Implement Data Loss Prevention and Retention
DLP: conditions, actions, enforcement points
DLP policies attach to locations - Exchange email, SharePoint sites, OneDrive accounts, Teams chat and channel messages, endpoint devices, on-premises scanner, and Fabric/Power BI. Inside a policy, rules combine conditions (sensitive information types, sensitivity labels, trainable classifiers, EDM, document fingerprinting, recipient domains, file size), exceptions, and actions (block, block with override, restrict access, encrypt, audit only, policy tips, alert). Always start in simulation mode to see match volume before enforcing. Endpoint DLP only functions on devices that have been onboarded; adaptive protection lets Insider Risk Management risk levels scope which users a DLP policy targets.
Retention: policies versus labels
- Retention policies are broad and automatic, target whole locations, require no user action, and cannot use disposition review or event-based triggers.
- Retention labels are item-level, can be published or auto-applied, and support disposition review, event-based retention, and file-plan descriptors.
Three retention outcomes exist: retain-and-delete, retain-only, and delete-only. When multiple sources apply, retention settings combine and the longest retention period wins; a delete-only setting never deletes content that another source still retains. Records can be marked immutable; regulatory records cannot be removed even by an administrator.
Traps
- Retention labels do not apply to Teams chat messages - only policies do.
- Unpublishing or deleting a label policy does not strip settings from items that already carry the label.
- A DLP policy that only audits generates alerts but blocks nothing; read the action list carefully.
Rule of thumb: policy = broad and automatic; label = precise and exception-handling.