How do you set up data loss prevention for email in Microsoft 365?

Most email security work is about what comes in. Data loss prevention (DLP) is about what goes out: Social Security numbers pasted into a reply, a spreadsheet of card numbers attached to the wrong thread, or patient records sent to a personal Gmail account. Microsoft 365 includes DLP for Exchange Online in its business and enterprise plans, and this guide shows how to set it up for email without breaking anyone's day.

What is data loss prevention in Microsoft 365?

Data loss prevention is a set of policies that detect sensitive information in email and files and then warn, block, encrypt or report when someone tries to share it inappropriately. In Microsoft 365 it's part of Microsoft Purview, Microsoft's compliance suite. Microsoft Learn describes it as "deep content analysis - not a simple text scan": keyword matches, regular expressions, internal function validation, supporting evidence near the match, and machine learning.

A DLP policy has three parts:

• What to look for: sensitive information types (SITs) such as Credit Card Number or U.S. Social Security Number (SSN), sensitivity labels, or trainable classifiers.
• Where to look: locations such as Exchange email, SharePoint, OneDrive, Teams and devices. This guide covers Exchange email only.
• What to do: actions such as showing a policy tip, blocking, allowing an override with justification, encrypting, or sending an incident report.

Which Microsoft 365 plans include DLP for email?

At the time of writing (November 2026), Microsoft's Purview service description lists these licenses for DLP in Exchange Online, SharePoint and OneDrive:

• Microsoft 365 E5/A5/G5/E3/A3/G3 and Microsoft 365 Business Premium
• Office 365 E5/A5/G5/E3/A3/G3
• Exchange Online Plan 2, SharePoint Online Plan 2 and OneDrive for Business (Plan 2)
• Microsoft Purview Suite and related suites

Advanced policy tips in Outlook, with extra conditions, advanced classifiers and the oversharing dialog, need Microsoft 365 E5/A5/G5 or an equivalent add-on for each scoped user. Microsoft 365 Business Basic and Business Standard aren't on the list, so check your plan before you start.

To create policies you need one of these role groups: Compliance administrator, Compliance data administrator, Information Protection, Information Protection Admin, or Security administrator (Microsoft Learn).

How is DLP different from mail flow rules and encryption?

DLP isn't the only outbound control in Microsoft 365. Use the right tool for the job.

For the other tools, see Microsoft 365 mail flow rules for security, Purview Message Encryption and the outbound spam policy. If you're on Google Workspace instead, the equivalent is content compliance rules.

Which DLP template should you start with?

Microsoft ships predefined policy templates for common regulations. Each template contains preconfigured rules, and you can edit them. What DLP policy templates include lists them all. Common starting points for US businesses:

The U.S. Financial Data template shows how templates are tuned. It has a low-count rule (1 to 9 matching items shared outside the organization) that sends a notification, and a high-count rule (10 to 500 items) that blocks access, sends a notification, allows an override with a business justification and sends an incident report.

A template is a technical starting point, not a compliance program. If you're covered by HIPAA or the GLBA Safeguards Rule, see HIPAA email security requirements or the FTC Safeguards Rule guide, and talk to your counsel or compliance advisor about what you need.

How do you create a DLP policy for Exchange email?

This procedure follows Microsoft's credit card email scenario, adapted for a common small-business goal: warn and then block when financial data is emailed outside the company. Menu names are current at the time of writing (November 2026).

1. Sign in to the Microsoft Purview portal.
2. Open the Data loss prevention solution and go to Policies > + Create policy.
3. Select Enterprise applications & devices.
4. Choose a template (for example U.S. Financial Data), or select Custom in both the Categories and Regulations lists to build your own. Select Next.
5. Enter a Name and Description. Write the policy's intent in the description; you'll thank yourself later.
6. On Assign admin units, keep the default to apply the policy to everyone. Select Next.
7. On the locations page, select only Exchange email and deselect the others. You can include or exclude distribution groups here.
8. Keep Create or customize advanced DLP rules selected, then select Create rule (or edit the template's rules).
9. Under Conditions, add Content contains > Sensitive info types and pick the types, for example Credit Card Number. Add Content is shared from Microsoft 365 > with people outside my organization if you only care about external mail.
10. Under Actions, add Restrict access or encrypt the content in Microsoft 365 locations. Choose to block everyone or only people outside your organization, or choose to encrypt the message.
11. Turn on User notifications and Policy tips so senders learn why a message was flagged.
12. Under User overrides, decide whether senders can override with a business justification. Overrides give you feedback on false positives during rollout.
13. Under Incident reports, set a severity level and turn on admin alerts if you want them.
14. Select Save, then Next, choose Run the policy in simulation mode, then Submit.

