Microsoft 365

How to Monitor Data Loss Prevention Activities in Microsoft 365

Are you confident your sensitive data is truly protected? Having data loss prevention (DLP) policies in place isn’t enough. A DLP policy that limits OneDrive sharing but allows unauthorized file transfers via SharePoint Online can create security gaps. Without monitoring DLP settings and changes, you might overlook security risks or data leakage. This guide helps you audit your Microsoft 365 DLP policies, identify potential vulnerabilities, optimize data protection policies, and maintain regulatory compliance.

Audit Data Loss Prevention Policy Changes in Purview Portal

Microsoft 365 Permission Required

View-Only Audit Logs role Least Privilege

Global Admin Most Privilege

Log in to the Microsoft 365 Purview portal.
Navigate to the 'Audit' page under Solutions.
Now, customize the date and time range as required. Then, enter the following operations as comma-separated values in the Activities - operation names field.

New-DlpCompliancePolicy, New-DlpComplianceRule, Set-DlpCompliancePolicy, Set-DlpComplianceRule, Remove-DlpCompliancePolicy, Remove-DlpComplianceRule
Now, click on "Search". Once completed, open the result to access the DLP policy operations report.

Audit Data Loss Prevention Policy Changes in Purview Portal

Here you can view all the DLP policy-related activities such as creations, modifications, and deletions that have been made within your organization.

Monitor Changes to DLP Policies Using PowerShell

Microsoft 365 Permission Required

View-Only Audit Logs role Least Privilege

Global Admin Most Privilege

Connect to the Exchange Online PowerShell module using the cmdlet below.
Windows PowerShell
```
 Connect-ExchangeOnline
```
Run the below PowerShell cmdlet to get all the DLP policy operations in Microsoft 365.

 Windows PowerShell 
 Search-UnifiedAuditLog -StartDate "MM/DD/YYYY" -EndDate "MM/DD/YYYY" -Operations New-DlpCompliancePolicy, New-DlpComplianceRule, Remove-DlpCompliancePolicy, Remove-DlpComplianceRule, Set-DlpCompliancePolicy, Set-DlpComplianceRule | Format-Table -Property CreationDate, Operations, UserIds, RecordType, AuditData

Replace 'MM/DD/YYYY' with the desired start and end dates to filter logs for a specific period.

Monitor Changes to DLP Policies Using PowerShell

The above cmdlet displays all DLP policy-related activities in Microsoft 365, including the creation date, operations, user IDs, and record type.

Audit Data Loss Prevention Policies Using AdminDroid
Simple & Quick

AdminDroid Permission Required Delegated

Any user with report access delegated by the Super Admin.

Log in to the AdminDroid Office 365 reporter.
Navigate to the Data Loss Prevention Policies and Rules report under Audit»Security and Compliance»Data Loss Prevention»DLP Policies.
Simply use the easy filter option to refine operations related to DLP policy and rule changes.
This report allows you to audit DLP policies and rule-based changes to help protect sensitive information in your organization.

Here, you can view details about the operations performed on DLP policies and rules, including the time of the operation, the performer, the result status of the operation, and more.

Audit Data Loss Prevention Policies Using AdminDroid

AdminDroid Office 365 DLP Reporter

Monitor your Microsoft 365 DLP changes and rule configurations like a pro!

AdminDroid's M365 data loss prevention auditing provides detailed reports on DLP policy matches, configuration changes, and incident tracking. With these insights, admins can effortlessly monitor sensitive data flow, detect anomalies, and ensure compliance.

Track and Review DLP Configuration Changes

Audit DLP policy setting changes in Microsoft 365 with the DLP configuration changes report to see which policy was updated, who made the changes, etc.

Identify and Analyze False Positives in DLP Reports

Track teams messages detected by DLP rules to manage false positives in DLP and refine policy enforcement while reducing unnecessary alerts.

Stay Updated on Endpoint Restriction Changes

Keep up with endpoint restriction setting changes using the endpoint restriction settings report. Automate report scheduling to receive updates effortlessly.

Customizable SharePoint DLP Report with Easy Export

Export the SharePoint DLP rule detection report in multiple formats to track policy violations, monitor sensitive data exposure, and analyze trends in data protection to refine security policies.

Audit Admin Activities on DLP Detection Reports

Stay updated on admin activities by reviewing DLP detection reports, which allows you to audit admin access, monitor rule matches, and ensure transparent policy enforcement.

Ensure Compliance with EDM Policy Audits

Review activities tied to Exact Data Match (EDM) schema policies and rules to monitor modifications, validate enforcement, and safeguard sensitive data.

