Identity and security
DLP
Data Loss Prevention
Data Loss Prevention, delivered in Microsoft's ecosystem primarily through Microsoft Purview, is a policy framework for detecting sensitive content, such as credit card numbers, national insurance numbers, health records, or custom pattern-matched data.
Why DLP matters in a Microsoft estate
DLP matters because identity, access, endpoint, and data controls shape how Microsoft environments are protected. Readers should understand the term and then be able to move into security assessment, conformity, or remediation guidance.
How DLP shows up in practice
It controls what happens when that content is about to leave a managed boundary, whether that boundary is an email being sent externally, a file being shared from SharePoint or OneDrive, a message posted in Teams, or a document being copied to USB media or printed from a managed endpoint. Detection relies on sensitive information types, which are pattern- and keyword-based definitions Microsoft maintains and organisations can extend, alongside trainable classifiers that use machine learning to recognise content types like resumes or source code that do not reduce cleanly to a regular expression. Detection can also key off sensitivity labels applied through Microsoft Purview Information Protection, so a document already labelled 'Confidential' can trigger stricter DLP handling than an unlabelled one, regardless of its literal content.
Policy actions sit on a spectrum: from silent audit-only logging, useful for understanding what a policy would actually catch before it starts blocking anyone, through user-facing policy tips that warn and allow an override with a business justification, to hard blocks that prevent the action outright. Getting this escalation path right matters enormously in practice, because a DLP rollout that jumps straight to blocking, before its detection accuracy has been tuned against real organisational data, tends to generate enough false positives and user friction that people either request bulk exceptions or find workarounds that defeat the policy's purpose entirely. Endpoint DLP extends the same policy engine onto Windows devices themselves through the Defender for Endpoint sensor, catching copy-to-USB, copy-to-network-share, and clipboard actions.
DLP for the Edge browser and for on-premises repositories through the Microsoft Purview scanner extend coverage further. A mature deployment is therefore rarely a single policy, but a coordinated set spanning email, cloud storage, endpoint, and browser. The connection to insider risk is direct: Purview's Adaptive Protection can raise DLP enforcement automatically for a user already flagged as elevated risk by Insider Risk Management, tightening controls exactly where they are statistically most needed rather than applying uniform friction to every user regardless of behaviour. Full DLP capability generally requires Microsoft 365 E5 Compliance or the equivalent add-on. Organisations frequently discover, only once running compliant policies for a regulatory audit or a contractual data-handling requirement, that their licence tier only ever supported a much narrower subset of what DLP is capable of.