DLP: simulation to enforcement checklist

Before you start

• Permissions. Microsoft lists the Information Protection admin role as the requirement for working with simulation mode.
• Licensing. DLP for Exchange, SharePoint and OneDrive comes with more plans than DLP for Teams chat or devices, so check the Microsoft 365 service descriptions before you choose locations.
• A clear target. Know which sensitive info types or labels represent your data, and who can judge whether a match is real.
• For devices: Windows 10 or 11, or macOS on one of the three latest releases, able to reach the Purview cloud service (through your proxy if you use one).

Checklist

1. 1

   Create the policy from a template

   In the Microsoft Purview portal, go to Solutions › Data loss prevention › Policies › Create policy. On What info do you want to protect? choose Enterprise applications & devices, then pick a template category and regulation (for example Privacy › GDPR Enhanced) or Custom policy.

2. 2

   Review the rules before you test

   Choose to customize the advanced DLP rules and read every rule the template created:

   • Conditions: Content contains sensitive info types, with confidence level and instance counts, often combined with Content is shared from Microsoft 365 with people outside your organization.
   • Actions: Restrict access or encrypt the content in Microsoft 365 locations, blocking everyone or only people outside the organization.
   • User notifications and overrides: policy tips in Outlook and Office apps, optionally with an override that requires a business justification.
   • Incident reports: a severity level, and whether admins are alerted on every match or only above a volume threshold.
3. 3

   Run it in simulation mode

   On the Policy mode page choose Run the policy in simulation mode. Two checkboxes deserve a decision:

   • Show policy tips while in simulation mode lets users see tips without anything being blocked. It's a cheap way to measure reactions, but tell people first.
   • Turn the policy on if it's not edited within fifteen days of simulation enforces the policy automatically. Leave it clear on your first policy so nothing goes live unattended.
4. 4

   Review the matches and tune

   Open the policy's simulation results, check matched items per location and rule, and open individual items to see why they matched. Activity explorer shows the underlying DLP rule-match events.

   What you see	Tuning lever
   Invoice or part numbers matching as card or ID numbers	Require high confidence, raise the minimum instance count, or use a custom info type or exact data match for your own data
   Legitimate sharing with a known partner	An exception for the partner's domain, or a notify-only rule for that flow
   A system account or process causing most matches	An exception agreed with the data owner, never a blanket exclusion of a whole location
   Classification matters more than patterns	Use sensitivity labels as the condition
   Constant overrides on one rule	Read the justifications; the rule is probably too broad

   Check the policy from PowerShell too:

   powershell

   Connect-IPPSSession
   Get-DlpCompliancePolicy | Format-Table Name,Mode
   Get-DlpCompliancePolicy -Identity "DLP - Customer data" -DistributionDetail |
     Format-List Name,Mode,DistributionStatus,DistributionResults

5. 5

   Onboard devices for endpoint DLP

   Go to Settings › Device onboarding › Onboarding, pick a deployment method (Intune, Group Policy, Configuration Manager, a local script for a handful of test devices, or the VDI package) and deploy the package.

6. 6

   Enforce in stages

   When the data owners agree with the matches, edit the policy and change Policy mode to turn it on. Enforce notify-only rules first, then Block with override on high-volume rules, and full blocking only where the business has signed off.

Verify

• From a pilot account, email dummy data that matches your rule to an external test mailbox: the policy tip appears while you compose, and the configured action applies on send.
• Share a matching test file from a test SharePoint site with an external user: access is restricted as configured.
• On an onboarded Windows device, copy a matching test file to a USB drive: the user sees a notification and the configured action applies.
• Activity explorer shows the rule-match events, high-severity rules raise alerts, and Get-DlpCompliancePolicy shows Mode as Enable.

Tips & gotchas

• Simulation isn't invisible when tips are on. Users see them, so announce the pilot.
• One purpose per rule. Rules that mix unrelated info types are hard to tune and hard to explain.
• VDI quirk: USB storage in virtual desktops is treated as a network share, so include the copy-to-network-share activity.
• DLP isn't device control. To block USB storage outright, use Defender device control; endpoint DLP is content-aware.
• Labels make DLP sharper. See rolling out sensitivity labels.