In summary, AdminDroid's Microsoft 365 auditing tool provides a comprehensive view of all DLP-related activities. It helps administrators manage and monitor DLP activities efficiently with actionable insights.

Explore a full range of reporting options

Download Live Demo

Important Tips

Update SharePoint Online DLP policies to enforce compliance by detecting and blocking unauthorized sharing of sensitive personally identifiable information (PII) across SPO sites.

Monitor email messages flagged by Data Loss Prevention policies using the Get-MailDetailDlpPolicyReport cmdlet to detect violations and ensure confidential data is handled securely.

Use DLP policy rule matches to audit real-time SharePoint file activities, detect incidents, and quickly address potential data loss.

Common Errors and Resolution Steps

The following are the possible errors and troubleshooting hints while monitoring DLP policies and activities related to DLP enforcement in Microsoft 365.

Error Get-DlpComplianceRule : The term 'Get-DlpComplianceRule' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

The user may lack required roles (e.g., Compliance Administrator or Compliance Data Administrator) or may not be properly connected to the Security & Compliance Center PowerShell to run Get-DlpComplianceRule.

Fix To fix, assign the required role by going to the Microsoft Entra Admin Center → Roles & Administrators → select Compliance Administrator or Compliance Data Administrator → assign the role to the intended user.

Error Get-DlpSensitiveInformationType : No sensitive information types were found.

This issue occurs when no predefined or custom Sensitive Information Types exist in your tenant or when the user lacks the necessary roles (DLP Compliance Management, Compliance Administrator) to retrieve them.

Fix Verify if any sensitive information types exist in your Microsoft 365 environment. If none exists, create a custom sensitive information type.

// Run the following cmdlet to check if any sensitive information types exist.
Get-DlpSensitiveInformationType | Select-Object Name, Publisher
// Run the following cmdlet to create a custom sensitive information type. (If None Exist)
New-DlpSensitiveInformationTypeRulePackage -FileData (Get-Content "C:\Path\to\CustomRule.xml" -Raw -Encoding UTF8)

Error New-DlpComplianceRule : Parameter 'AdvancedRule'. Cannot convert value to type System.String.

The -AdvancedRule parameter of the New-DlpComplianceRule cmdlet expects a single string as input, but using the Get-Content cmdlet without proper handling returns an array of strings, which leads to this error.

Fix Convert the array of strings into a single string by appending Out-String to the Get-Content cmdlet. For example:

$data = Get-Content -Path "C:\Data\SensitiveType.txt" -ReadCount 0 | Out-String 
New-DlpComplianceRule -Name "Contoso Rule 1" -Policy "Contoso Policy 1" -AdvancedRule $data -NotifyUser <UserUPN>

Microsoft 365

Frequently Asked Questions

Gain Visibility and Control Over Data Loss Prevention Activities in Microsoft 365

What is data loss prevention and why is it important in Microsoft 365?

How to configure data loss prevention policies in Microsoft 365?

How to create and manage DLP policies using PowerShell?

What are the key best practices for implementing data loss prevention policies?

What is a DLP alert and how can it be investigated?

What are DLP incident reports and where can they be accessed in Microsoft 365?

Can DLP policies automatically encrypt sensitive documents in SharePoint Online?

1. What is data loss prevention and why is it important in Microsoft 365?

Data loss prevention in Microsoft 365 is a feature designed to identify, monitor, and safeguard your organization's data. It helps prevent accidental sharing, unauthorized access, data leakage, or misuse of critical information.

DLP detects sensitive data, such as credit card numbers, Social Security numbers, or confidential business details. It then applies defined policies to protect this sensitive data while controlling access and sharing.

Common causes of data loss in Microsoft 365:

Understanding these common causes helps organizations implement effective DLP measures to protect sensitive information.

Accidental Sharing - Employees may mistakenly send sensitive files to unauthorized recipients.
Insider Risks – Malicious insiders could deliberately leak confidential data to external parties.
Security Dangers - Cyberattacks, such as phishing, malware, spam, and spoofing can compromise sensitive information.
Cloud and Personal Device Risks - Increased usage of cloud applications and Bring Your Own Device (BYOD) practices can increase the risk of uncontrolled data access.

Why every organization needs data loss prevention in Microsoft 365?

Organizations manage large volumes of sensitive information, including customer data, employee records, financial details, etc. Without a robust DLP solution, they face significant risks such as data breaches, insider threats, regulatory non-compliance, legal penalties, operational disruptions, and reputational damage.

