Week 7, Day 4 — Data Loss Prevention

Day 3 review & the data exfiltration gap

• Ask: "The attack simulation showed that 3 out of 10 Lakeview Logistics users clicked a phishing link. Priya Nair (Finance Manager) was one of them. Priya has access to spreadsheets with Lakeview's payroll data and customer credit card numbers. What is the risk if she is compromised — not just to Priya's account, but to that data?" — the data itself can leave the organisation, either by an attacker exfiltrating it or by a compromised user accidentally sending it.
• Ask: "Tom Bellamy (Accountant) accidentally attaches a spreadsheet with 50 customer credit card numbers to an email and sends it to a client contact. Which of this week's controls would have caught that?" — none so far. Safe Attachments inspects for malware, not for sensitive data patterns. The data left the organisation unchallenged.
• Frame: DLP is the data governance layer. It scans content for sensitive information patterns — credit card numbers, bank accounts, national ID numbers, health data — and intercepts transfers based on policy. One DLP policy covers Exchange, SharePoint, OneDrive, and Teams simultaneously. Students who configured each of those workloads separately now see unified cross-workload data governance in a single policy.

DLP architecture — conditions, actions, policy tips, and endpoint DLP

How a DLP policy evaluates content

• Sensitive Information Types (SITs) — Microsoft's library of 300+ pre-built patterns for detecting sensitive data: credit card numbers (all major networks), bank account numbers (country-specific), national ID numbers, passport numbers, health data, and many more. Each SIT uses a combination of regular expressions, keyword proximity, and checksum validation. You can also create custom SITs with your own regex patterns. For Lakeview Logistics the relevant SITs are Credit Card Number and New Zealand Bank Account Number.
• DLP policy structure — a policy contains one or more rules. Each rule has: conditions (what must be true for the rule to fire — SIT match, volume threshold, sender/recipient), exceptions (conditions that override the rule), and actions (what happens when conditions are met). Rules fire in priority order — the first matching rule determines the action.
• Actions — four main types: Block (prevent send/share entirely), Block with override (block but allow user to override with a business justification), Restrict access (remove sharing permissions on a file), Notify only (audit the event and notify the user or admin but allow the action). Starting with Notify only is a best practice for new policies — it lets you measure how often the policy would fire before enforcing blocks.
• Policy tips — inline notifications shown to users in Outlook, Word, Excel, SharePoint, and Teams when their content matches a DLP rule. The user sees a banner before sending or sharing, informing them that the content may violate policy. Policy tips are the most important user-facing feature of DLP — they turn DLP from an invisible background process into an educational tool that teaches users what not to share.
• Endpoint DLP — extends DLP policy enforcement to the device level, applying to Windows 10/11 devices enrolled in Intune and onboarded to Defender for Endpoint. Endpoint DLP can monitor and restrict: clipboard copy to unauthorised apps, USB device transfers, printing to non-corporate printers, uploading to non-sanctioned cloud storage, and accessing files in specific network shares. It requires the same Intune + MDE onboarding completed in Week 6 and Day 2.
• DLP workload coverage — a single Purview DLP policy can apply to Exchange Online (email), SharePoint Online (document libraries), OneDrive (personal cloud storage), Microsoft Teams (chat and channel messages), Endpoint devices (WIN-CLIENT-01 with MDE), and Microsoft 365 Copilot. Students who configured each of these workloads separately across Weeks 3–6 now govern all of them with one policy.

Lab 7-D: Financial data DLP policy and endpoint DLP

Students enable the audit log (required for DLP alerts), create a cross-workload DLP policy protecting credit card and NZ bank account data, test it with a synthetic document, configure endpoint DLP to block USB transfers, and review DLP alerts in the Purview compliance portal.

