Data Loss Prevention (DLP) in Microsoft Teams

Every day, documents, customer data and sometimes even account numbers or passwords get shared in Teams. With Data Loss Prevention (DLP) in Microsoft Purview, you detect sensitive information automatically and stop it from ending up with the wrong person in a chat or channel. This article explains what DLP does in Teams, which licence you need and how to create a policy step by step.

What does DLP do in Microsoft Teams?

It scans chat and channel messages for sensitive information such as IBANs, credit card numbers or national ID numbers.
It can block a message, block it only for external users, or just show a warning.
The user sees a policy tip with an explanation and, if you allow it, can enter a business justification.
Files you share in Teams live in SharePoint and OneDrive, so include those locations in your policy too.

Which licence do you need?

DLP for Exchange, SharePoint and OneDrive is already included in Microsoft 365 E3. For DLP in Teams chats and channels you need Microsoft 365 E5 or A5, Office 365 E5, or an add-on such as Microsoft 365 E5 Compliance. See how to check your Microsoft 365 licence.

Create a DLP policy for Teams

Go to purview.microsoft.com and open Data loss prevention > Policies.
Select Create policy and choose a template, for example Financial or Privacy for your country, or start with a custom policy.
Choose Teams chat and channel messages as a location. Add SharePoint sites and OneDrive accounts as well.
Set the rules: which type of sensitive information, how many instances and what should happen (block, policy tip, alert to the admin).
Start with Run the policy in simulation mode. You see what would be blocked without disturbing users.
Review the results after a week, then turn the policy on.

Creating a new DLP policy in Microsoft Purview

Choosing Teams chat and channel messages as a DLP location

What does the user see?

When a message is blocked, the sender sees a red notice saying This message was blocked with a link to more information. The recipient only sees that a message was removed. You can let users report the message as a false positive or override it with a justification.

Tips

Start small: one information type and a policy tip, and tighten later.
Use Activity explorer in Purview to see how often rules match.
Combine DLP with encrypted email and blocking automatic forwarding.

Nederlandstalige versie: Data Loss Prevention (DLP) in Microsoft Teams activeren met Purview

share on LinkedIn ☕ buy me a coffee

More in English

▸Block specific file types from OneDrive syncStop OneDrive from uploading .pst, .ost or .iso files. Via the SharePoint admin center, PowerShell, Intune or… ▸Where is your Microsoft 365 tenant's data stored?Find the data location of Exchange, SharePoint, OneDrive and Teams in the Microsoft 365 admin center, with… ▸Security defaults in Microsoft Entra ID: what they do and how to enable themWhat security defaults in Microsoft Entra ID (formerly Azure AD) do, who they are for, how to turn them on or… ▸Which Microsoft 365 licence do I have? How to checkSee which Microsoft 365 or Office 365 licence is assigned to your account: via My Account, in the Office…

Set up Data Loss Prevention (DLP) in Microsoft Teams with Purview