Implementing DLP in Microsoft 365 helps mitigate these risks by performing the following key functions:

Classifying Sensitive Information – Identifies sensitive items using deep content analysis and applies labels to enforce appropriate protection measures.
Automating Remediation for Policy Violations – Detects policy breaches and applies corrective actions without manual intervention.
Enforcing Access Restrictions – Ensures only authorized users can access or share sensitive data.
Applying Encryption – By integrating DLP with Microsoft Purview Information Protection, organizations can apply sensitivity labels to classify and encrypt sensitive data.
Achieving Regulatory Compliance – Helps organizations to meet legal requirements such as GDPR, HIPAA, and PCI-DSS.
Protecting Organizational Reputation – Prevents data leaks that could damage customer trust with financial or reputational harm.
Preventing Data Breaches – Monitors and controls data flow to stop unauthorized exposure of sensitive data.

Native ways of monitoring Microsoft 365 DLP have limitations. These include restricted data retention (e.g., 180 days), limited advanced features without higher-tier licenses, complex policy configuration, and less detailed reporting on policy violations.

2. How to configure data loss prevention policies in Microsoft 365?

Default DLP settings may not cover all scenarios, leaving gaps that could lead to accidental data exposure. To mitigate these risks, organizations should customize DLP policies to align with their security and compliance needs. Follow these steps to configure DLP policies in Microsoft Purview.

Log in to the Microsoft Purview compliance portal and navigate to Solutions > Data Loss Prevention to open the DLP dashboard.
Under the Policies section, click ‘Create Policy’ to begin. On the template selection page, either choose a pre-built template (e.g., HIPAA, PCI-DSS) or select 'Custom' for a tailored policy. Click Next to proceed.
Provide a name (e.g., 'Safeguard Financial Data') and a description for clarity, then click Next.
Now, on the ‘Assign admin units’ page, add or remove admin units based on your organizational needs.
Choose the locations to apply the policy, such as Exchange email, SharePoint sites, OneDrive accounts, Teams chats, or Windows devices. Select all or specific locations, then click Next.
Define conditions in the DLP rule creation step to monitor sensitive data like credit card numbers or Social Security numbers. Adjust settings for internal or external sharing, save the rule, and click Next to proceed.

(Note: If you’re using a template, the conditions will be pre-filled. For custom policies, you’ll need to manually configure the rules (e.g., Block content containing more than five instances of PII).
Choose what happens when the policy detects a violation:

Actions: Click the "Add an action" drop-down and select "Restrict Access" to block sharing or limit access to specific users based on policy rules.
User Notifications: Toggle on the option to display a pop-up tip for alerting users when they interact with sensitive data.
Incident Reports: Switch on the toggle button to notify administrators via email whenever a policy violation occurs.

Additionally, enable 'User Overrides' if you want to allow users to bypass restrictions in Microsoft 365 files and Microsoft Fabric items (including Power BI, Exchange, SharePoint, OneDrive, and Teams) when necessary.
Customize notifications or override options as needed, then click Save.
Optionally, on the 'Policy mode’ page, run the policy in test mode to review results without enforcement. Choose whether to show policy tips during testing, then click Next.
Review the settings and click 'Submit' to save the policy. It can be set to ON immediately. Leave it OFF to activate later from the DLP dashboard.

3. How to create and manage DLP policies using PowerShell?

To automate tasks, manage policies in bulk, and ensure consistency across multiple workloads, you can configure DLP policies using PowerShell. It also streamlines policy deployment and reduces manual effort.

Use the Connect-IPPSSession cmdlet to connect to Security & Compliance Center PowerShell before executing the following key DLP operations.

Create a New DLP Policy

Use the New-DlpCompliancePolicy cmdlet to create a new DLP policy in Microsoft 365 as shown below.

New-DlpCompliancePolicy -Name "<PolicyName>" -ExchangeLocation "<MailboxUPN>" -OneDriveLocation "<OneDriveURL>" -SharePointLocation "<SiteURL>" -Mode "<Enable/Audit/Disable>" -Priority "<Value>"

📌 Replace <PolicyName> with a descriptive name that aligns with your data protection strategy. Use 'Enable' mode to enforce the policy or 'Disable' to turn it off.

Define Rules for the DLP Policy

After creating a policy, use this command to define rules that specify conditions and actions for content protection.