• Step 1 — Enable the unified audit log (5 min)
  Navigate to purview.microsoft.com → Audit → Start recording user and admin activity (if not already enabled from the Secure Score action in Lab 7-C).
  This is a prerequisite for DLP alert generation. Without it, DLP policy matches are not logged and alerts do not appear.
• Step 2 — Create the financial data DLP policy (25 min)
  Navigate to purview.microsoft.com → Data loss prevention → Policies → + Create policy.
  · Template: Financial → Credit Card Number (Microsoft-provided template — review what it pre-configures)
  · Name: LL — Financial Data Protection
  · Locations: enable Exchange email, SharePoint sites, OneDrive accounts, Teams chat and channel messages, Devices
  
  Edit the policy rules. The template creates a default rule — review it, then customise:
  · Add a second SIT: New Zealand Bank Account Number (in addition to Credit Card Number)
  · Low volume rule (1–9 instances): Action = Notify user, send admin alert
  · High volume rule (10+ instances): Action = Block the content, notify user, send admin alert
  · Enable policy tips for Exchange (Outlook) and SharePoint/OneDrive
  · Mode: Turn the policy on immediately (not test mode)
  Save.
• Step 3 — Test the DLP policy with a synthetic document (15 min)
  Create a test document with synthetic credit card data. On WIN-CLIENT-01, open Notepad or Word and create a file with the following content (these are test numbers — not real card data):
  
  Customer: Tom Bellamy
  Card: 4111 1111 1111 1111 (Visa)
  Card: 5500 0000 0000 0004 (MC)
  Account: 01-0242-0100175-00 (NZ Bank)
  
  Save as Finance-Test.docx. Then test three scenarios:
  Test A — Email: Open Outlook on WIN-CLIENT-01. Compose a new email to an external address (e.g. a personal email or made-up external address). Attach Finance-Test.docx. Observe the policy tip in the compose window.
  Test B — SharePoint: Upload Finance-Test.docx to the Finance SharePoint site document library. Wait 2–5 minutes. Check whether sharing is restricted and whether a DLP alert appears.
  Test C — Teams: Open Teams and attempt to share Finance-Test.docx in the Finance team channel. Observe the DLP notification.
• Step 4 — Configure endpoint DLP for USB blocking (15 min)
  Navigate to purview.microsoft.com → Data loss prevention → Endpoint DLP settings.
  Confirm WIN-CLIENT-01 appears in the Onboarded devices list (it should — onboarded to MDE in Lab 7-B).
  Return to Policies → LL — Financial Data Protection → Edit.
  Under Devices locations, add the following endpoint activity restriction:
  · Activity: Copy to a removable USB device → Action: Block
  · Activity: Upload to cloud service domains or access by unallowed browsers → Action: Audit only (observe before blocking)
  Save the policy update.
• Step 5 — Review DLP alerts in Purview (10 min)
  Navigate to purview.microsoft.com → Data loss prevention → Alerts.
  Review any alerts generated from the test scenarios in Step 3. Click an alert to explore:
  · Alert details: which policy and rule fired
  · Matched content: a preview of the sensitive data that triggered the match (redacted)
  · User: who performed the action
  · Workload: which service (Exchange/SharePoint/Teams)
  · Severity and status
  Record findings in the lab handout.

⭐ Bonus: Custom SIT and DLP activity explorer

Reflection & preview

• Ask: "Tom Bellamy accidentally emails the Finance-Test.docx to a client. DLP blocks it. He calls the helpdesk saying it's urgent — he needs to send this file right now. What are his options?" — he can override with a business justification (if the policy allows override), he can request the IT admin to create an exception, or the IT admin can temporarily exclude his account from the policy scope. All of these leave an audit trail.
• Ask: "Priya Nair's laptop is compromised. The attacker copies the Finance spreadsheet to a USB drive. Endpoint DLP is configured to block USB transfers. What happens?" — the copy is blocked on WIN-CLIENT-01. A DLP alert fires. An endpoint DLP event appears in Activity Explorer. The attacker fails to exfiltrate via USB but still has access to the file on the device — device isolation (Lab 7-B Bonus) becomes relevant here.
• Preview Day 5: DLP protects data in transit and in use. Sensitivity labels protect data at rest — they apply metadata and protection directly to files and emails, following them wherever they go. Day 5 introduces labels and then moves straight into the Week 7 assessment, which involves a combined incident: a phishing email that bypassed controls and a file that was shared externally without DLP catching it.