Commands › Exchange Online

New-DlpCompliancePolicy

Exchange Online ExchangeOnlineManagement New-*

For more information, see Security & Compliance PowerShell. Use the New-DlpCompliancePolicy cmdlet to create data loss prevention (DLP) policies in the Microsoft Purview compliance portal. DLP policies contain DLP rules that identify, monitor, and protect sensitive information.

Quick start script

# New-DlpCompliancePolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-DlpCompliancePolicy
$before | Format-List

# 3. Make the change (dry run first)
New-DlpCompliancePolicy -Name <String> -WhatIf
New-DlpCompliancePolicy -Name <String>

# 4. Verify and diff
$after = Get-DlpCompliancePolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-DlpCompliancePolicy [-Name] <String>
 [-Comment <String>]
 [-Confirm]
 [-DisplayName <String>]
 [-EndpointDlpAdaptiveScopes <MultiValuedProperty>]
 [-EndpointDlpAdaptiveScopesException <MultiValuedProperty>]
 [-EndpointDlpLocation <MultiValuedProperty>]
 [-EndpointDlpLocationException <MultiValuedProperty>]
 [-EnforcementPlanes <MultiValuedProperty>]
 [-ExceptIfOneDriveSharedBy <RecipientIdParameter[]>]
 [-ExceptIfOneDriveSharedByMemberOf <RecipientIdParameter[]>]
 [-ExchangeAdaptiveScopes <MultiValuedProperty>]
 [-ExchangeAdaptiveScopesException <MultiValuedProperty>]
 [-ExchangeLocation <MultiValuedProperty>]
 [-ExchangeSenderMemberOf <RecipientIdParameter[]>]
 [-ExchangeSenderMemberOfException <RecipientIdParameter[]>]
 [-Force]
 [-IsFromSmartInsights <System.Boolean>]
 [-Locations <String>]
 [-Mode <PolicyMode>]
 [-OneDriveAdaptiveScopes <MultiValuedProperty>]
 [-OneDriveAdaptiveScopesException <MultiValuedProperty>]
 [-OneDriveLocation <MultiValuedProperty>]
 [-OneDriveLocationException <MultiValuedProperty>]
 [-OneDriveSharedBy <RecipientIdParameter[]>]
 [-OneDriveSharedByMemberOf <RecipientIdParameter[]>]
 [-OnPremisesScannerDlpLocation <MultiValuedProperty>]
 [-OnPremisesScannerDlpLocationException <MultiValuedProperty>]
 [-PolicyRBACScopes <MultiValuedProperty>]
 [-PolicyTemplateInfo <PswsHashtable>]
 [-PowerBIDlpLocation <MultiValuedProperty>]
 [-PowerBIDlpLocationException <MultiValuedProperty>]
 [-Priority <Int32>]
 [-SharePointAdaptiveScopes <MultiValuedProperty>]
 [-SharePointAdaptiveScopesException <MultiValuedProperty>]
 [-SharePointLocation <MultiValuedProperty>]
 [-SharePointLocationException <MultiValuedProperty>]
 [-TeamsAdaptiveScopes <MultiValuedProperty>]
 [-TeamsAdaptiveScopesException <MultiValuedProperty>]
 [-TeamsLocation <MultiValuedProperty>]
 [-TeamsLocationException <MultiValuedProperty>]
 [-ThirdPartyAppDlpLocation <MultiValuedProperty>]
 [-ThirdPartyAppDlpLocationException <MultiValuedProperty>]
 [-ValidatePolicy]
 [-WhatIf]
 [<CommonParameters>]

Parameters (45)

