What DLP does here
Data Loss Prevention (authored in Microsoft Purview) applies policies to SharePoint and OneDrive locations that detect sensitive content and take action. Detection is by:
- Sensitive information types (SITs) — patterns like credit-card, national ID, bank details, with confidence and count thresholds.
- Sensitivity labels — a DLP rule can key off the label on a file (the labels-on-sites concept), so "if labelled Confidential, block external sharing" becomes enforceable.
- Trainable classifiers / keywords / document fingerprints for less structured content.
Actions: block or restrict external (or all) sharing, show policy tips to the user, notify/alert admins, and restrict access to the content.
The scan timing (the crucial caveat)
DLP for SharePoint/OneDrive evaluates content that has been crawled and indexed (search concept). The implication that trips people up:
- It's not a synchronous gate at upload. A freshly uploaded file with sensitive content may not be caught for a short window until it's indexed and the policy evaluates it.
- Sharing actions are evaluated closer to real time (a block-external-sharing rule can prevent the share), but at-rest detection of already-stored content depends on the crawl.
So DLP is strong at governing already-indexed content and sharing events, weaker as an instantaneous upload firewall — plan it as detect-and-remediate, not an airtight door.
The failure modes
- "It didn't catch my test file immediately." Indexing latency — expected; re-test after the content is indexed.
- Encrypted/unreadable content is invisible. DLP inspects text the service can read; an encrypted file (or an image-only PDF without OCR) may not match a SIT — the same partially-indexed gap eDiscovery has.
- False positives from loose SITs — low thresholds flag benign content; tune confidence and instance counts.
- Label vs content precedence — a label-based rule and a content-based rule can both apply; understand which action wins (typically the most restrictive).
- Policy scope gaps — a policy scoped to specific sites misses content elsewhere; OneDrive is a separate location that must be explicitly included.
- Policy tips need supported clients — tips surface in the web/Office experience; not every access path shows them.
What to watch (proofs)
- Policy coverage: Purview → Data loss prevention → policies — which locations (SharePoint, OneDrive) each policy covers and its status (test vs enforce).
- Matches and actions: the DLP activity/alerts and Activity Explorer — what was detected, where, and whether it was blocked or tipped.
- The timing reality: upload a test file with a known SIT, then observe the match appear after indexing — proof of the crawl-dependent behaviour.
- Label interplay: a DLP rule conditioned on a sensitivity label firing on labelled content — confirms labels and DLP are wired together.