Microsoft Purview Data Loss Prevention (DLP) is the Microsoft 365 feature that detects sensitive information — such as card numbers, passport details, Emirates ID numbers or confidential contracts — and stops it from being shared where it should not go. A DLP policy watches email in Exchange Online, files in SharePoint and OneDrive, chats in Microsoft Teams and, with Endpoint DLP, data on Windows and macOS devices. When content matches a rule, Purview can warn the user, require a business justification, block the action, or alert your compliance team.
In short: sensitivity labels classify and protect a document wherever it travels; DLP decides what users are allowed to do with sensitive content in the moment. Most organisations need both.
How Purview DLP works
Every DLP policy is built from the same four parts:
- Locations — where the policy applies: Exchange email, SharePoint sites, OneDrive accounts, Teams chats and channels, endpoints, and some third-party cloud apps.
- Conditions — what to look for. Usually a sensitive information type (a pattern such as a credit card number with checksum validation), a trainable classifier (a model trained to recognise, for example, contracts or CVs), or a sensitivity label already applied to the file.
- Actions — what happens on a match: show a policy tip, block sharing externally, encrypt the email, or block copying to USB.
- Notifications and reporting — who is told and how incidents are reviewed in the Purview portal.
Microsoft ships hundreds of built-in sensitive information types covering financial, health and national identity data for many countries. Where a built-in type does not fit your business — a customer account format, a project code, a specific national ID — you can build a custom one with regular expressions, keywords and confidence levels.
DLP vs sensitivity labels: what is the difference?
| Data loss prevention | Sensitivity labels | |
|---|---|---|
| Purpose | Controls actions on sensitive content | Classifies and protects the content itself |
| When it acts | When a user shares, sends, copies or uploads | When a file or email is labelled |
| Travels with the file? | No — enforced at the location | Yes — encryption and markings stay with the file |
| Typical example | Block emailing card numbers to Gmail | Mark a board pack “Confidential” and restrict it to directors |
| Works together? | Yes — DLP can use labels as a condition | Yes — labels can be applied automatically from DLP-style rules |
What licences do you need?
Core DLP for Exchange Online, SharePoint and OneDrive is included in Microsoft 365 E3 and Business Premium. More advanced capabilities — such as Endpoint DLP, DLP for Teams chats, automatic labelling at scale and richer investigation tools — generally require Microsoft 365 E5 or the E5 Compliance add-on. Microsoft revises compliance licensing regularly, so validate the exact feature set against current licensing guidance before you design policies around it.
Why DLP matters for UAE organisations
The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) requires organisations to protect personal data with appropriate technical measures, and free zones such as DIFC and ADGM have their own data protection regimes. Sector regulators in banking, healthcare and government add further expectations. DLP is one of the clearest technical controls you can point to: it shows where personal data lives, who is moving it, and what was blocked.
It also addresses everyday risk. The most common data leaks in Microsoft 365 are not sophisticated attacks — they are a spreadsheet of customer details forwarded to a personal address, a HR folder shared with “Anyone with the link”, or a contract pasted into an external Teams chat. DLP catches exactly these.
A practical DLP rollout plan
1. Discover before you block
Use Purview content explorer and activity explorer to see what sensitive data you have and where it moves. Many organisations discover payroll files in personal OneDrives or ID scans sitting in public Teams channels.
2. Start with a small set of high-value policies
Begin with three or four policies: financial data (cards and IBANs), national ID and passport numbers, customer personal data, and anything labelled Confidential. Resist the urge to switch on every template.
3. Run in simulation mode
Deploy every new policy in simulation (test) mode for two to four weeks. Review matches, tune confidence levels and instance counts, and remove false positives before any user is blocked.
4. Turn on policy tips, then blocking
Move policies to “show policy tips” first, so users learn why content is sensitive. Then block external sharing for the highest-risk data, with an override and business justification for edge cases.
5. Assign ownership of alerts
A DLP alert nobody reviews is noise. Decide who triages alerts, what counts as an incident, and how it escalates — ideally inside the same process as your incident response plan.
Common mistakes to avoid
- Blocking on day one, which floods the helpdesk and gets the policy switched off.
- Ignoring Teams and guest access — external chats are a growing leak path. See our guide to enforcing Teams external access and guest policies.
- Building DLP without a labelling scheme, so policies cannot distinguish a public brochure from a confidential board pack.
- Forgetting identity: if accounts are compromised, attackers move data as legitimate users. Strong identity and access management comes first.
How M365 Enterprise Hub helps
We design and deploy Microsoft Purview Information Protection and DLP for organisations in the UAE and the US — from data discovery and label taxonomy to tuned policies and alert workflows. DLP is often part of a wider compliance programme and tenant governance review. If endpoint threats are your bigger concern, read our comparison of Defender for Business vs Defender for Endpoint. Book a consultation to see what sensitive data your tenant is exposing today.
Frequently Asked Questions
What does DLP stand for in Microsoft Purview?
DLP stands for data loss prevention. In Microsoft Purview it refers to policies that detect sensitive information in email, files, chats and devices and then warn, block or report when that information is shared inappropriately.
Is Microsoft Purview DLP included in Microsoft 365 E3?
Yes, core DLP for Exchange Online, SharePoint Online and OneDrive is included in Microsoft 365 E3. Advanced features such as Endpoint DLP and DLP for Teams chats typically require E5 or the E5 Compliance add-on.
Can Purview DLP detect Emirates ID numbers?
Purview can detect national identity numbers through built-in or custom sensitive information types. Where a built-in type does not match your exact format, a custom type using patterns, keywords and confidence levels can be created and tested in simulation mode.
What is the difference between DLP and sensitivity labels?
Sensitivity labels classify and protect a file or email, and the protection travels with the content. DLP policies control what users can do with sensitive content at a location, such as blocking external sharing. DLP can use labels as a condition, so the two work best together.
Will DLP slow down users?
Well-tuned DLP is barely noticeable. Problems usually come from policies deployed in blocking mode without testing. Running policies in simulation mode first and starting with policy tips keeps disruption low.
Does DLP help with UAE PDPL compliance?
DLP supports PDPL compliance by providing technical controls and evidence for how personal data is protected, but it is one control among many. Compliance also requires policies, data mapping, consent handling and legal review.