What this check looks at
Checks that the rules of enforced DLP policies block sharing of the sensitive information they find with everyone, rather than only reporting it.
Each DLP policy is made of rules: conditions (which sensitive information, how many instances, shared with whom) and actions. The action that stops data leaving is "Restrict access or encrypt the content in Microsoft 365 locations": block people from receiving the email or opening the shared file, either everyone or only people outside the organisation (BlockAccess, with BlockAccessScope All or PerUser). A rule without it only notifies, reports or raises an alert.
The check takes the switched-on rules of the enforced DLP policies and fails for every rule that does not block access for everyone, that is BlockAccess is not true or its scope is something other than All. It also fails when the enforced policies have no switched-on rule. It passes only when every such rule blocks everyone.
Many template policies come with a low-volume rule that only notifies and a high-volume rule that blocks, and blocking is often turned off after the first complaint. A notify-only rule lets the email go and tells someone afterwards, so the data is already outside by the time anyone reads the alert. That is useful while tuning; it is not protection.
Why it matters
A rule that only reports lets the data go and tells someone afterwards. Blocking is what keeps a list of card numbers from reaching an outside address in the first place.
A typical case: a payroll officer sends the monthly payroll file, with 150 people’s salaries and bank details, to the wrong outside address picked by autocomplete. The DLP rule matched and emailed the IT mailbox, but did not block. The file was delivered, cannot be recalled from an outside mailbox, and the business has a personal data breach to assess and possibly report to the ICO within 72 hours.
Every one of those 150 people may have to be told, and the business has to show the ICO what it did to prevent it. A rule that blocks, with an override and a business reason for genuine needs, would have stopped the email and kept a record of any decision to send.
CISA SCuBA MS.DEFENDER.4.3v1 asks that the DLP policy blocks sharing of sensitive information with everyone, and ISO 27001 A.8.12 expects leakage to be prevented, not only recorded.
How to fix it
Where: Microsoft Purview portal → Data loss prevention → Policies
Before you start
- Decide where people may override a block with a business justification, so legitimate work is not stopped.
- Check the matches in Activity explorer first to avoid blocking false positives.
Step by step
- List the rules and what they do. Connect to Security & Compliance PowerShell (Install-Module ExchangeOnlineManagement, then Connect-IPPSSession) as a Compliance Administrator. Run Get-DlpComplianceRule | Select-Object Name, ParentPolicyName, Disabled, BlockAccess, BlockAccessScope. Only the enabled rules of enforced policies count; note each without BlockAccess True and scope All.
- Check each rule’s matches before it blocks. In the Purview portal, go to Solutions > Data loss prevention > Explorers > Activity explorer, filter on each rule, and check what it matched over the last few weeks. Tighten any rule that catches ordinary work before turning blocking on, or staff will learn to override it by reflex.
- Set each rule to block everyone. Go to Data loss prevention > Policies, select the policy and choose Edit policy, continue to the advanced rules page and edit each rule. Under Actions, add "Restrict access or encrypt the content in Microsoft 365 locations", tick the option that blocks users from receiving email or accessing shared SharePoint, OneDrive and Teams files, and choose "Block everyone". Save the rule.
- Allow overrides where people genuinely need to share. In the same rule, under user overrides, allow overrides from Microsoft 365 services and require a business justification, for the rules where blocking would stop legitimate work. Overrides need user notifications on (see NL-PVW-105). Then save and submit the policy.
- Or set the action in PowerShell. Run Set-DlpComplianceRule -Identity "<rule name>" -BlockAccess $true -BlockAccessScope All for each rule.
- Confirm the change. Rerun Get-DlpComplianceRule | Select-Object Name, ParentPolicyName, BlockAccess, BlockAccessScope: every enabled rule of the enforced policies shows True and All. Send a test email with the words "credit card" and the test number 4111 1111 1111 1111 to an outside address: it is blocked, with the override option where you allowed it.
What users will notice
Sharing that matches a rule is blocked for everyone it is shared with, unless the person overrides it where allowed.
How to confirm it worked
Get-DlpComplianceRule | Select-Object Name, BlockAccess, BlockAccessScope shows True and All for every rule of the enforced policies.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.b Data in transitB3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of informationC1.1 Identifying and maintaining confidential information |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.8.12 Data leakage prevention |
| CISA SCuBA | MS.DEFENDER.4.3v1 The DLP policy blocks sharing sensitive information with everyone |
| CIS Controls v8.1 | 3.13 Deploy a data loss prevention solution (IG3) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- DLP policy reference: actions (Microsoft Learn)