Download to read offline
Uploaded byNikki Chapple
Microsoft Purview Data Loss Prevention Deep Dive
Session| Microsoft Purview DLP Deep Dive Presenter | Nikki Chapple 2 x MVP and Principal Cloud Architect at CloudWay Event | Workplace Ninjas Norway Format | In Person | Oslo | Norway Date | 11 June 2025 As cyber threats and data breaches continue to evolve, safeguarding sensitive data within Microsoft 365 becomes increasingly critical. The integration of generative AI tools in business workflows further amplifies the risk of inadvertently exposing sensitive information. By deploying Microsoft Purview Data Loss Prevention (DLP) across Microsoft 365, organizations can better protect their sensitive data and mitigate the risks associated with accidental and malicious oversharing. This session is a hands-on demo on configuring and deploying Microsoft Purview DLP policies across Microsoft 365 apps, endpoints, and Copilot integrations to protect sensitive data and mitigate oversharing. Covering - What is DLP - Licensing - Onboarding devices into Purview for EndPoint DLP - Block Unauthorised Browsers - Add Purview Browser Extension - Set up Adaptive Protection - Explain DLP policy structure - Understanding sensitive data - Create separate DLP policies for each location - DLP settings - Demonstrated creating DLP Policies - Demonstrated end-user experience when DLP polices are triggered - DLP Analytics and Alerts
More Related Content
Similar to Microsoft Purview Data Loss Prevention Deep Dive
![[IGNITE2018] [BRK2495] What’s new in Microsoft Information Protection solutio...](https://cdn.slidesharecdn.com/ss_thumbnails/10h50mignite2018brk2495-181215035055-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Microsoft Purview Data Loss Prevention Deep Dive
- 1. #WPNinjasNO #WPNinjasNO DLP Deep Dive NikkiChapple | Principal Cloud Architect CloudWay | MVP
- 2. #WPNinjasNO Thank you sponsors GoldSponsors Silver Sponsors Community Sponsors
- 3. #WPNinjasNO About Nikki Chapple Focus MicrosoftPurview | Microsoft 365 From London | UK My Blog NikkiChapple.com All Things M365 Compliance podcast Contact Hobbies Holidays, learning Portuguese Certifications SC-300 | SC-401| Microsoft 365 Enterprise Administrator | TOGAF Enterprise Architect PROSCI Change Manager
- 4. #WPNinjasNO What is DLP Agenda PrerequisitesDLP Policies Examples Top Tips Data Loss Prevention (DLP) Intro DLP Prerequisites Create DLP Policies DLP Examples DLP Top Tips
- 5. #WPNinjasNO Data Loss Prevention(DLP) Intro
- 6. #WPNinjasNO Data Security iscritical for strong cybersecurity! Data security incidents are widespread and severe 20% Increase in severity of data security incidents compared to 2023 Insiders account for a large portion of data breaches, adding to costs 63% of data breach incidents stem from inadvertent, negligent, or malicious users2 80%+ of leaders cited leakage of sensitive data as their main concern around adopting Generative AI3 Source: 1Microsoft Data Security Index report 2Microsoft Data Security Index report 3First Annual Generative AI Study: Business Rewards vs. Security Risks, Q3 2023, ISMG, N=400 Organizations are concerned about data leak in Generative AI
- 7. #WPNinjasNO But securing datais complex Different types of data, users, and objectives AI transformation brings new data risk Regulations continue to evolve
- 8. #WPNinjasNO Data security controls Block endpoint Allowendpoint Block sensitive data Allow sensitive data Allow low risk user Block high risk user
- 9. #WPNinjasNO Minor risk Policy tips DLP Policy 3 DLP Policy2 Moderate risk Block with override DLP Policy 1 Elevated risk Block DLP policy match Endpoint patch required VM login compromised DLP Integrated insights and alerting 9 Know the context Leverage classification and labeling on sensitive data from Information Protection Understand the intent Automatically apply risk insights from Insider Risk Management to DLP policies Integrate alert investigation Integrate DLP alerts with Microsoft Defender XDR and Sentinel for richer investigation experience
- 10.
- 11. #WPNinjasNO DLP Prerequisites 1 23 4 Onboard Devices Deploy Purview browser extension Block access to unapproved browsers Configure Adaptive scopes 5 Licensing
- 12.
- 13. #WPNinjasNO E3/Business Premium E5 Compliance PAYG Files and EmailYes Yes N/A Teams No Yes N/A Endpoint No Yes N/A Adaptive scopes No Yes N/A Fabric No No Yes Non-Microsoft 365 locations No No Yes DLP Licensing modern-work-plan-comparison-enterprise.pdf modern-work-plan-comparison-smb5.pdf
- 14. #WPNinjasNO Onboard Devices intoPurview Process varies depending on how devices are managed
- 15. #WPNinjasNO If Devices enrolledin Intune
- 16. #WPNinjasNO One click onboarddevices into Purview
- 17. #WPNinjasNO If devices notmanaged by Intune Devices will report to Defender for Endpoint, even if a different antivirus or anti-malware solution is in use. In such cases, these systems will report to Defender for Endpoint in passive mode.
- 18. #WPNinjasNO Block Unauthorised Browsers Configuredin Intune > Device > Configuration
- 19.
