How can you configure advanced DLP (Data Loss Prevention) rules in Microsoft 365 to prevent data leakage between two internal tenants using custom regex patterns and exclusions?

Question

How can you configure advanced DLP (Data Loss Prevention) rules in Microsoft 365 to prevent data leakage between two internal tenants using custom regex patterns and exclusions?

Answer 1

Thanks for the question!

To configure advanced DLP rules in M365:

**Create DLP Policy**
•	At the source, go to **Microsoft 365 Compliance Center > Data Loss Prevention > Create a policy**.
•	Select **Custom policy** and choose locations (Exchange, SharePoint, etc.).

**Define Sensitive Info Type with Regex**
•	In the policy, create a **Custom Sensitive Info Type**.
•	Use the regex pattern to define what data you want to detect (e.g., AB\d{8} for account numbers).
•	Set **Confidence Levels** for accuracy.

**Set Exclusions**
•	Under **Except when**, define exclusions like:
o	**Recipient domain** (e.g., exclude certain domains within internal tenants).
o	**Sender domain** or specific users/groups.

**Configure Actions**
•	Choose actions such as **block**, **restrict**, or **notify** based on the policy triggers.

**Test and Deploy**
•	Test the policy using **simulation mode** to ensure accuracy.
•	Review **DLP reports**, fine-tune if needed, then deploy.

Tuned policy will block or monitor sensitive data transmission between internal tenants, with necessary exclusions applied.

DLP policies will need to be deployed within **both** source tenants.