Prevention & Enforcement
With the foundation in place and oversharing remediated, this section implements proactive controls to prevent data loss, manage data lifecycle, and enforce policy compliance.
These capabilities may overlap with existing security tools (Proofpoint, Elastic SIEM, third-party CASB). Coordinate with those teams before implementing to avoid conflicts and duplicate alerts.
Data Loss Prevention (DLP) {#dlp}
Deploy DLP policies across Exchange, SharePoint, Teams, and endpoints to detect and prevent sensitive data exposure.
DLP Enforcement Actions
| Action | When to Use | User Experience |
|---|---|---|
| Audit | Testing policies | No notification |
| Warn | Low-risk matches | User sees tip, can proceed |
| Block with Override | Medium risk | User provides justification |
| Block | High risk (SSN, credit cards) | Hard stop |
DLP Locations
| Location | Coverage |
|---|---|
| Exchange Online | Email messages and attachments |
| SharePoint/OneDrive | Documents and file shares |
| Teams | Chat messages and channel files |
| Endpoints (E5/A5) | USB copies, print, cloud uploads |
| Power Platform | Power BI, Power Apps |
Step 1 – Create DLP Policy for SSN
DLP policies should always be deployed in simulation (test) mode first. Monitor for at least 7-14 days before enabling enforcement to avoid disrupting legitimate workflows.
Click-Ops:
- Navigate to Microsoft Purview portal → Solutions → Data Loss Prevention → Policies
- Click + Create policy
- Select template: U.S. PII Data
- Configure locations (Exchange, SharePoint, Teams)
- Set actions:
- Low volume (1-9): Warn user
- High volume (10+): Block with override
- Policy mode: Select Run the policy in simulation mode
- Monitor DLP reports for false positives before switching to enforcement
Step 2 – Create DLP for Sensitivity Labels
Goal: Use labels as DLP conditions for more reliable detection.
Example Policy:
- Condition: Label = "Restricted" AND recipient is external
- Action: Block email
Using labels as conditions reduces false positives compared to content scanning alone.
Step 3 – Enable Endpoint DLP (E5/A5)
Goal: Extend DLP to Windows and macOS devices.
- Windows 10/11: Full feature support (Defender for Endpoint required)
- macOS: Supported since late 2021 (macOS 11+ with Defender for Endpoint)
- Linux: Limited support for specific distributions
Protected Activities:
- Copy to USB drive
- Print sensitive documents
- Upload to cloud services (browser and app)
- Copy to network shares
- Paste to clipboard (Windows only)
Prerequisites:
- Devices onboarded to Defender for Endpoint
- Enable device onboarding in Settings → Device onboarding
- Configure Endpoint DLP settings
Data Lifecycle Management {#data-lifecycle}
Establish retention policies and records management to control data lifecycle and meet regulatory requirements.
Why Lifecycle Comes After Remediation
With oversharing addressed and access controls in place, you can now implement retention policies that:
- Reduce storage costs by deleting transient content
- Meet compliance requirements (Texas Records Retention, FERPA)
- Simplify eDiscovery by reducing noise from old content
Retention Strategy for Higher Ed
| Content Type | Retention | Rationale |
|---|---|---|
| Teams Chat | 1 year, then delete | Transient communication |
| 7 years, then review | State records requirement | |
| SharePoint Documents | Retain until deleted | Owner-managed |
| Student Records | 7 years after graduation | FERPA |
| Research Data | Per grant requirements | Variable (often 3-10 years) |
Step 1 – Create Retention Policy for Teams Chat
Goal: Treat Teams chat as ephemeral—retain for 1 year, then delete.
Click-Ops:
- Navigate to Microsoft Purview portal → Data lifecycle management → Retention policies
- Click + Create retention policy
- Name: "Teams Chat - 1 Year Retention"
- Locations: Select Teams channel messages and Teams chats
- Retention settings:
- Retain items for: 1 year
- After retention period: Delete items automatically
- Review and create
Step 2 – Create Retention Labels for Records
Goal: Create labels that declare content as official records with specific retention.
Recommended Labels:
| Label | Retention | Action |
|---|---|---|
| Official Record - 7 Year | 7 years | Delete |
| Student Record | 7 years after event | Review |
| Research Record | 10 years | Review |
| Permanent Record | Retain forever | None |
Power Platform DLP {#power-platform-dlp}
Control data flow between Power Platform connectors to prevent data leakage through Power Apps and Power Automate.
Connector Classification
| Category | Examples | Policy |
|---|---|---|
| Business | SharePoint, Dynamics, SQL | Can connect together |
| Non-Business | Twitter, Dropbox, Gmail | Can connect together |
| Blocked | High-risk connectors | Cannot be used |
Step 1 – Create Data Policy
Click-Ops:
- Navigate to Power Platform Admin Center > Data policies
- Click + New policy
- Classify connectors:
- Business: SharePoint, OneDrive, Teams
- Non-Business: Social media, consumer cloud
- Blocked: Anonymous file sharing services
- Apply to environments
Communication Compliance {#communication-compliance}
Monitor messages for policy violations, harassment, and sensitive information.
Policy Templates
| Template | Purpose |
|---|---|
| Detect inappropriate text | Harassment, profanity, threats |
| Detect sensitive information | PII in messages |
| Detect financial regulatory compliance | SOX, FINRA requirements |
| Custom policy | Build your own rules |
Step 1 – Create Communication Compliance Policy
Click-Ops:
- Navigate to Microsoft Purview portal → Solutions → Communication Compliance
- Click + Create policy
- Select template or create custom
- Configure:
- Users to monitor
- Channels (Teams, Exchange)
- Detection conditions
- Reviewers
- Enable pseudonymization for privacy
Privacy Considerations
| Feature | Purpose |
|---|---|
| Pseudonymization | Hide user identities from reviewers |
| Role-based access | Limit who reviews which policies |
| Audit logging | Track all reviewer actions |
Validation Checklist
| # | Item | Success Criteria |
|---|---|---|
| 1 | DLP policies | Active for SSN at minimum |
| 2 | Endpoint DLP | Deployed to managed devices |
| 3 | Power Platform | Connector classification complete |
| 4 | Communication Compliance | At least one policy active |
Next Steps
With prevention and lifecycle controls in place, proceed to Extensions for additional integrations and advanced scenarios.