implementing-data-loss-prevention-with-microsoft-purview

Use New-DlpCompliancePolicy in Security & Compliance PowerShell to scope locations like Exchange, SharePoint, and OneDrive, then add rules with New-DlpComplianceRule specifying sensitive information types, confidence thresholds, and actions such as block or notify. Start in TestWithNotifications mode before enforcing.

Define an XML rule package containing your regex pattern, optional corroborating keywords, and confidence levels, then import it with New-DlpSensitiveInformationTypeRulePackage. Note that ^ and $ anchors do not behave as expected in Purview, so validate patterns in simulation mode first.

Endpoint DLP and full policy capabilities require Microsoft 365 E5, E5 Compliance, or the E5 Information Protection add-on assigned to target users. You also need Compliance Administrator or equivalent roles in the Purview portal.

Yes, endpoint DLP supports macOS 12+ and Windows 10/11 21H2+ devices, but they must be onboarded through Microsoft Intune or Configuration Manager. Verify onboarding by checking that the registry OnboardingState value equals 1 on Windows.

The policy is likely still in test mode; check with Get-DlpCompliancePolicy and confirm the Mode is set to Enable rather than TestWithNotifications. Also verify all intended locations are bound and endpoint devices are actually onboarded.

Raise the SIT confidence level (for example from 65 to 85), increase MinCount, and add corroborating keywords to custom SITs. Review override activity in Activity Explorer and validate patterns against a seeded test corpus with Test-DataClassification.