Microsoft 365 Data Loss Prevention (DLP) — what it is and how to set it up

← All articles

Data Loss Prevention (DLP) in Microsoft 365 is a set of policies that detect and prevent sensitive information — credit card numbers, National Insurance numbers, passport details, medical records — from being shared outside your organisation inappropriately. It's a key component of GDPR compliance and often required for ISO 27001 certification.

What does DLP actually do?

DLP policies scan content in Exchange, SharePoint, OneDrive, Teams, and endpoints (if you have Defender for Endpoint). When it finds content that matches a sensitive information type — like a 16-digit number that looks like a credit card — it can:

• Show a policy tip to the user ("This message contains a credit card number")
• Block the email or file share and notify an admin
• Allow the action but log it for review
• Require the user to provide a business justification

What licences do you need?

Basic DLP (Exchange and SharePoint) is available from Business Premium and E3. More advanced DLP including endpoint DLP and Teams requires E5 Compliance or the Microsoft 365 E5 licence.

Setting up your first DLP policy

1. Go to compliance.microsoft.com → Data loss prevention → Policies → Create policy
2. Choose a template — start with "Financial" or "GDPR" depending on your industry
3. Select where to apply it: Exchange, SharePoint, OneDrive, Teams
4. Set the policy mode to Test mode with policy tips first — users see warnings but nothing is blocked
5. Review the activity log for two weeks, then switch to enforcement mode

Sensitive information types relevant to UK businesses

Microsoft 365 includes pre-built detectors for:

• UK National Insurance numbers
• UK NHS numbers
• UK passport numbers
• UK driver's licence numbers
• Credit and debit card numbers (all major schemes)
• IBAN bank account numbers
• SWIFT/BIC codes

How to check if DLP is configured

M365Clarity scans your DLP policy status as part of every tenant scan. If no DLP policies are configured it flags this as red — particularly important if your licence includes DLP and you haven't yet set it up.

Related articles