How to set up data loss prevention (DLP) in Microsoft 365

What this check looks at

Checks, from Microsoft Secure Score, that data loss prevention (DLP) policies are in place for Exchange, SharePoint, OneDrive and Teams.

Data loss prevention (DLP) in Microsoft Purview notices sensitive information, such as card numbers, National Insurance numbers, bank details or patient records, leaving by email, a sharing link or a Teams chat, and warns the person or stops it before it goes. Microsoft provides templates for common UK data types, but no policy exists until someone creates one. This check is the Secure Score view of DLP, for tenants where ConfigCheckup does not read Purview directly.

The check uses Microsoft Secure Score’s assessment of its DLP actions, matched by name. It passes when Secure Score shows every DLP action as done, warns when any is not, and reports not checked when Secure Score does not track DLP for the tenant. Secure Score can take up to 48 hours to catch up with a change; the checks that read Purview directly (NL-PVW-101 to NL-PVW-105) show it sooner and in more detail.

Without DLP, nothing stands between a mistake or a deliberate act and the data leaving: a payroll file sent to the wrong address, a customer list uploaded to a personal account, card numbers pasted into a chat with a guest. The organisation finds out afterwards, if at all.

Why it matters

DLP is the control that notices a spreadsheet of card numbers or patient records leaving by email or a sharing link, and stops or warns before it goes. PCI DSS, DSPT and most insurers ask what stops sensitive data leaving.

A typical case: an administrator at a dental practice emails a spreadsheet of patients’ names, dates of birth and treatment notes to a personal address to work on at home. Nothing stops it. When it comes to light the practice has a breach of special category health data to report to the ICO, and its patients to tell.

Many sector requirements ask what stops sensitive data leaving: PCI DSS for card data, the Data Security and Protection Toolkit for health and care, and most cyber insurance proposal forms. DLP is the usual answer, and Business Premium and E3 already include it for email, SharePoint and OneDrive.

CIS Microsoft 365 Foundations Benchmark 3.2.1 and CISA SCuBA MS.DEFENDER.4.1v2 ask for DLP policies to be enabled (this check covers them partly, through Secure Score). It is ISO 27001 A.8.12 (data leakage prevention) and the NCSC Cyber Assessment Framework’s B3.b and B3.c.

How to fix it

Where: Microsoft Purview portal → Data loss prevention

Before you start

• Choose templates for the data the business holds (for example UK personal data, card numbers).
• Run them in simulation mode and review matches for a couple of weeks before turning them on.

Step by step

1. 1See which Secure Score actions are open. In Microsoft Secure Score in the Microsoft Defender portal, go to Recommended actions and search for "DLP" or "data loss". Note the actions not completed.
2. 2Choose templates for the data the business holds. Agree with the business which sensitive data it handles: card numbers, UK personal data such as National Insurance numbers, bank details, health information. Pick the matching templates in the Financial, Privacy or Medical and health categories.
3. 3Create the policy in simulation. In the Microsoft Purview portal, go to Solutions > Data loss prevention > Policies > Create policy. Choose the template, name the policy, and set Exchange email, SharePoint sites and OneDrive accounts (and Teams chat and channel messages where licensed) to All. Keep policy tips and the template’s blocking for content shared outside the organisation, choose "Run the policy in simulation mode" and submit.
4. 4Review the matches. After a week or two, go to Data loss prevention > Explorers > Activity explorer, filter on the policy and look at what it matched. Raise instance counts or add exceptions for rules that catch ordinary work.
5. 5Turn the policy on. Edit the policy, go to Policy mode and choose "Turn the policy on immediately", or in Security & Compliance PowerShell run Set-DlpCompliancePolicy -Identity "<policy name>" -Mode Enable. Tell staff what the policy tips mean and how to ask for help.
6. 6Confirm the change. Send a test email with the words "credit card" and the test number 4111 1111 1111 1111 to an outside address: it shows a policy tip or is blocked, and appears in Activity explorer. Within 48 hours the Secure Score DLP actions show as completed.

What users will notice

Users see a policy tip when they share sensitive data, and may be blocked from sending it externally.

How to confirm it worked

Microsoft Purview, Data loss prevention, Policies: the policies are On (not in simulation), with matches appearing in Activity explorer.

Frameworks and controls

This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Learn about data loss prevention (Microsoft Learn)

Related checks

• How to switch a DLP policy from test mode to enforced
• How to find risky apps with access to Microsoft 365 data
• How to create sensitivity labels for documents and email
• How to set up retention labels in Microsoft Purview

The full Microsoft 365 security checklist, worst first