What this check looks at
Checks that an enforced DLP policy covers Teams chats and channel messages.
DLP policies apply per location, and Teams chat and channel messages is a location of its own, separate from Exchange email, SharePoint sites and OneDrive accounts. A policy that covers those does not look at what people type into Teams. With Teams covered, DLP checks one-to-one and group chats and channel posts, can block a message so the recipients see only that it was blocked, and shows the sender why.
The check passes when at least one enforced DLP policy (switched on and in Enable mode) includes the Teams location. It fails when DLP is enforced but no enforced policy covers Teams, and gives the same results as the DLP enforcement check (NL-PVW-101) when no policy is enforced at all.
Chat is where people paste what they would think twice about emailing: a customer’s card number to finish a phone order, the password for a shared account, a screenshot of someone’s bank details. With guests and external access, the other side of a chat may be outside the organisation, and without DLP for Teams nothing looks at the message before it arrives.
Why it matters
Card numbers, passwords and personal data are pasted into Teams chats as often as into email. Without DLP on Teams, the same data the email policy would stop goes out in a chat with a guest.
A typical case: a customer service agent takes a card payment by phone and pastes the full card number and security code into a Teams chat so a colleague can process it. The chat is kept for years. When the business next assesses for PCI DSS, its Teams chat history is full of card data, including security codes that the standard says must never be stored after authorisation.
The clean-up is slow and the finding is serious: the card data has to be found and removed, Microsoft 365 comes into PCI DSS scope, and the acquirer may ask questions. A Teams DLP policy would have blocked the message and told the agent why.
CIS Microsoft 365 Foundations Benchmark 3.2.2 asks that DLP policies are enabled for Microsoft Teams. DLP for Teams needs Microsoft 365 E5 or an E5 Compliance or Information Protection add-on; Business Premium and E3 do not include it, so in those tenants this check stays failed until the licence is added.
How to fix it
Where: Microsoft Purview portal → Data loss prevention → Policies
Before you start
- Run the Teams location in test mode first: chat messages are short and some sensitive information types match more often there.
Step by step
- Check the licence. In the Microsoft 365 admin centre, go to Billing > Your products and confirm the tenant has Microsoft 365 E5, E5 Compliance or E5 Information Protection and Governance for the people whose chats are covered. Without it the Teams location is not available.
- See which enforced policies cover what. Connect to Security & Compliance PowerShell (Install-Module ExchangeOnlineManagement, then Connect-IPPSSession) as a Compliance Administrator. Run Get-DlpCompliancePolicy | Select-Object Name, Mode, TeamsLocation to see which policies include Teams and which are enforced.
- Create a Teams policy in simulation. In the Purview portal, go to Solutions > Data loss prevention > Policies > Create policy. Use the same template as your enforced policy, name it for Teams, and on Locations turn on only "Teams chat and channel messages" for all accounts. Keep policy tips on, and choose "Run the policy in simulation mode". Chat messages are short and match differently from email, which is why Teams is best trialled on its own.
- Review the Teams matches. After a week or two, open Data loss prevention > Explorers > Activity explorer, filter on the Teams policy and look at what matched. Tune any rule that catches ordinary messages.
- Turn it on. Edit the policy, go to Policy mode, choose "Turn the policy on immediately" and submit, or run Set-DlpCompliancePolicy -Identity "<Teams policy>" -Mode Enable. If your existing enforced policy is well tuned, you can instead add Teams to it with Set-DlpCompliancePolicy -Identity "<policy>" -AddTeamsLocation All, which enforces it straight away.
- Confirm the change. Get-DlpCompliancePolicy | Select-Object Name, Mode, TeamsLocation shows an enforced policy with TeamsLocation All. In a test chat with a guest, send the words "credit card" with the test number 4111 1111 1111 1111: the message is blocked and the sender sees a policy tip.
What users will notice
A Teams message containing sensitive information is blocked for the recipients the policy covers, and the sender sees why.
How to confirm it worked
Get-DlpCompliancePolicy | Select-Object Name, Mode, TeamsLocation shows the enforced policy with TeamsLocation All.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.b Data in transitB3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of informationC1.1 Identifying and maintaining confidential information |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.8.12 Data leakage prevention |
| CIS M365 | 3.2.2 Ensure DLP policies are enabled for Microsoft Teams |
| CIS Controls v8.1 | 3.13 Deploy a data loss prevention solution (IG3) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- DLP for Microsoft Teams (Microsoft Learn)