implementing-endpoint-dlp-controls

# Implementing Endpoint DLP Controls ## When to Use Use this skill when: - Deploying endpoint DLP to prevent sensitive data (PII, PHI, PCI) from leaving the organization - Configuring content inspection rules for email attachments, USB transfers, and cloud uploads - Implementing Microsoft Purview DLP or Symantec DLP endpoint policies - Meeting compliance requirements for data protection (GDPR, HIPAA, PCI DSS) **Do not use** for network DLP (inline proxy-based) or cloud-only DLP (CASB). ## Prerequisites - Microsoft 365 E5 or standalone Microsoft Purview DLP license - Microsoft Purview compliance portal access (compliance.microsoft.com) - Sensitive Information Types (SITs) defined for organization data - Endpoint onboarded to Microsoft Purview (via Intune or SCCM) ## Workflow ### Step 1: Define Sensitive Information Types ``` Microsoft Purview → Data Classification → Sensitive info types Built-in SITs for common data: - Credit card number (PCI) - Social Security Number (PII) - Health records (HIPAA) - Passport number - Bank account number Custom SIT example (Employee ID): Pattern: EMP-[0-9]{6} Confidence: High Keywords: "employee id", "emp id", "staff number" ``` ### Step 2: Create DLP Policy ``` Microsoft Purview → Data loss prevention → Policies → Create policy Policy Configuration: 1. Template: Financial / Medical / PII (or custom) 2. Locations: Devices (endpoint DLP) 3. Conditions: - Content contains: Credit card numbers (min 5 instances) - OR Conte...