New-DlpComplianceRule -Name "<RuleName>" -Policy "<PolicyName>" -ContentContainsSensitiveInformation @("<SensitiveInfoType>") -BlockAccess $true -NotifyUser "<Owner/User>"

📌 Replace <SensitiveInfoType> with the type of sensitive data you want to monitor, such as “U.S. Social Security Number (SSN)” or “Credit Card Number.”

Modify an Existing DLP Policy

To modify an existing policy, update its mode or other attributes as needed.

Set-DlpCompliancePolicy -Identity "<PolicyName>" -Mode "<Enable/Audit/Disable>"

📌 Use <Audit> mode to test policy behavior before enforcement. Replace <PolicyName> with the name of the policy you want to modify.

4. What are the key best practices for implementing data loss prevention policies?

DLP policies play a crucial role by monitoring sensitive data at rest, in transit, or in use and enforcing protective measures. When an unauthorized action occurs, like emailing medical records or uploading confidential files to an unapproved cloud, DLP blocks or restricts access to enhance data security.

By configuring DLP policies in Microsoft 365, organizations can proactively safeguard sensitive data, maintain compliance, and control how information is accessed and shared.

Essential Microsoft DLP Best Practices for Secure Data Protection

Define Clear Data Protection Goals: Identify sensitive data, determine storage locations such as OneDrive, SharePoint Online, Exchange Online, and Microsoft Teams. Subsequently, establish appropriate enforcement rules and begin with testing mode before applying restrictions.
Utilize Predefined Templates and Customize Policies: Leverage built-in DLP templates for compliance standards such as GDPR and HIPAA. Modify DLP rules based on specific business needs and test policies before enforcement.
Conduct Regular Policy Audits and Adjustments: Continuously evaluate and fine-tune DLP policies using incident insights, simulated tests, and adaptations to new security threats.
Maintain a Balance Between Security and Productivity: Enable policy tips in Outlook, Teams, and OneDrive to inform users about potential violations. Implement controlled exceptions for internal communications while restricting external sharing in Microsoft 365.
Extend DLP Beyond Emails and Documents: Apply DLP policies to Teams chats, cloud applications, and endpoints to prevent unauthorized data transfers via chat messages, USB devices, and print operations.
Automate Classification with Sensitivity Labels: Use sensitivity labels to categorize and protect information automatically. Labels such as "Confidential" or "Internal Use" ensure consistent enforcement across all platforms.
Implement Conditional Access for Risk-Based Protection: Enhance DLP policies by incorporating risk-based conditional access policies in Microsoft Entra ID. Enforce access restrictions based on user risk levels, require multi-factor authentication (MFA), or block access from unmanaged devices when necessary.
Enable Real-Time Alerts and Incident Reporting: Set up alerts for high-risk data activities and configure automated remediation actions for policy violations. Regularly review DLP incident reports for continuous improvement.

An effective DLP strategy in Microsoft 365 requires proactive monitoring, automated enforcement, and continuous refinement. Regular audits and policy optimizations help strengthen data security while minimizing disruptions.

5. What is a DLP alert and how can it be investigated?

A data loss prevention alert is triggered when an action involving sensitive data violated organizational policies, such as sharing restricted content or transferring files to unauthorized locations. These alerts provide actionable information about policy violations so that organizations can take immediate actions to remediate and prevent recurrence.

Note: The least privilege required to investigate DLP alerts in Microsoft 365 is the Security Reader role. Additionally, a Microsoft 365 E5 license is necessary to access advanced DLP alerts.

How to investigate DLP alerts in Microsoft Purview Compliance portal?

Data loss prevention alerts help organizations identify and mitigate sensitive data handling incidents. They can be investigated and managed using two primary tools:

To analyze and manage DLP alerts in Microsoft Purview,

Go to the Alerts page under the Data Loss Prevention section.
Use filters to refine the alerts list and customize columns for relevant details.
Select an alert to view details in the Details tab.
Use Security Copilot to generate a summary, including alert severity, policy match, file name, and user details.
Select View details to open the Overview tab to get a summary of what happened and who triggered the alert.
Check the Events tab to review associated events and take necessary actions (e.g., verifying true/false matches).
If insider risk management is enabled, view user activity history in the User activity summary tab (up to 120 days).
Triage and manage alerts by adding comments, assigning ownership, and setting the status to Resolved.

How to investigate DLP alerts in Microsoft defender XDR dashboard?

To investigate DLP alerts in Microsoft Defender XDR, navigate to the Incidents & Alerts section and filter by Service/detection sources: Microsoft Data Loss Prevention to focus on Data Loss Prevention-related events.

