.1.3 requires controlling authorized CUI flows. No single DLP domain list covers every workload; the control is three settings. Exchange: the rule condition or exception Recipient domain is. SharePoint and OneDrive: the SharePoint admin center setting Limit external sharing by domain (Allow only specific domains, set for the organization and, as a subset, per site), which refuses the share before DLP sees it, and the DLP sub-option Block access for specific external domains or users (preview; its Domain IS NOT form is an allow list). A domain on any of these lists proves nothing about a particular contract's authorization; the contract file does.

Configuring the Exchange recipient-domain exception for CUI

For an Exchange rule covering CUI external sharing:

1. Set the action to Block external sharing.
2. If authorized, add a recipient-domain exception for the partner's actual mail domain to the CUI//SP-CTI rule only. The CUI//SP-EXPT rule carries no domain exception, because a partner domain says nothing about whether every mailbox behind it is a US person; add one only with the export-compliance officer's written approval. Test a message containing both an approved and an unapproved recipient; a message-level exception must not accidentally exempt the unapproved recipient.
3. Disable user override where unauthorized transfer must be prevented: the CUI//SP-EXPT rule never offers one. A justification is not manager approval or authorization to release CUI.

For SharePoint and OneDrive the allow list is the SharePoint admin center setting Limit external sharing by domain (Policies > Sharing for the organization; Active sites > site > Settings > More sharing settings for one site, a subset of the organization list), which refuses the share before any DLP rule runs. The DLP rule then conditions on the label and Content is shared from Microsoft 365 > with people outside my organization, with the action Restrict access or encrypt the content in Microsoft 365 locations > Block only people outside your organization (walkthrough); the preview sub-option Block access for specific external domains or users adds a per-rule domain list if the tenant shows it. Test an approved guest, an unapproved guest, and an existing link created before the policy; a permitted domain does not establish the recipient's authorization for every contract. Verify conditions and actions by workload.

CMMC Control Mapping

NIST Control	DLP Enforcement
3.1.3: Control CUI flow	Recipient domain is exception on the Exchange CUI rules; Limit external sharing by domain for SharePoint and OneDrive
3.13.1: Monitor communications	Alert on all external CUI sharing
3.13.8: Implement cryptographic mechanisms	Encryption enforced by label; DLP blocks unencrypted external send
3.3.1: Audit log	Incident reports to compliance mailbox

Commercial

Sector-Specific External Sharing Controls

For commercial organizations, tailor the external sharing block by regulatory context.

GLBA / Financial Services

Block external sharing of Financial SIT content to non-business domains. Add exceptions for known external auditors, regulators (SEC, FDIC), and accounting firms by domain.

HIPAA / Healthcare

HIPAA permits PHI disclosure only as the Privacy Rule allows; define the permitted disclosures with the privacy officer first. A Require business justification override records the sender's own statement in the audit log and the message X-header; it obtains nobody's approval. Where a release needs sign-off, use the Exchange rule action Forward the message for approval to sender's manager (or to specific approvers), which holds the message until the approver releases it, and leave the override off. Incident reports to the privacy mailbox give the record of what was attempted. See DLP policy reference.

FERPA / Higher Education

FERPA permits disclosure from education records without consent only under its listed exceptions (34 CFR 99.31), which include officials of another institution where the student seeks to enroll. Have the registrar list the permitted disclosures, then build the Exchange rule: condition on the student-record sensitive information types your institution uses and Content is shared > with people outside my organization, action Block, with a Recipient domain is exception carrying the institutions the registrar approved under transfer or dual-enrollment agreements. The registrar's record is the authorization; the domain list only mirrors it.

Confidential / CUI (Basic): External Sharing Alerts

Content at the Confidential tier (CUI (Basic) in GCC High) requires alerting but not automatic blocking during initial deployment (Foundational phase). Escalate to blocking in the Managed phase once false-positive rates are understood.

Priority	Policy	Workload	Action
7	Exchange: Confidential Label External Sharing Alert	Exchange	Alert
8	OneDrive: Confidential Label External Sharing Alert	OneDrive	Alert
9	SharePoint: Confidential Label External Sharing Alert	SharePoint	Alert

Copilot: Sensitive Label Enforcement

Microsoft 365 Copilot already respects user access permissions and applicable label encryption rights. A Copilot DLP policy adds a restriction on processing selected sensitive content even when the user otherwise has access; it does not create the underlying permission boundary.

Priority	Policy	Workload	Action
10	Copilot Chat: Sensitive Label Enforcement	Microsoft 365 Copilot and Copilot Chat	Block

Rule condition: Content is labeled → Confidential OR Restricted (in GCC High, the CUI parent, which includes every sublabel: CUI (Basic), CUI//SP-CTI, CUI//SP-EXPT)

Rule action: Block Copilot from accessing, processing, or referencing the content.

Deploy Copilot DLP Before Copilot

Validate the intended exclusion policy before rollout. Without it, Copilot may process sensitive content the user is already authorized to access, subject to supported encryption rights. See Copilot data readiness for supported workloads, cloud availability, and limitations; DLP does not replace permission cleanup.

PII SITs: External Sharing Alerts

These policies detect content containing PII SITs at the point of sharing and generate security team alerts.

Priority	Policy	Workload	Confidence
11	Exchange: PII External Sharing Alert	Exchange	High + Medium
12	SharePoint: PII External Sharing Alert	SharePoint	High + Medium
13	OneDrive: PII External Sharing Alert	OneDrive	High + Medium

Rule design (two rules per policy):

• High Confidence rule: PII SIT group at High confidence + Shared externally → Alert with High severity
• Medium Confidence rule: PII SIT group at Medium confidence + Shared externally → Alert with Medium severity

Separate rules prevent High severity alerts from being suppressed when Medium confidence matches dominate.

