What this check looks at
Checks, in Microsoft Purview directly, that at least one data loss prevention (DLP) policy is switched on and enforced, rather than only in test mode.
A Microsoft Purview data loss prevention (DLP) policy watches for sensitive information, such as payment card numbers, National Insurance numbers, bank details or health data, in the locations it covers, and acts when content matches: a policy tip, an email to the sender or an administrator, or blocking the email or the shared file. Each policy has a mode: on (Enable), simulation (TestWithNotifications or TestWithoutNotifications), or off. In simulation it only records what it would have done.
The check reads the DLP policies directly from Microsoft Purview. It passes when at least one policy is switched on and in Enable mode. It fails when there are no DLP policies at all, or when every policy is off or in simulation, and warns when a policy came back without whether it is on.
Simulation is meant to be a short trial, but many tenants create a policy from a template, leave it in simulation "for now" and never come back. Until a policy is enforced, nothing stops someone emailing a spreadsheet of card numbers to a personal address, sharing a payroll export by link, or a compromised account sending a client folder to an attacker. The match may show up in Activity explorer, but by then the data has gone.
Why it matters
A DLP policy in test mode only reports what it would have stopped. Until one is enforced, a spreadsheet of card numbers or personal data can still leave by email or a sharing link.
A typical case: a consultant at a 70-person recruitment firm emails a candidate database export, with names, addresses and National Insurance numbers, to their personal Gmail before resigning. A DLP policy in simulation records the match; nobody reviews it, and the firm learns what happened when the consultant’s new agency starts contacting the same candidates.
That is a personal data breach the firm may have to report to the ICO within 72 hours and explain to every candidate affected; for card data, it also has to explain itself to its card acquirer under PCI DSS. An enforced policy would have stopped the email and told the sender why.
CIS Microsoft 365 Foundations Benchmark 3.2.1 asks that DLP policies are enabled, and CISA SCuBA MS.DEFENDER.4.1v2 asks for a DLP policy protecting sensitive information. It is ISO 27001 control A.8.12 (data leakage prevention). Microsoft 365 Business Premium and E3 include DLP for Exchange, SharePoint and OneDrive.
How to fix it
Where: Microsoft Purview portal → Data loss prevention → Policies
Before you start
- Review the policy’s matches in test mode (Activity explorer) for at least two weeks and tune rules that match too much.
- Tell staff what the policy blocks and how to ask for an override.
Step by step
- See the policies and their modes. In the Microsoft Purview portal, go to Solutions > Data loss prevention > Policies and note each policy’s status. Or in PowerShell: Connect to Security & Compliance PowerShell (Install-Module ExchangeOnlineManagement, then Connect-IPPSSession) as a Compliance Administrator. Then run Get-DlpCompliancePolicy | Select-Object Name, Mode, Enabled.
- If there is no policy, create one in simulation. On Policies, select Create policy and choose the data stored in connected sources. Pick a template in the Financial or Privacy categories that fits what the business holds (for example U.K. Financial Data, or PCI Data Security Standard (PCI DSS)), name it, keep Full directory, and set Exchange email, SharePoint sites and OneDrive accounts to All. Keep the template’s rules, with policy tips and blocking for content shared outside the organisation. Choose "Run the policy in simulation mode" with policy tips shown, and submit.
- Review what the policy matched. Go to Data loss prevention > Explorers > Activity explorer and filter on Activity "DLP rule matched" and the policy name, over at least the last two weeks (the policy’s simulation view shows the same). Look at a sample of matches: real sensitive data, or false alarms such as order numbers that look like card numbers?
- Tune rules that match too much. Edit the policy and open each rule: raise the instance count (for example ten or more card numbers for the blocking rule), require high confidence, and add exceptions for known flows such as the payroll bureau’s domain ("Recipient domain is"). Keep the condition that content is shared with people outside the organisation.
- Turn the policy on. Edit the policy, move through to the Policy mode page, choose "Turn the policy on immediately" and submit. In PowerShell: Set-DlpCompliancePolicy -Identity "<policy name>" -Mode Enable. Tell staff what is now blocked and how to override with a business reason where allowed.
- Confirm the change. Get-DlpCompliancePolicy | Select-Object Name, Mode, Enabled shows Mode Enable and Enabled True for the policy. Send a test email to an outside address containing the words "credit card" and the test number 4111 1111 1111 1111 with an expiry date: it is blocked or shows a policy tip, and the match appears in Activity explorer.
What users will notice
Messages and files that match the policy are blocked or need a business justification, with a policy tip explaining why.
How to confirm it worked
Get-DlpCompliancePolicy | Select-Object Name, Mode, Enabled shows Mode Enable for the policy; send a test message with sample data and check it is blocked.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.b Data in transitB3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of informationC1.1 Identifying and maintaining confidential information |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.8.12 Data leakage prevention |
| CISA SCuBA | MS.DEFENDER.4.1v2 A custom DLP policy protects sensitive information |
| CIS M365 | 3.2.1 Ensure DLP policies are enabled |
| CIS Controls v8.1 | 3.13 Deploy a data loss prevention solution (IG3) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Learn about data loss prevention (Microsoft Learn)