How to Create a Custom DLP Policy for Sensitive Information
Question details
The user needs to set up a custom Data Loss Prevention (DLP) policy to detect specific text criteria, apply protection rules, and prevent the external sharing of sensitive documents.
- Product
- Microsoft Purview
- Device & OS
- not provided
- Scenario
- Configuring enterprise data protection policies to identify custom sensitive information and enforce external-sharing restrictions using sensitivity labels.
- Observed behavior
- Needs to enforce custom DLP rules to detect specific text patterns and ensure automated sensitivity labels govern external sharing without being manually overridden.
Ensure you have the necessary compliance administrator or global administrator permissions in your Microsoft 365 tenant to create and manage Data Loss Prevention policies.
Create a Custom DLP Policy and Configure Label Priorities
Define custom sensitive information types, set up external-sharing restrictions, and manage sensitivity label priorities to ensure automated labels are respected.
Microsoft Purview allows organizations to create custom sensitive information types to detect specific text patterns (like project codes or custom identifiers). You can then use DLP policies to block external sharing when these patterns are detected.
When using sensitivity labels within your DLP strategy, it is critical to understand priority. By default, manually applied labels are not replaced by automated labels. To enforce strict protection, configure your policy to prevent manual label downgrading.
Log in to the Microsoft Purview compliance portal. In the left navigation pane, select 'Data loss prevention' and then click on 'Policies'.
Click the 'Create policy' button. In the template categories, choose 'Custom', select 'Custom policy', and click 'Next' to name your policy.
In the policy rules section, create a rule and add a condition. Select 'Content contains' and define your custom sensitive information type (e.g., your specific XXXX text pattern) or select a sensitivity label.
Under 'Actions', configure the rule to restrict access or block the content when it is shared with people outside your organization.
If you are relying on automatic sensitivity labels, review their priority order in the Information Protection tab. Ensure your configuration restricts users from manually changing or removing high-priority labels required for compliance.
Secure Your Daily Documents with WPS Office
While Microsoft Purview is designed for complex enterprise-level Data Loss Prevention, WPS Office provides a free, lightweight, and highly secure alternative for everyday document management. Protect your sensitive data locally with robust built-in encryption and password protection.
- 1. Open your file in WPS Office: Launch WPS Office and open the Word, Excel, or PowerPoint document containing your sensitive information.
- 2. Access Document Encryption: Navigate to the 'Menu' button in the top left corner, select 'Document Encryption', and click 'Encryption'.
- 3. Set a secure password: Enter and confirm a strong password to ensure your document cannot be opened or modified by unauthorized users.
Frequently Asked Questions
Can users manually change automatically applied sensitivity labels?
By default, manually applied labels are not replaced by automated labels. Users can often change labels manually unless the organization's policy is specifically configured to require justification or prevent downgrading of sensitivity labels.
What is a custom sensitive information type in a DLP policy?
A custom sensitive information type is a specific pattern, keyword, or regular expression defined by an organization (such as an internal project code) that Microsoft Purview uses to identify and protect sensitive data that doesn't fit standard templates like credit card numbers.
How does a DLP policy block external sharing?
When a DLP policy rule detects sensitive information in a document, it evaluates the rule's conditions. If the document is being shared with external users, the policy triggers an action (such as 'Block people outside your organization') to instantly restrict access and protect the data.
