How to Implement Data Leak Prevention in Microsoft 365

Microsoft 365 Office Suite contains business-critical information. Despite the company’s powerful security measures, data leak incidents happen due to security misconfigurations and a lack of certain features. Learn how to implement Data Leak Prevention in Microsoft 365 and how to empower it with third-party tools.

Understanding Data Leak Prevention (DLP)

Data leak prevention is the umbrella term for processes, policies, and tools to prevent unauthorized access to sensitive information and its theft.

Environments like Microsoft 365 offer great collaboration opportunities for teams that annihilate document duplicates and streamline editing. However, the nature of such collaboration bears hidden risks, as unauthorized individuals and entities can access sensitive data and even steal it.

Understanding these risks and building security systems to minimize them is one of the key challenges for organizations using Microsoft 365 SaaS products.

One more aspect that companies need to consider is the confusion between data leak and data loss prevention. For example, in Microsoft 365, data leak prevention policies exist as part of Data Loss Prevention functionality.

The lack of understanding of the difference between the two can cause severe gaps in your MSO 365 security.

The Importance of Data Leak Prevention for Microsoft 365 

In early 2023, Micorosft 365 controlled 46% of the market share for major office suite technologies worldwide. The rest of the market is occupied almost exclusively by Google Workspace. 19% of companies using MSO 365 have annual revenue that exceeds $50M. The revenue of 6% of their customers is over $1000M.

This makes Microsoft 365 a desired target for many cyber criminals aiming to profiteer from the exfiltrated data. Despite the developer’s best efforts and ~$1B investment in security annually, data breaches and exfiltrations happen on a regular basis.

Microsoft 365 has a shared responsibility model. It states that the business using MSO 365 is responsible for certain security measures, for example, preventing phishing attacks or controlling access to its data stored in MSO 365 services.

Data Leak Prevention in Microsoft 365

Microsoft 365 has data leak functionality. These are security policies that Admins can configure in its Compliance Center. As mentioned above, the DLP stands for Data Loss Prevention, however, you can configure policies that will help you prevent both loss and leakage.

Microsoft 365 DLP policy capabilities

Let’s take a closer look at the different features of DLP policies offered by Microsoft. 

Each DLP policy in MSO 365 has several customizable components: 

1. Name and description.
2. Locations – MSO 365 services where it can be applied (e.g., OneDrive).
3. Policy rules that consist of conditions (e.g. Content contains), exceptions, and actions (e.g., restrict access and remove on-premises files).
4. Policy mode (run test, turn off, remain off).

The DLP policies have multiple templates with different types of sensitive data. They are conveniently organized by:

•  categories (e.g., medical), 
• country, 
• law/regulation (e.g., HIPAA). 

You can edit the condition of each template to fit your organization’s security policies. You can also create custom rules.

How to implement data leak prevention in Microsoft 365

Implementing Data Leak Prevention in Microsoft 365 requires diligent planning, careful setup, close monitoring, and subsequent tuning. We suggest 7 simple steps:

1. Catalog data and identify sensitive information.
2. Define DLP policy objectives.
3. Assign DLP responsibilities to the team.
4. Configure policies in Microsoft 365 Security & Compliance Center.
5. Inform your organization about the policies.
6. Monitor policy implementation and possible data leak incidents.
7. Fine-tune policies for minimal false positives.
8. Add new data leak prevention policies when necessary.

MSO 365 Data Leak Prevention limitations

The key limitation of Data Leak Prevention in Microsoft 365 is that it is not available in all subscriptions. Below, you can see the list of subscriptions that have DLP for files and emails:

• Microsoft 365 E3
• Microsoft 365 E5
• Office 365 E3
• Office 365 E5 
• Microsoft 365 F5 + Compliance

Additionally, the following subscriptions have DLP for Teams chat:

• Microsoft 365 E5 
• Office 365 E5
• Microsoft 365 F5 + Compliance

Other limitations include the lack of control of the following risky events that can lead to data leak:

• OAuth applications
• Misconfigurations
• Ransomware

Finally, Microsoft 365 doesn’t provide visibility into abnormal behavior of data and users that can signify data leaks (for example, mass download of OneDrive files, or a suspicious login).

Learn how to implement data leak prevention in Google Workspace.

Integrating third-party tools for enhanced DLP capabilities

To fill the gaps in Microsoft 365 data leak prevention, we suggest using third-party tools like SpinOne. These solutions were specifically created to help companies detect and control cyber incidents that lie within their sphere of responsibilities under the shared responsibility model.

SpinOne data leak prevention capabilities include:

• Ransomware protection
• DLP policies that MSO 365 lacks
• Abnormal user behavior monitoring
• Abnormal data behavior monitoring
• Application detection, risk assessment, and control
• Misconfiguration detection and remediation

Get better Microsoft 365 data leak prevention with SpinOne.

FAQs