- 20. #WPNinjasNO Users can onlyuser managed browsers
- 21. #WPNinjasNO Add Purview BrowserExtension Configured in Intune > Device > Configuration
- 22. #WPNinjasNO Add Purview BrowserExtension to Edge
- 23. #WPNinjasNO Add Purview BrowserExtension to Chrome Instructions
- 24. #WPNinjasNO Add Purview BrowserExtension to Firefox Instructions
- 25. #WPNinjasNO Tips Purview browser extensionfor Edge, Chrome & Firefox macOS devices do not require the extension Block other browsers Incognito mode isn't supported on Google Chrome and Firefox so it must be disabled
- 26. #WPNinjasNO Configure Adaptive Protection RequiresInsider Risk Management
- 27. #WPNinjasNO Insider risk level Continuously evaluate andpublish risk level Elevated risk Moderate risk Minor risk Data Loss Prevention Dynamically prevent unauthorized use Block action Block action, allow override Policy tip Conditional Access Dynamically prevent unauthorized access Block access Terms of use Data Lifecycle Management Dynamically preserve deleted files Preserve data Adaptive Protection
- 28.
- 29. #WPNinjasNO One-Click IRM policy– Visit AI site
- 30. #WPNinjasNO View users ateach risk level
- 31.
- 32.
- 33. #WPNinjasNO B D A C Plan andDesign Polices Business requirement Actions to Take What sensitive data to protect Where to Monitor
- 34. #WPNinjasNO Data Explorer -What sensitive data to protect
- 35.
- 36. #WPNinjasNO Only Exchange emailMultiple locations Common conditions Only SharePoint sites
- 37. #WPNinjasNO Actions Block Block with override WarnMonitor Allow
- 38. #WPNinjasNO Extend DLP beyondMicrosoft 365
- 39.
- 40.
- 41.
- 42.
- 43.
- 44.
- 45.
- 46.
- 47.
- 48.
- 49.
- 50.
- 51.
- 52.
- 53.
- 54. #WPNinjasNO Create One-Click Policiesin DSPM for AI
- 55. #WPNinjasNO 1. Create DLPPolicy to Block External Sharing for labelled content
- 56.
- 57. #WPNinjasNO 1. Block ExternalSharing for labelled content User Experience
- 58. #WPNinjasNO User experience –visual identifiers Block Warn
- 59.
- 60.
- 61.
- 62. #WPNinjasNO 2. Create DLPPolicy to Block device and browser actions for labelled content
- 63.
- 64. #WPNinjasNO Option to scopeto Devices and Users
- 65. #WPNinjasNO Endpoint DLP PolicyRules Rule Name Condition Action Block Copy to Clipboard If content contains label "Secret" Block copy to clipboard Block Copy to USB If content contains label "Secret" Block copy to removable USB Block Print If content contains label "Secret" Block print Block Upload to Restricted Cloud or Unallowed Browser If content contains label "Secret" Block upload to restricted domains or unallowed browsers
- 66. #WPNinjasNO Rule 1 –Block file activities
- 67. #WPNinjasNO Rule 2 -Block upload to 3rd Party Gen AI Apps
- 68. #WPNinjasNO Web site URLallow/block list If the DLP has a block action for Upload to a restricted cloud service domain or access from an unallowed browser. Then if there is an allow list for Service domains then only these sites can be accessed
- 69.
- 70. #WPNinjasNO 2. Block deviceand browser actions for labelled content User experience
- 71. #WPNinjasNO Copy to USBBlocked
- 72. #WPNinjasNO Block copy fromdocument
- 73. #WPNinjasNO Block upload to3rd party Gen AI site
- 74.
- 75. #WPNinjasNO Just In Timeactions
- 76.
- 77. #WPNinjasNO 3. Block Copilotprocessing for labelled content (Preview) Block access to Copilot if content contains specific sensitivity labels
- 78. #WPNinjasNO 3. Block Copilotprocessing for labelled content User Experience Block access to Copilot if content contains specific sensitivity labels
- 79. #WPNinjasNO Copilot does notwork in labelled file
- 80. #WPNinjasNO Copilot cannot uselabelled file as source
- 81. #WPNinjasNO Microsoft 365 Copilotcannot summarise content
- 82. #WPNinjasNO Microsoft 365 Copilotcan’t reference labelled file
- 83. #WPNinjasNO Copilot Agent cannotaccess content
- 84. #WPNinjasNO 4. Configure DLPPolicy with Adaptive protection Different controls based on risk
- 85. #WPNinjasNO View DLP Policiesusing Adaptive protection
- 86.
- 87. #WPNinjasNO DLP Alerts inPurview
- 88.
- 89. #WPNinjasNO DLP Alerts nowin Defender XDR
- 90. #WPNinjasNO Investigate Alert inDefender XDR
- 91.
- 92. #WPNinjasNO B D A C Design Policesbased on business requirements What sensitive data to monitor Actions to take Where to Monitor Conditions for match
- 93. #WPNinjasNO Statement Configuration questionanswered and configuration mapping "Contoso need to detect Office documents containing sensitive health care information covered by HIPPA... - What to monitor: Office docs, use the U.S. Health Insurance Act (HIPAA) template. - Conditions for a match: (preconfigured but editable) - item contains U.S. SSN and Drug Enforcement Agency (DEA) number, International Classification of Diseases (ICD-9-CM), International Classification of Diseases (ICD-10-CM), users share content with people outside my organization. - Drives conversations to clarify the triggering threshold for detection like confidence levels, and instance count (called leakage tolerance). ...that employees stored in OneDrive/SharePoint and protect against users sharing information in Teams chat and channel messages... - Where to monitor: Location scoping by including or excluding OneDrive and SharePoint sites and Teams chat/channel accounts or distribution groups. ...and restrict everyone from sharing these documents with unauthorized third parties." - Actions to take: You add Restrict access or encrypt the content in Microsoft 365 locations. - Drives conversation on what actions to take when someone triggers a policy. Protective actions may include sharing restrictions. Awareness actions may include notifications and alerts. User empowerment actions may include allowing user overrides of a blocking action. Design Polices based on business requirements
- 94.
- 95.
- 96.
- 97.