This allows you to review incidents, analyze policy details, and perform deeper investigations using built-in queries. Based on the alert type, you can take necessary actions such as restricting file access, applying sensitivity labels, or retrieving related emails for further analysis.

AdminDroid simplifies monitoring with intelligent alerts that feature granular customization to target critical changes and AI-powered filters to eliminate noise and boost relevance.

The All DLP Rule Matches report provides visibility into all DLP rule matches across Microsoft 365 services. This helps safeguard sensitive data by tracking policy violations and potential risks.
Stay informed by setting up alerts using the bell icon (🔔) in the top-right corner.

This ensures you receive timely notifications for critical DLP events, which allow for swift action and enhanced data protection.

6. What are DLP incident reports and where can they be accessed in Microsoft 365?

Data loss prevention incident reports provide a clear overview of policy violations involving sensitive data in an organization. These reports help admins monitor and analyze cases where DLP policies detected the sharing of sensitive information, such as employee records, business strategies, contract details, or other confidential data.

Why is it important to monitor DLP incident reports?

Monitoring DLP incident reports is crucial for several reasons:

Threat Detection – Helps identify policy violations and potential data leaks before they escalate.
Incident Response & Remediation – Enables swift action to mitigate security risks and prevent future breaches.
Audit & Accountability – Provides transparency into policy enforcement and user actions involving sensitive data.
Policy Effectiveness & Optimization – Helps evaluate DLP policy performance and make necessary adjustments to reduce false positives and enhance security.

1. Get DLP incident reports using Microsoft Purview Compliance portal:

Monitor DLP incident reports in Microsoft Purview by filtering for 'DLPRuleMatch' events on the Activity Explorer page. This method provides a centralized view of DLP violations with advanced filtering for analysis. However, a key limitation is the 30-day retention period, meaning additional solutions are needed for long-term data access.

💡Note- Incident reports and advanced DLP analytics require an E5 license or the Microsoft 365 Compliance add-on license.

2. Access DLP incident detail report using powershell:

The deprecation of the Get-DlpIncidentDetailReport cmdlet, creates a significant limitation in tracking and reviewing incidents beyond 30 days.

To overcome this, you can use the PowerShell script below that was developed to audit DLP-detected messages and offer intuitive filtering options for better analysis.

AuditDLPRuleMatch.ps1

If you wish to get the Exchange-related DLP rule match report, run the script with the WorkloadCategory parameter set to 'Exchange'.

With AdminDroid, retention is never a concern! It pulls up historical audit data upon installation and continues accumulating data indefinitely. This ensures that incident reports remain accessible anytime without restrictions.

AdminDroid’s DLP Rule Detected Mails report provides a detailed view of emails that match DLP rules. It includes rich filters and customizable columns for in-depth analysis.
Plus, exporting reports is effortless with multiple formats options such as HTML, PDF, CSV, XLS, XLSX, and RAW.

PRO TIP: To explore any report in AdminDroid, hit 'Ctrl + Shift + F' and type fewer related keywords about the required report. It will show you the related reports.

7. Can DLP policies automatically encrypt sensitive documents in SharePoint Online?

No, DLP policies in SharePoint Online do not automatically encrypt sensitive documents. They primarily focus on detecting and preventing data loss, not encryption. However, DLP policies in Microsoft 365 can work alongside Microsoft Purview Information Protection to enforce sensitivity labels, which apply encryption and access restrictions based on detected sensitive data.

If you're looking for automated encryption, consider setting up auto-labeling policies with sensitivity labels, which can apply encryption based on content inspection.

What are Microsoft 365 sensitivity labels, and how do they work in DLP?

Sensitivity Labels in the Microsoft 365 helps to classify and protect sensitive data by assigning security policies to files and emails. When a document or email is labeled, DLP policies can detect the label and enforce actions such as:

Blocking external sharing or unauthorized access..
Encrypting content to restrict unauthorized viewing.
Triggering policy violation alerts when sensitive data is accessed or shared improperly.
Applying retention policies for regulatory compliance.

By integrating sensitivity labels with DLP, organizations can ensure that sensitive information is classified, protected, and monitored across Microsoft 365 apps.

Facing challenges in tracking sensitive information DLP rules? AdminDroid has you covered!

AdminDroid’s DLP sensitive information type rules report provides an audit trail of changes to DLP rules. It tracks when sensitive information type rules are added, modified, or removed by administrators.
It also helps monitor detected sensitive data. While DLP policies don’t encrypt files, this report supports security by identifying sensitive data and aiding in enforcing sensitivity labels for encryption.

audit-dlp-sensitive-information-type-rules