Finance SITs: External Sharing Alerts

Priority	Policy	Workload	Confidence
14	Exchange: Finance External Sharing Alert	Exchange	High + Medium
15	OneDrive: Finance External Sharing Alert	OneDrive	High + Medium
16	SharePoint: Finance External Sharing Alert	SharePoint	High + Medium

Internal Label: External Sharing Alerts

Low-priority audit trail for content labeled Internal that is shared externally. Informational only: Internal does not restrict sharing, but provides an anomaly-detection baseline.

Priority	Policy	Workload	Action
17	OneDrive: Internal Label External Sharing Alert	OneDrive	Alert (Low severity)
18	Exchange: Internal Label External Sharing Alert	Exchange	Alert (Low severity)
19	SharePoint: Internal Label External Sharing Alert	SharePoint	Alert (Low severity)

Endpoint DLP

Endpoint DLP extends policy enforcement to Windows device actions: USB copy, Bluetooth transfer, browser upload, print, and RDP clipboard paste.

Prerequisites: onboarded, not merely enrolled

The Devices location in a DLP policy reaches only devices that are onboarded, and Intune enrollment is not what onboards them. Device onboarding is the Defender for Endpoint sensor onboarding, shared with Purview: an Intune-enrolled device that missed the EDR policy is invisible to Endpoint DLP, and an MDE-onboarded device that is not Intune-enrolled is covered. Before publishing the two policies below, confirm four things:

• [ ] The tenant switch is on: Purview Settings > Device onboarding > Devices > Turn on device onboarding, once per tenant. MDE-onboarded devices populate the list on their own. The mechanics, the GCC High portal, and the per-device confirmation are in Endpoint DLP Uses the Same Onboarding.
• [ ] Target devices show in that list with Configuration status = Updated. Expect Policy sync status = Not available until the first device-scoped policy below exists; it flips to Updated within about two hours of publishing.
• [ ] Licensing follows the user: E5 or G5 Compliance on every signed-in user in scope; the device list's Valid user attribute reports whether the current user qualifies.
• [ ] Browsers match the enforcement model: Edge enforces natively; Chrome and Firefox require the Purview extension; anything else is unallowed and redirected.

Priority	Policy	Workload	Action
20	Endpoint: Block External Cloud Uploads	Devices (onboarded)	Block
21	Endpoint: Block USB Copy of Sensitive Files	Devices (onboarded)	Block

Endpoint: Block External Cloud Uploads

• Condition: Content is labeled → Confidential OR Restricted
• Action: Block upload to unapproved cloud storage (list approved services: SharePoint, OneDrive, approved line-of-business apps)
• User notification: Policy tip explaining the block; link to approved transfer method

Endpoint: Block USB Copy

• Condition: Content is labeled → Confidential OR Restricted
• Action: Block copy to removable media; audit log entry
• Override: Require justification (written to Unified Audit Log)

GCC High (CMMC)

CMMC Endpoint Requirements

CMMC MP.L2-3.8.7 prohibits the use of removable media unless approved and limited to documented needs. Endpoint DLP implements this control technically:

• Block USB copy for all CUI-labeled content with no override option
• Block Bluetooth transfer for CUI content
• Block print of CUI content on non-organizationally-owned printers (use Printer groups to define approved printers)
• Block RDP clipboard paste of CUI content to non-corporate remote sessions

Configure Printer Groups in Endpoint DLP settings to define corporate-approved print destinations. CUI//SP-CTI and CUI//SP-EXPT policies should use Block always (no override); CUI (Basic) may use Block with override during transition.

Commercial

Commercial Endpoint Controls

For commercial organizations, USB and cloud upload controls apply to Restricted content. For Confidential content, use Override with justification rather than hard block during the initial deployment phase: this reduces help desk calls while still building an audit trail.

Set Block with override on USB copy for Confidential, and escalate to Block always for Restricted. Review endpoint DLP alerts weekly for the first 90 days to calibrate.

Policy Tips

Policy tips deliver just-in-time education at the point of risk: when the user is sending an email or uploading a file. They reduce false positives by allowing users to self-serve corrections before a DLP violation is logged.

PII Policy Tips

Policy	Workload	Trigger
Exchange: Policy Tip: PII	Exchange	PII SIT at any confidence OR Confidential label detected in outbound email
OneDrive: Policy Tip: PII	OneDrive	PII SIT or Confidential label on a file being shared externally
SharePoint: Policy Tip: PII	SharePoint	Same as OneDrive

Tip message example:

"This message appears to contain personal information (names, SSNs, or financial account numbers). Before sending, confirm the recipient is authorized to receive this data and that it is protected per your organization's data handling policy."

Finance Policy Tips

Policy	Workload	Trigger
Exchange: Policy Tip: Finance	Exchange	Finance SIT at any confidence OR Confidential label
OneDrive: Policy Tip: Finance	OneDrive	Finance SIT or Confidential label on shared file
SharePoint: Policy Tip: Finance	SharePoint	Same as OneDrive

Email CC List Warning

A lightweight policy tip that displays a banner on outbound messages with a large CC list, a common vector for accidental data disclosure.

Policy	Workload	Trigger	Action
Exchange: CC List Warning	Exchange	CC recipient count > 10	Display policy tip; allow send

No SIT condition: fires on recipient count alone.

Alert Tuning

After initial deployment, tune DLP alerts weekly:

1. Review the DLP Alerts dashboard in the Microsoft Purview compliance portal.
2. For each false-positive alert category, identify the SIT or label condition causing the match.
3. Adjust confidence level thresholds, add keyword exclusions, or scope the policy to exclude known-safe sites or distribution groups.
4. Document tuning decisions in your DLP policy change log: this record serves as audit evidence for compliance assessments.