Implementing Endpoint DLP Controls

When to Use

Use this skill when:

• Deploying endpoint DLP to prevent sensitive data (PII, PHI, PCI) from leaving the organization
• Configuring content inspection rules for email attachments, USB transfers, and cloud uploads
• Implementing Microsoft Purview DLP or Symantec DLP endpoint policies
• Meeting compliance requirements for data protection (GDPR, HIPAA, PCI DSS)

Do not use for network DLP (inline proxy-based) or cloud-only DLP (CASB).

Prerequisites

• Microsoft 365 E5 or standalone Microsoft Purview DLP license
• Microsoft Purview compliance portal access (compliance.microsoft.com)
• Sensitive Information Types (SITs) defined for organization data
• Endpoint onboarded to Microsoft Purview (via Intune or SCCM)

Workflow

Step 1: Define Sensitive Information Types

Microsoft Purview → Data Classification → Sensitive info types

Built-in SITs for common data:
- Credit card number (PCI)
- Social Security Number (PII)
- Health records (HIPAA)
- Passport number
- Bank account number

Custom SIT example (Employee ID):
  Pattern: EMP-[0-9]{6}
  Confidence: High
  Keywords: "employee id", "emp id", "staff number"

###…