<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-email-dlp-policies
description: >-
  Implement data loss prevention policies for email to detect and prevent
  unauthorized transmission of sensitive data including PII, PHI, financial
  data, and intellectual property via email channels.
domain: cybersecurity
subdomain: email-security
tags:
  - dlp
  - data-classification
  - pii
  - compliance
  - transport-rules
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1048.003", "T1567"]
  tools: [exchange-powershell, regex, python3, m365-compliance]
---

# Implementing Email DLP Policies

## Overview

Email DLP prevents sensitive data exfiltration through email. Implementation
requires defining sensitive information types, creating detection rules with
thresholds, configuring policy actions (block, encrypt, notify), and
establishing exception workflows for legitimate business needs.

## Prerequisites

- Tools: Exchange PowerShell, M365 Compliance Center
- Data classification taxonomy for the organization
- Regulatory requirements mapping (HIPAA, PCI-DSS, GDPR)

## Key Concepts

- **Sensitive info types**: Regex and keyword patterns matching PII/PHI/PCI
- **Confidence levels**: Threshold determining match certainty (75-100)
- **Policy actions**: Block, quarantine, encrypt, notify, or allow with override
- **DLP incident reports**: Automated reporting on policy triggers

## Workflow

### Step 1: Sensitive Information Type Definition

```powershell
# List built-in sensitive info types
Get-DlpSensitiveInformationType | Select Name, Publisher | Sort Name

# Create custom sensitive info type
New-DlpSensitiveInformationType -Name "Internal Project Code" \
  -Description "Matches internal project code format"
```

### Step 2: DLP Policy Creation

```powershell
# Create DLP policy for PII protection
New-DlpCompliancePolicy -Name "Email PII Protection" \
  -ExchangeLocation All -Mode Enable

# Add rule for credit card numbers
New-DlpComplianceRule -Name "Block Credit Card in Email" \
  -Policy "Email PII Protection" \
  -ContentContainsSensitiveInformation @{
    Name = "Credit Card Number"; MinCount = 1; MinConfidence = 85
  } \
  -BlockAccess $true \
  -NotifyUser "SenderNotifyOnly"
```

### Step 3: Transport Rule DLP

```powershell
# Block sensitive content externally
New-TransportRule -Name "Block Sensitive Attachments" \
  -AttachmentContainsWords "CONFIDENTIAL","TOP SECRET" \
  -SentToScope NotInOrganization \
  -RejectMessageReasonText "Cannot send classified content externally"

# Auto-encrypt PII
New-TransportRule -Name "Auto-Encrypt PII" \
  -SentToScope NotInOrganization \
  -MessageContainsDataClassifications @{
    Name = "Credit Card Number"; MinCount = "1"
  } \
  -ApplyRightsProtectionTemplate "Encrypt"
```

### Step 4: Custom Regex Detection

```python
import re

PATTERNS = {
    "credit_card": r"\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\b",
    "ssn": r"\b\d{3}-\d{2}-\d{4}\b",
    "aws_key": r"AKIA[0-9A-Z]{16}",
    "api_key": r"(?:api[_-]?key)[\s:=]+[\x27\"]?[a-zA-Z0-9_-]{20,}",
}

def scan_content(text: str) -> list[dict]:
    matches = []
    for name, pattern in PATTERNS.items():
        found = re.findall(pattern, text, re.IGNORECASE)
        if found:
            matches.append({"type": name, "count": len(found)})
    return matches
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| DLP trigger | M365 Compliance | Emails matching DLP rules |
| Override abuse | Audit logs | Excessive DLP override by single user |
| Encoded bypass | Gateway | Base64 content bypassing text DLP |

```yaml
title: Email DLP Policy Override Abuse
id: a7b8c9d0-e1f2-3456-a012-789012345678
status: experimental
description: Detects excessive DLP policy overrides indicating data exfiltration
logsource:
  category: application
  product: m365
detection:
  selection:
    Operation: "DlpRuleOverride"
  condition: selection | count(UserId) by UserId > 10
falsepositives:
  - Departments routinely handling sensitive data with approved overrides
level: high
tags:
  - attack.t1048.003
  - attack.exfiltration
```

## Verification

- [ ] Sensitive info types defined for all data classifications
- [ ] DLP policies created for PII, PHI, financial, and IP data
- [ ] Policy actions configured (block, encrypt, notify)
- [ ] Override workflow with justification enabled
- [ ] DLP incident reports generated and reviewed

## References

- [Microsoft DLP](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp)
- [CIS Controls v8 — Control 3](https://www.cisecurity.org/controls)
- [NIST SP 800-171](https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final)
