Fixing Microsoft Purview DLP Policy Not Triggering for Sensitive Data

Explore Our Microsoft Cloud Security Training →

Compliance admins implementing Data Loss Prevention (DLP) policies in Microsoft Purview may encounter situations where these policies fail to trigger, leaving sensitive data unprotected. In this blog post, we’ll walk you through the most common issues and their solutions.

Sensitive Information Type (SIT) accuracy and thresholds
Ensure that your SITs are accurately defined and that the confidence levels and instance counts are set appropriately. If the default instance count of 5 is too high for low-volume sensitive data, adjust it to improve detection.

DLP policy scope and location settings
Make sure that your DLP policies include all relevant workloads (Exchange, SharePoint, OneDrive, Teams) across locations. Incomplete or incorrect scopes can result in missed triggers.

Conflicts with retention policies
Retention policies might interfere with DLP policies if they are set to delete sensitive data before the DLP policy has a chance to trigger. Review your retention policies to ensure that they don’t create conflicts.

Endpoint DLP requirements for device coverage
For Endpoint DLP, devices must be onboarded to Defender. Use the same onboarding script as Microsoft Defender for Endpoints (MDE).

Validating with policy tips and test content
Test your DLP policies using policy tips and test content to confirm that they are functioning correctly.

Using Purview activity explorer to confirm policy evaluation
Review the Purview activity explorer to verify that policy evaluation occurred for the affected document or message.

Policy mode not stuck in Test mode
Ensure that your DLP policies are not stuck in Test mode, as this can prevent them from triggering.

Review DLP policy match reports
Analyze DLP policy match reports for the affected document or message to identify issues and areas for improvement.

Conclusion
Ensuring that your Microsoft Purview DLP policies are functioning correctly is essential for protecting sensitive data. By following these steps, you’ll be well on your way to a secure environment. For more in-depth training on Microsoft technologies like Purview and other cloud security solutions, visit ITP Training.

Explore Our Microsoft Cloud Security Training →