Phased DLP rollout on the sensitivity-label schema

DLP without a sensitivity schema becomes a keyword filter that Finance and IM will hate. DLP follows the label: Highly Confidential already means “this does not leave the building”; DLP is the gate. Do not start at Block. Microsoft Learn: test/audit until you know the data, then tip, then block-with-override, then block. Schema first: sensitivity architecture. This is not Power Platform connector DLP — that is in Power Automate DLP.

Why the schema comes first

• A “credit card” SIT on all Exchange without a label also hits training data. A condition “label = Highly Confidential” hits what the organisation already called high risk.
• DLP on Public/General = noise. DLP on Confidential Organisatie = sharing to guests. DLP on Highly Confidential = encryption + block. That mapping is column DLPHook on the sensitivity CSV.
• Same name in the label, DLP, Insider Risk and (later) a search index. One language. Highly Confidential must be able to stop Copilot processing; without a label DLP has nothing to hook.
• Labels express intent; SITs stay the detector. DLP uses both: label for “this is high risk”, SIT for leaks nobody labelled.

Three axes (Microsoft)

Microsoft Learn (Create and deploy a DLP policy): steer the rollout with state (simulation / simulation+tips / on), scope (who, which locations) and action (audit / block with override / block). Never max all three at once. Broad in simulation first, then narrow with tips (pilot), then enforce. Locations: Exchange, SharePoint, OneDrive, Teams, Devices — not everything in phase 1.

Connect-IPPSSession -UserPrincipalName [email protected]

# Axis 1 = state (simulation → tips → on). Axis 2 = scope. Axis 3 = action.
# Create the policy in the portal (conditions for "content contains sensitivity label"
# are less error-prone there), then walk the mode:

Set-DlpCompliancePolicy -Identity "DLP-Juridisch-Audit" -Mode TestWithoutNotifications
# two weeks of alerts, no user impact

Set-DlpCompliancePolicy -Identity "DLP-Juridisch-Audit" -Mode TestWithNotifications
# policy tips on. Pilot group first.

Set-DlpCompliancePolicy -Identity "DLP-Juridisch-Audit" -Mode Enable
# full enforcement. Do not jump here from Design.

Get-DlpCompliancePolicy | Format-Table Name, Mode, DistributionStatus
Get-DlpComplianceRule -Policy "DLP-Juridisch-Audit" |
  Format-Table Name, BlockAccess, NotifyAllowOverride, Disabled

Phases

1. 0 Design. No policy in Purview until the sensitivity CSV is signed. Map DLPHook → policy name. One policy per condition, not “one DLP to rule them all”.
2. 1 Audit only (TestWithoutNotifications). Condition: Highly Confidential OR SIT national-id/IBAN/card. No tip to the user. Two weeks: false-positive ratio. Exit: < 5%. Also use this phase to practise the alert-review process.
3. 2 Policy tip (TestWithNotifications) on Confidential Organisatie, a pilot group first. User sees why. Override allowed + justification. Measure override-%. Above 20%: the tip or the label is wrong, not the user. Link in the tip to the internal policy.
4. 3 Block with override (Enable) on Highly Confidential (Exchange + SPO + Teams). Justification required. Weekly review of overrides. Legal-hold mailboxes excepted. Microsoft: override on the most restrictive rule overrides the rest — design for that.
5. 4 Block without override for SIT + unlabeled/Public (a real leak). Never for Confidential Organisatie — that is where papers that must go to counsel or a named partner live. Endpoint not yet.
6. 5 Endpoint. Unmanaged device cannot put Highly Confidential on USB/browser. Intune-compliant excepted. Only after phase 3, or you hostage the pilot laptops. Browser/USB: block with override first, block later. Microsoft Endpoint DLP: the override toast has seconds, then the action is blocked.

Planning CSV

Phase,PolicyName,Mode,Locations,Condition,Action,Exception,Owner,ExitCriteria
0,n/a,Design,n/a,Schema from sensitivity CSV,n/a,n/a,CISO,Four parents signed off
1,DLP-Juridisch-Audit,TestWithoutNotifications,Exchange+SPO+ODSP+Teams,Label = Highly Confidential OR SIT Credit Card / IBAN / BSN,Audit only,Break-glass mailboxes,DLP ops,False-positive rate < 5% for 14 days
2,DLP-Organisatie-Tip,TestWithNotifications,Exchange+SPO+ODSP,Label = Confidential\Organisatie,Notify user + admin,Standard forms library,DLP ops,Users understand the tip; override < 20%
3,DLP-Juridisch-BlockOverride,Enable,Exchange+SPO+ODSP+Teams,Label = Highly Confidential,Block with override + justification,Legal hold mailboxes,DLP ops,Overrides reviewed weekly
4,DLP-SIT-Block,Enable,Exchange,SIT BSN AND (no label OR Public),Block without override,None,DLP ops,Zero unlabelled BSN leaving Exchange
5,DLP-Endpoint-Browser,Enable,Endpoint devices,Highly Confidential on unmanaged device,Block,Intune compliant,SecOps,Unmanaged devices cannot copy HC

Conditions in the portal

• Content contains → Sensitivity labels — pick Highly Confidential (and children). This is the primary hook.
• Content contains → Sensitive info types — national id / IBAN / card, for what nobody labelled. Combine with “label is Public or empty” in phase 4.
• Recipient is outside the organisation — sharing, not internal editing.

Simulation/test mode is not a toy: without those two weeks of data you build politics, not security. The classic mistake is too many overlapping policies and then mandatory block on day one. One policy per phase/condition, mode up, overlap down. Alerts: one mailbox, not ten Teams channels.

Sources

• Microsoft Learn — Create and deploy a DLP policy (three axes, simulation → tips → on)
• Microsoft Learn — Plan for DLP
• Microsoft Learn — DLP policy reference