What does a policy tip look like to the sender?

When a message matches, Outlook shows a banner above the message before it's sent. You can write the text yourself; the rule cmdlet allows up to 256 characters, with no HTML. For example:

Example policy tip text This email appears to contain a card or bank account number and is going outside Example Co. Remove the number or send it through the secure portal. Questions? Contact IT.

How do you create the same policy with PowerShell?

DLP policies are managed in Security & Compliance PowerShell, not Exchange Online PowerShell. Connect with Connect-IPPSSession, then create the policy and rule. This example audits external email containing U.S. Social Security numbers, in simulation mode, with incident reports set to go to a compliance mailbox:

Connect-IPPSSession -UserPrincipalName admin@example.com

New-DlpCompliancePolicy -Name "Email - SSN to external" `
  -ExchangeLocation All -Mode TestWithoutNotifications

New-DlpComplianceRule -Name "External SSN" `
  -Policy "Email - SSN to external" `
  -ContentContainsSensitiveInformation @(@{Name="U.S. Social Security Number (SSN)"; minCount="1"}) `
  -AccessScope NotInOrganization `
  -GenerateIncidentReport "compliance@example.com" -ReportSeverityLevel High

Watch the -Mode parameter. According to New-DlpCompliancePolicy, Enable is the default, so a policy created without -Mode enforces straight away. The values map to the portal's states:

When you're ready to block, add -BlockAccess $true to the rule with Set-DlpComplianceRule, and switch the policy with Set-DlpCompliancePolicy -Mode Enable. New-DlpComplianceRule documents every condition and action, including -NotifyPolicyTipCustomText and -NotifyAllowOverride WithJustification.

How should you roll out a DLP policy without disrupting email?

Microsoft's deployment guidance is to take an incremental approach, from simulation mode through full enforcement:

1. Keep it off while you design and review the policy with the people who own the process (finance, HR, clinical staff).
2. Simulation mode, broad scope. Watch matches in the DLP simulation overview and Activity explorer for a week or two.
3. Tune. Raise instance counts, exclude a group that legitimately sends this data (for example payroll to your payroll provider), or refine the sensitive information types.
4. Simulation mode with policy tips, scoped to a pilot group. Users see the tips but nothing is blocked. Collect their feedback.
5. Turn it on, first with block with override so users can justify legitimate sends, then block once false positives are rare.

Policies generally take effect about an hour after you turn them on. DLP alerts stay in the Purview DLP alerts dashboard for 30 days and in the Microsoft Defender portal for six months.

What are the limits of DLP for email?

DLP is powerful but narrow. Know where it stops:

• It only checks new messages. Microsoft says DLP "does not scan or match previously existing email items" in a mailbox or archive.
• Some content can't be fully scanned. Password-protected attachments and attachments with a lot of extracted text may not be fully inspected. Exchange DLP has conditions for attachments that are password protected, couldn't be scanned, or didn't complete scanning (for example, extracted content over 2 MB), so you can act on those too (DLP policy reference).
• It isn't anti-phishing. DLP won't stop an attacker from emailing your staff or a compromised account from forwarding mail. Block automatic external forwarding separately, and treat unexpected outbound mail as a sign of a compromised account.
• It doesn't replace people. Someone can still describe a secret in plain words or read it out on the phone.

Inbound protection still matters, because most data theft by email starts with a phishing message that steals a login. iBlockSpam adds MX-level filtering in front of Microsoft 365 to catch phishing, spoofing and malware before it reaches the mailbox.

Next steps

• Confirm your licenses include Exchange DLP, and that the admin who will build policies has the right role group.
• Create one email policy from a template in simulation mode today, and review the matches after a week.
• Pair DLP with encryption for data that must leave: see Purview Message Encryption.
• Turn off automatic external forwarding in the outbound spam policy.
• If you want inbound phishing and spoofing filtering on top of Microsoft's, see iBlockSpam for Microsoft 365.