mcpField
P
purview-advanced-dlp

purview-advanced-dlp

github.com/vinayaklattheSecurity17877 installsUpdated 19w ago
Repository

About purview-advanced-dlp

Microsoft Purview Advanced DLP is a skill for data security teams with classification and baseline DLP in place. It supports dynamic, context-aware enforcement using Insider Risk, precise data matching, and endpoint egress controls.

Key features

  1. 01Adjust DLP dynamically to user risk
  2. 02Precisely match proprietary data with EDM
  3. 03Combine label, recipient, and volume conditions
  4. 04Restrict endpoint data egress paths
  5. 05Tune rules using activity records

Use cases

  1. 01Adjust blocking based on Insider Risk level
  2. 02Detect content matching structured customer records
  3. 03Restrict uploads to unsanctioned cloud or AI apps
  4. 04Block copying sensitive content to USB

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/vinayaklatthe/microsoft-security-skills --skill purview-advanced-dlp

After installing, type/purview-advanced-dlpin Claude Code to confirm it loaded.

Details

From the project README

Microsoft Purview Advanced DLP

Advanced DLP extends baseline policies with risk-adaptive and high-precision controls, notably Adaptive Protection, which dynamically adjusts DLP enforcement based on a user's Insider Risk level - so low-risk users get light controls and elevated-risk users get stricter actions automatically.

When to use

Moving from static DLP to dynamic, context-aware enforcement and high-precision matching for mature data security programs that already have classification and baseline DLP working.

Do not use this skill to design a first DLP policy from scratch (use purview-dlp-policy) or to stand up Insider Risk Management (use insider-risk-baseline).

Pick the right advanced capability

GoalUse
Dynamic enforcement keyed to user riskAdaptive Protection (IRM-driven)
High-precision match against your own recordsExact Data Match (EDM) SITs
Context-aware rules (label + recipient + volume)Contextual conditions in DLP rules
Block USB / unsanctioned cloud / clipboardAdvanced Endpoint DLP egress controls
Stop paste into ChatGPT / unsanctioned AIEndpoint DLP + DSPM for AI

Rule of thumb: pick one advanced capability per quarter; layering Adaptive Protection, EDM, and new Endpoint controls simultaneously makes failure attribution impossible.

Approach

  1. Confirm prerequisites - Baseline DLP in enforce mode for at least one workload; Insider Risk Management running with tuned indicators (for Adaptive Protection). Verify: IRM is producing meaningful risk levels for a pilot population.
  2. Adaptive Protection - Integrate Insider Risk Management risk levels (minor/moderate/ elevated) with DLP so low-risk users get light controls and elevated-risk users get stricter actions (e.g., block) automatically - minimising friction while focusing protection. Verify: a test user moved to elevated triggers the stricter DLP rule branch.
  3. Exact Data Match (EDM) - Use EDM SITs to match against a hashed copy of your structured data (e.g., customer records) for high-precision, low-false-positive detection. Verify: EDM schema definition uploaded, hash refresh succeeded, and test sample matches.
  4. Contextual conditions - Combine sensitivity labels, classifiers, content volume, recipient, and access scope for precise rules (e.g., "Confidential + external recipient + ≥5 SIT matches"). Verify: test events show the rule fires only on the intended combinations.
  5. Endpoint egress controls - Restrict copy to USB, upload to unsanctioned cloud/AI apps, network share, clipboard, and printing on managed endpoints. Verify: a test paste of labelled content into an unsanctioned AI app is blocked or flagged.
  6. Tune continuously - Use Activity Explorer and alerts to refine; review override justifications weekly. Verify: false-positive rate trends down month over month.

Guardrails

  • Adaptive Protection requires Insider Risk Management configured and consented - plan privacy and pseudonymisation with legal/works councils before enabling.
  • EDM requires schema definition, a hashed data upload, and a dedicated upload role - this is not a quick win and needs data-engineering ownership.
  • Validate dynamic enforcement in audit/simulation before enabling block actions - dynamic block in production with no audit phase is a guaranteed incident.
  • Endpoint DLP advanced controls (clipboard, USB, network share) need onboarded devices and E5 Compliance; mac and Windows behaviour can differ.
  • Keep an exception path - business processes break; an override workflow with justification is required.

Common anti-patterns

  • Turning Adaptive Protection straight to "block on elevated" before IRM thresholds are tuned - blocks innocent users on noisy indicators.
  • EDM with a 50-column schema and no refresh job - matches go stale silently.
  • Stacking contextual conditions until nothing matches, then declaring DLP "doesn't work".
  • Blocking clipboard tenant-wide without piloting on knowledge workers.
  • No metrics on override frequency - tuning becomes guesswork.

Example prompts

  • Configure risk-based DLP driven by Insider Risk Adaptive Protection.
  • Set up Exact Data Match (EDM) for precise DLP detection.
  • How do I add contextual conditions to advanced Endpoint DLP?
  • Validate dynamic DLP enforcement in simulation before blocking.
  • Block clipboard paste of Highly Confidential into unsanctioned AI on managed endpoints.

Microsoft Learn

Comments

Markdown supported