Microsoft Purview DLP Complete Design Guide: Sensitive Info Types, Endpoint DLP, Adaptive Protection, EDM

Microsoft Purview Data Loss Prevention (DLP) is a unified DLP service that prevents the unauthorized exfiltration of sensitive organizational data from Microsoft 365, SaaS apps, and endpoint devices. It centralizes policy definition, enforcement, and monitoring across Exchange / SharePoint / OneDrive / Teams / Endpoint, Defender for Cloud Apps (CASB), and Power Platform. It identifies sensitive data through a combination of Sensitive Information Types (SIT, 200+ built-in patterns including credit card numbers, SSNs, and Japanese My Number) plus Sensitivity Labels, and executes actions such as Block, Notify, Encrypt, or Allow with Justification. It is a core feature for compliance with GDPR, HIPAA, PCI DSS, APPI, and a key topic on the SC-400 exam.

A DLP Policy combines 'Locations (where applied) + Conditions (criteria) + Actions (response)'. Locations: Exchange Email, SharePoint Sites, OneDrive Accounts, Teams Chat and Channels, Devices (Endpoint DLP), Defender for Cloud Apps, Power BI, Fabric. Conditions: 1) Sensitive Info Type (200+ built-in plus custom), 2) Sensitivity Label applied, 3) Contextual conditions (recipient domain, recipients, attachment count, User Risk Level). Actions: Block (full send denial), Block with Override (send allowed with Justification), Notify User (Policy Tip display), Send Incident Report to Admin (SOC notification), Encrypt (auto-apply Rights Management), Quarantine. Standard pattern: tier policies so highly sensitive data is Blocked, medium-sensitivity data is Notify + Justification, and low-sensitivity data is Audit-only.

Microsoft Purview provides 200+ built-in SIT patterns. Examples: credit card numbers (16 types including Visa, MasterCard, American Express), social security numbers (US SSN, UK NINO, Japanese My Number), driver's license numbers, passport numbers, bank account numbers, medical record numbers, phone numbers, email addresses, addresses, IP addresses. Each SIT consists of 'Primary Pattern (regular expression), Supporting Element (proximity keywords), Confidence Level (High / Medium / Low), Minimum Confidence (detection threshold)'. Example: a credit card SIT detects a 16-digit number plus Luhn algorithm validation plus 'credit card' / 'payment' keyword proximity for a High Confidence match. When built-in SITs don't cover the requirement, create a Custom SIT (Regular Expression + Keyword List). Exact Data Match (EDM) enables matching against organization-specific databases, providing precise matches against large datasets such as employee ID lists or customer lists.

Endpoint DLP controls sensitive data operations on Windows 10/11 and macOS devices. Microsoft Intune manages target devices via Compliance, and the Defender for Endpoint Agent monitors on-device operations (USB copy, printing, Bluetooth, Cloud Sync, web browser upload, clipboard). Typical controls: 1) Block USB / Bluetooth copy of sensitive files, 2) Block personal Cloud Sync of sensitive files (Dropbox, Google Drive), 3) Block sensitive data uploads to web browsers (allow-list domains only), 4) Block screen capture of sensitive files, 5) Block printing of sensitive files. App-level control via Restricted Apps (only allowed apps can access sensitive data) and Restricted App Groups. For BYOD, combine with App Protection Policy to container-isolate personal data and corporate data. In production deployments, the standard is staged rollout starting with Audit rather than Block to avoid disrupting user workflows.

Adaptive Protection is a 'risk-based dynamic DLP' feature announced by Microsoft in 2023. It dynamically adjusts DLP Policy strength based on a user's Risk Level (Minor Risk, Moderate Risk, Elevated Risk) calculated by Insider Risk Management. Typical behavior: 1) Normal users (Minor Risk) → Audit + Notify, 2) Users with anomalous activity in the past 30 days (Moderate Risk) → enhanced Block with Override, 3) High Risk users → full Block + immediate SOC notification. Risk evaluation leverages machine learning, dynamically judging based on past anomalous patterns (mass file downloads, personal email sends, resignation notices). It evolves from traditional Static DLP (one Policy fits all) to risk-based graduated control, realizing 'usability and security balance' — the latest feature of Microsoft Purview.

Exact Data Match (EDM) is a mechanism for DLP to detect data that exactly matches organization-specific databases (customer lists, employee IDs, medical record IDs, etc.). Process: 1) Export Source Database to CSV (e.g., all customers' Email + Customer ID list), 2) Define EDM Schema (field names, Primary Element settings), 3) Upload Schema to Microsoft Purview Compliance Center + hash data (the original data is not uploaded, only hashes are stored in Purview), 4) Reference the EDM SIT in DLP Policy, 5) Re-upload EDM periodically when Source Database is updated. Typical use cases: 1) Customer PII exfiltration detection, 2) Unauthorized access to medical record IDs, 3) Employee SSN email send detection. It enables exact matches on organization-specific data that built-in SITs cannot detect, with a low false positive rate (higher precision than Pattern Match), greatly contributing to DLP accuracy in production.

Key practices: 1) Deploy in Audit mode → Tune → migrate to Block mode in stages (1-3 months to reduce false positives), 2) Two-layer defense by combining Sensitivity Label + DLP (DLP targets only labeled files), 3) Risk-based dynamic control with Adaptive Protection, 4) User education via Policy Tips (explain why blocked), 5) Endpoint DLP staged expansion from Office Apps to Restricted Apps, 6) Exact matches on organization-specific data with EDM, 7) Continuous DLP event monitoring in Activity Explorer, 8) Send DLP events to Microsoft Sentinel, anomaly detection with KQL, 9) Insider threat detection through integration with Insider Risk Management, 10) Quarterly Policy review + false positive analysis. In production, balancing business continuity with high detection accuracy is the challenge; careful staged rollout and continuous improvement are the keys to success.

SC-400 (Information Protection and Compliance Administrator Associate) is the primary certification for this area, deeply tested in Domain 2 (DLP 15-20%). SC-100 (Cybersecurity Architect Expert) covers the Data pillar of Zero Trust strategy, MS-102 (Microsoft 365 Administrator Expert) covers enterprise rollout in Domain 4 (Purview 20-25%), SC-300 (Identity Admin) covers Conditional Access App Control integration, and SC-200 (Security Operations Analyst) covers DLP event operations from the SOC perspective. It is essential knowledge across all Microsoft security certifications.