ParameterTypeRequiredWhat it controls
-Name String yes The Name parameter specifies the unique name of the DLP policy. If the value contains spaces, enclose the value in quotation marks.
-Comment String The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks ("), for example: "This is an admin note".
-Confirm SwitchParameter The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DisplayName String {{ Fill DisplayName Description }}
-EndpointDlpAdaptiveScopes MultiValuedProperty {{ Fill EndpointDlpAdaptiveScopes Description }}
-EndpointDlpAdaptiveScopesException MultiValuedProperty {{ Fill EndpointDlpAdaptiveScopesException Description }}
-EndpointDlpLocation MultiValuedProperty **Note**: This parameter requires membership in the Compliance Administrator or Compliance Data Administrator roles in Microsoft Entra ID.
-EndpointDlpLocationException MultiValuedProperty **Note**: This parameter requires membership in the Compliance Administrator or Compliance Data Administrator roles in Microsoft Entra ID.
-EnforcementPlanes MultiValuedProperty The EnforcementPlanes parameter defines the layer where policy actions are run. This parameter uses the following syntax:
-ExceptIfOneDriveSharedBy RecipientIdParameter[] The ExceptIfOneDriveSharedBy parameter specifies the users to exclude from the DLP policy (the sites of the OneDrive user accounts are included in the policy). You identify the users by UPN (`laura@contoso.onmicrosoft.com`).
-ExceptIfOneDriveSharedByMemberOf RecipientIdParameter[] The ExceptIfOneDriveSharedByMemberOf parameter specifies the distribution groups or mail-enabled security groups to exclude from the DLP policy (the OneDrive sites of group members are excluded from the policy). You...
-ExchangeAdaptiveScopes MultiValuedProperty {{ Fill ExchangeAdaptiveScopes Description }}
-ExchangeAdaptiveScopesException MultiValuedProperty {{ Fill ExchangeAdaptiveScopesException Description }}
-ExchangeLocation MultiValuedProperty The ExchangeLocation parameter specifies whether to include email messages in the DLP policy. The valid value for this parameter is All. If you don't want to include email messages in the policy, don't use this...
-ExchangeSenderMemberOf RecipientIdParameter[] The ExchangeSenderMemberOf parameter specifies the distribution groups or security groups to include in the policy (email of the group members is included in the policy). You identify the groups by email address.
-ExchangeSenderMemberOfException RecipientIdParameter[] The ExchangeSenderMemberOfException parameter specifies the distribution groups or security groups to exclude from the policy (email of the group members is excluded from the policy). You identify the groups by email address.
-Force SwitchParameter The Force switch hides warning or confirmation messages. You don't need to specify a value with this switch.
-IsFromSmartInsights Boolean {{ Fill IsFromSmartInsights Description }}
-Locations String The Locations parameter specifies to whom, what, and where the DLP policy applies. This parameter uses the following properties:
-Mode PolicyMode The Mode parameter specifies the action and notification level of the DLP policy. Valid values are:
-OneDriveAdaptiveScopes MultiValuedProperty {{ Fill OneDriveAdaptiveScopes Description }}
-OneDriveAdaptiveScopesException MultiValuedProperty {{ Fill OneDriveAdaptiveScopesException Description }}
-OneDriveLocation MultiValuedProperty The OneDriveLocation parameter specifies whether to include OneDrive sites in the policy. A valid value for this parameter is All, which is also the default value.
-OneDriveLocationException MultiValuedProperty Don't use this parameter. See the OneDriveLocation parameter for an explanation.
-OneDriveSharedBy RecipientIdParameter[] The OneDriveSharedBy parameter specifies the users to include in the DLP policy (the sites of the OneDrive user accounts are included in the policy). You identify the users by UPN (`laura@contoso.onmicrosoft.com`).
-OneDriveSharedByMemberOf RecipientIdParameter[] The OneDriveSharedByMemberOf parameter specifies the distribution groups or mail-enabled security groups to include in the DLP policy (the OneDrive sites of group members are included in the policy). You identify the...
-OnPremisesScannerDlpLocation MultiValuedProperty The OnPremisesScannerDlpLocation parameter specifies the on-premises file shares and SharePoint document libraries and folders to include in the DLP policy. You can use the value All to include all on-premises file...
-OnPremisesScannerDlpLocationException MultiValuedProperty The OnPremisesScannerDlpLocationException parameter specifies the on-premises file shares and SharePoint document libraries and folders to exclude from the DLP policy if you use the value All for the...
-PolicyRBACScopes MultiValuedProperty The PolicyRBACScopes parameter specifies the administrative units to assign to the policy. A valid value is the Microsoft Entra ObjectID (GUID value) of the administrative unit. You can specify multiple values...
-PolicyTemplateInfo PswsHashtable The PolicyTemplateInfo specifies the built-in or custom DLP policy templates to use in the DLP policy.
-PowerBIDlpLocation MultiValuedProperty The PowerBIDlpLocation parameter specifies the Power BI workspace IDs to include in the DLP policy. Only workspaces hosted in Premium Gen2 capacities are permitted. You can use the value All to include all supported...
-PowerBIDlpLocationException MultiValuedProperty The PowerBIDlpLocationException parameter specifies the Power BI workspace IDs to exclude from the DLP policy when you use the value All for the PowerBIDlpLocation parameter. Only workspaces hosted in Premium Gen2...
-Priority Int32 The Priority parameter specifies a priority value for the policy that determines the order of policy processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and policies...
-SharePointAdaptiveScopes MultiValuedProperty {{ Fill SharePointAdaptiveScopes Description }}
-SharePointAdaptiveScopesException MultiValuedProperty {{ Fill SharePointAdaptiveScopesException Description }}
-SharePointLocation MultiValuedProperty The SharePointLocation parameter specifies the SharePoint sites to include in the DLP policy. You identify the site by its URL value, or you can use the value All to include all sites.
-SharePointLocationException MultiValuedProperty The SharePointLocationException parameter specifies the SharePoint sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.
-TeamsAdaptiveScopes MultiValuedProperty {{ Fill TeamsAdaptiveScopes Description }}
-TeamsAdaptiveScopesException MultiValuedProperty {{ Fill TeamsAdaptiveScopesException Description }}
-TeamsLocation MultiValuedProperty The TeamsLocation parameter specifies the Teams chat and channel messages to include in the DLP policy. You identify the entries by the email address or name of the account, distribution group, or mail-enabled...
-TeamsLocationException MultiValuedProperty The TeamsLocation parameter specifies the Teams chat and channel messages to exclude from the DLP policy when you use the value All for the TeamsLocation parameter. You identify the entries by the email address or...
-ThirdPartyAppDlpLocation MultiValuedProperty **Note**: This parameter requires membership in the Compliance Administrator or Compliance Data Administrator roles in Microsoft Entra ID.
-ThirdPartyAppDlpLocationException MultiValuedProperty **Note**: This parameter requires membership in the Compliance Administrator or Compliance Data Administrator roles in Microsoft Entra ID.
-ValidatePolicy SwitchParameter {{ Fill ValidatePolicy Description }}
-WhatIf SwitchParameter The WhatIf switch doesn't work in Security & Compliance PowerShell.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.