HOW-TO GUIDE 5

Create a basic Data Loss Prevention (DLP) policy with Microsoft Purview

1. Purpose

This guide explains how to detect and control the sharing of sensitive information – for example employee PAN and Aadhaar numbers, and bank account details – in email and documents. You will create one DLP policy, run it in simulation mode with policy tips so users learn what is sensitive, then enforce it with warnings and blocks for external sharing.

2. Applies to / licence required

3. Prerequisites

• Business Premium licences assigned to all users in scope.
• Agreement from HR, finance and management on what counts as sensitive and what action to take (warn, block, allow override with justification).
• A pilot group of users from HR and accounts (who handle PAN/Aadhaar and bank details).
• Auditing turned on (default for most tenants) – check in Purview portal > Solutions > Audit.

4. Built-in sensitive information types to use

5. Step-by-step procedure

Part A (optional) – Create a custom SIT for Indian bank accounts

1. In the Purview portal, go to Solutions > Information Protection > Classifiers > Sensitive info types (menu location may vary; search 'Sensitive info types') and select + Create sensitive info type.
2. Name it India Bank Account (Custom). Add a pattern: primary element a regular expression for 9–18 digits (for example \b\d{9,18}\b), with supporting keywords within 300 characters such as account number, a/c no, bank account, IFSC. Set confidence level to Medium.
3. Save, then use Test on the SIT page with a sample document to confirm it matches real formats without too many false positives.

Part B – Create the DLP policy

4. Go to purview.microsoft.com > Solutions > Data loss prevention > Policies > + Create policy.
5. When asked what info to protect, choose data stored in connected sources (Enterprise applications & devices). Choose category Custom and template Custom policy (or review Privacy templates for India-related options, for example India Information Technology Act – verify availability).
6. Name the policy DLP-India-PII-Financial and add a description. Leave Admin units as Full directory.
7. Locations: turn on Exchange email, SharePoint sites and OneDrive accounts. Leave Teams chat and channel messages off unless your licensing covers it (see section 2). Scope to the pilot group first where the location allows it.
8. Choose Create or customize advanced DLP rules and select + Create rule.
9. Rule 1 – Low volume (warn): Conditions > Content contains > Sensitive info types: add PAN, Aadhaar and the custom bank SIT, instance count 1 to 9. Add condition Content is shared from Microsoft 365 > with people outside my organization. Action: Restrict access or encrypt the content in Microsoft 365 locations – block people outside your organisation. Turn on User notifications with policy tips and User overrides (Allow overrides from M365 services, require a business justification).
10. Rule 2 – High volume (block): same conditions with instance count 10 or more, block external sharing with no override. Incident reports: severity High, send an alert to the IT/compliance mailbox.
11. On Policy mode, select Run the policy in simulation mode and tick Show policy tips while in simulation mode. Select Next, then Submit.

[SCREENSHOT PLACEHOLDER – Purview – DLP rule with India PAN and Aadhaar conditions and policy tip settings]

Part C – Review simulation, then enforce

12. After 1–2 weeks, open the policy and review the Simulation overview, matched items and Alerts. Also use Data loss prevention > Explorers > Activity explorer (or Activity explorer under Data explorers) to see which files and emails matched.
13. Tune rules: raise instance counts, adjust the custom SIT, or exclude a trusted partner domain if needed.
14. Edit the policy and change Policy mode to Turn the policy on immediately. Widen scope from the pilot group to all users.

Part D – Introduction to sensitivity labels

Sensitivity labels let users classify documents and emails (for example Public, Internal, Confidential, Highly Confidential – HR/Finance). Labels can add headers/watermarks and encryption. Create them in Solutions > Information Protection > Sensitivity labels > + Create a label, then publish them with Publishing policies to a pilot group. DLP policies can later use labels as a condition. Manual labelling is included in Business Premium; for automatic labelling, verify licensing in the portal.

6. Verification and testing

• As a pilot user, create a Word file containing test PAN and Aadhaar numbers (use Microsoft's sample formats, never real data) and save it to OneDrive.
• Share it with an external email address: a policy tip should appear in simulation; after enforcement, external access should be blocked (or allowed with justification for Rule 1).
• Send an email with a test PAN to an external address from Outlook: a policy tip should appear while composing.
• Check Data loss prevention > Alerts for the generated alert and Activity explorer for the event (allow up to a few hours for reports).

7. Troubleshooting / common issues

8. Best practices

• Start in simulation mode with policy tips; enforce only after reviewing matches.
• Begin with a small number of SITs and clear rules; add more later.
• Explain to staff why the policy exists – tips should educate, not surprise.
• Review alerts and override justifications weekly; adjust rules monthly.
• Never use real PAN, Aadhaar or bank numbers for testing.

9. Glossary

10. Need help with rollout?

Need help planning or rolling this out across your sites? Contact Kalpesh Adhvaryu (IT consultancy) for rollout support, pilot planning and hands-on configuration.

Portal menus change regularly. This guide was checked against Microsoft Learn documentation in October 2026; if a menu name differs in your tenant, search for the setting name in the portal or check the linked Microsoft Learn topic.