Microsoft Purview DLP – Step by Step

Safeguarding sensitive company information and ensuring compliance is essential in this day and age. Microsoft Purview offers a robust solution for unified data governance, protection, and compliance management across your organization.

Step 1: Access Microsoft Purview Portal

1. Go to the Purview Portal: Visit the Microsoft Purview portal.
2. Sign in with Your Organizational Account: Use your work or school account to access the portal.
3. Set Up Permissions: Ensure you have the necessary roles, such as Global Administrator or Compliance Administrator, to configure and manage Purview settings.

---

Step 2: Create a Microsoft Purview Account in Azure

1. Open the Azure Portal: Go to Azure portal.
2. Create Resource: In the main Azure portal, click on Create a resource in the left-hand navigation panel.
3. Search for Microsoft Purview: Enter “Microsoft Purview” in the search bar, select it from the results, and click Create.
4. Configure Basic Settings:
   • Subscription: Select your Azure subscription.
   • Resource Group: Choose an existing resource group or create a new one for organizing Purview resources.
   • Account Name: Enter a unique name for your Purview account.
   • Region: Select the region closest to where your data resides (e.g., East US, West Europe).
5. Review + Create: Verify your settings, then click Create. Azure will deploy the Microsoft Purview account in a few minutes.

---

Step 3: Set Up Data Map and Catalog

1. Access Data Map: In the Purview portal, navigate to Data Map on the left menu.
2. Register Data Sources:
   • Click Register: Select Register to add a new data source to map your organization’s data.
   • Choose Data Source Type: Select the data source type (e.g., Azure Blob Storage, SQL Server, Microsoft 365).
   • Fill in Connection Details: Enter the necessary information, such as server name, database name, and authentication details.
3. Set Up Scanning and Classification:
   • Create a Scan: After registering your data source, set up a scan to discover data assets.
   • Configure Scan Scope and Frequency:
     • Define the scope of your scan, such as specific databases, files, or locations.
     • Set a scan frequency (e.g., weekly, monthly) to continuously update your data map.
   • Define Data Classifications: Select predefined classifications, like PII or financial data, or create custom ones.
4. Run the Scan: Start the scan to populate your data catalog, allowing you to view your organization’s data assets by type, location, and sensitivity.

---

Step 4: Define and Apply Sensitivity Labels

Creating Sensitivity Labels

1. Go to Information Protection: Navigate to Information Protection within the Purview portal.
2. Create New Label:
   • Click Create Label: Enter a name and description for the label (e.g., Confidential, Internal).
   • Define Protection Settings:
     • Encryption: Choose to encrypt the document, set permissions (e.g., read-only, view-only), and specify users or groups allowed access.
     • Content Marking: Optionally add visual markings like watermarks or headers/footers.
3. Save Label and repeat this process to create labels for various data sensitivity levels.

Publishing Sensitivity Labels

1. Create a Label Policy: Once you have created your labels, create a policy to publish them.
2. Assign Labels to Users or Groups: Specify who can apply or see these labels (e.g., finance department, HR team).
3. Configure Additional Policy Settings:
   • Set default labels for specific document types or classifications.
   • Configure mandatory labeling to ensure users classify documents before saving or sharing.
4. Publish: Apply the policy, making the labels accessible across Microsoft 365 and endpoint devices.

---

Step 5: Configuring Data Loss Prevention (DLP) Policies for Microsoft 365 and Endpoints

DLP policies allow you to monitor and protect sensitive information across email, cloud storage, endpoints, and even USB devices.

Creating a DLP Policy

1. Access DLP Settings: In the Purview portal, go to Data Loss Prevention.
2. Create a New Policy:
   • Select Policy Scope: Choose locations for DLP policy enforcement, such as Exchange Online, SharePoint, OneDrive, Microsoft Teams, and Endpoints.
   • Choose Data Type: Specify sensitive information types (e.g., credit card numbers, Social Security numbers).
   • Define Policy Rules:
     • Detect Content: Configure patterns or keywords to detect sensitive content.
     • Actions to Take: Choose actions to take when sensitive data is detected, such as block sharing, restrict access, or notify users.
   • Configure Endpoint DLP:
     • Enable DLP on Windows endpoints, allowing you to restrict or monitor data transfers to USB drives, network shares, or even printing.
     • Define file path exclusions, if necessary, to allow specific transfers.
3. Set Real-Time Alerts:
   • Configure alerts for policy violations, notifying the security team or compliance team via email or dashboard alerts.
   • Set thresholds for triggering alerts, like notifying after multiple violations within a short period.
4. Test Mode:
   • Start the DLP policy in Test Mode to assess the impact and accuracy without enforcing restrictions.
   • Review results and refine rules if necessary before full enforcement.

---

Step 6: Compliance and Risk Management Reporting

Setting Up Compliance with Compliance Manager

1. Go to Compliance Manager: In the Purview portal, navigate to Compliance Manager.
2. Select a Compliance Framework:
   • Choose a framework like NIST RMF 1.0, GDPR, HIPAA, or others that are relevant to your organization’s regulatory requirements.
3. Assign Compliance Controls:
   • Review the recommended controls and assign tasks to team members for remediation or compliance implementation.
   • Track progress and document actions taken to meet compliance requirements.

Setting Up Risk and Compliance Reports

1. Access Risk Insights: Generate risk reports to see the movement of sensitive data, policy violations, and high-risk activity.
2. Run Compliance Reports:
   • Generate reports on compliance with regulatory requirements.
   • Customize reports based on DLP policy violations, data access, and sensitivity label usage.
3. Schedule Regular Reports: Set reports to be automatically generated on a regular basis, such as weekly or monthly, to keep stakeholders updated on compliance status.

---

Step 7: Monitor Data Activities with Activity Explorer

1. Navigate to Activity Explorer: In the Purview portal, open Activity Explorer to monitor and review data usage.
2. View Data Access Events:
   • Filter events by activity type, such as file access, data sharing, or policy violation.
   • Monitor which users are accessing sensitive data and how they are handling it.
3. Identify Anomalies:
   • Review access patterns, looking for unusual or suspicious activity, such as access from unexpected locations or times.
4. Respond to Incidents:
   • Investigate alerts triggered by DLP policy or sensitivity label violations.
   • Use detailed activity logs to track data paths and initiate response actions if a violation requires escalation.

---

Step 8: Continuous Improvement and Adjustments

1. Review Policy Violations and Update Rules: Regularly analyze DLP incidents and policy violations to fine-tune rules and reduce false positives.
2. Provide Ongoing User Training: Educate users about labeling, DLP policies, and secure data handling practices to reduce accidental data leaks.
3. Regular Audits and Compliance Checks: Schedule periodic reviews of your DLP policies and sensitivity labels to ensure they align with the latest regulatory standards and organizational needs.

---

Conclusion

By following these steps, you’ll have a comprehensive DLP solution in place with Microsoft Purview. With capabilities that span from sensitivity labeling and DLP to real-time alerts and compliance management, Purview enables you to protect sensitive information, enforce data protection policies across Microsoft 365 and endpoints, and maintain regulatory compliance. Regularly monitor and refine your DLP setup to stay ahead of potential risks and ensure data protection remains aligned with your organization’s needs and compliance obligations.