/commands/purview/dlp-policy-cmdlets
Create a Purview DLP policy with PowerShell: New-DlpCompliancePolicy and New-DlpComplianceRule
The commands on this page have not been executed by our verification runner yet.updated
- tool
- Microsoft Purview (Security & Compliance PowerShell)
- versions
- Security & Compliance PowerShell, ExchangeOnlineManagement 3.x
- os
- windows, linux, macos
A Microsoft Purview data loss prevention (DLP) policy is created in two steps in Security & Compliance PowerShell: the policy (where it applies and in which mode) and one or more rules (what to detect and what to do). Connect with Connect-IPPSSession first.
New-DlpCompliancePolicy -Name "US Financial" -ExchangeLocation All -SharePointLocation All -OneDriveLocation All -Mode TestWithNotifications
New-DlpComplianceRule -Name "Block SSN" -Policy "US Financial" `
-ContentContainsSensitiveInformation @{Name="U.S. Social Security Number (SSN)"} `
-BlockAccess $true -NotifyUser Owner -GenerateIncidentReport SiteAdminThe policy starts in simulation mode with notifications; switch it on when the results look right:
Set-DlpCompliancePolicy -Identity "US Financial" -Mode EnablePolicy mode
| -Mode value | Effect |
|---|---|
| Enable | Actions and notifications are applied (the default) |
| TestWithNotifications | Simulation: no actions, notifications are sent |
| TestWithoutNotifications | Simulation: no actions, no notifications |
| Disable | The policy is off |
Locations
New-DlpCompliancePolicy accepts -ExchangeLocation, -SharePointLocation, -OneDriveLocation, -TeamsLocation, -EndpointDlpLocation (devices), -OnPremisesScannerDlpLocation, -PowerBIDlpLocation and -ThirdPartyAppDlpLocation. Most take All or a list of mailboxes, sites or accounts.
Common rule actions
| Parameter | Values |
|---|---|
| -ContentContainsSensitiveInformation | Hashtable(s) with the sensitive information type Name, optionally minCount, minConfidence |
| -BlockAccess | $true blocks access to the matching item (owner, author and site owner keep access) |
| -NotifyUser | An email address, LastModifier, Owner or SiteAdmin |
| -GenerateIncidentReport | An email address or SiteAdmin |
Use the exact name of the sensitive information type. List them with:
Get-DlpSensitiveInformationType | Sort-Object Name | Format-Table Name,PublisherCheck what exists
Get-DlpCompliancePolicy | Format-Table Name,Mode,Enabled
Get-DlpComplianceRule -Policy "US Financial" | Format-List Name,BlockAccess,ContentContainsSensitiveInformationSources
Related pages
commands · purviewConnect-IPPSSession: connect to Security & Compliance PowerShell (Purview)Connect-IPPSSession from ExchangeOnlineManagement opens Security & Compliance PowerShell for Purview cmdlets; add -EnableSearchOnlySession for eDiscovery.commands · purviewPurview retention in PowerShell: New-RetentionCompliancePolicy, New-RetentionComplianceRule, New-ComplianceTagA retention policy is a policy plus a rule: New-RetentionCompliancePolicy sets locations, New-RetentionComplianceRule the duration. Labels: New-ComplianceTag.commands · purviewGet-Label: list sensitivity labels and label policies in Security & Compliance PowerShellGet-Label lists Purview sensitivity labels and Get-LabelPolicy shows who receives them. Both need Connect-IPPSSession; -SkipValidations helps with many labels.