Understand and plan data loss prevention.
In this module you learn to:
- Explain what data loss prevention is designed to address and where it fits in a data security strategy
- Describe how DLP evaluates content, context, and user actions
- Identify where DLP can apply protection and how enforcement differs by location
- Plan DLP policies based on risk, scope, and operational considerations
- Use simulation mode to validate policy behavior before enforcement
- Recognize when advanced DLP controls can improve enforcement decisions
Create and manage data loss prevention policies.
In this module you learn to:
- Establish clear intent and boundaries before creating a DLP policy
- Decide when to use a template-based policy or create a custom policy
- Define detection logic that reflects meaningful data risk
- Align policy scope and actions to real business workflows
- Validate and refine policy behavior using simulation mode
- Manage and adapt DLP policies as risk and usage patterns change
Learn how to discover, classify, and protect sensitive and business-critical content throughout its lifecycle across your organization.
When you finish with this module, you'll be able to:
- Understand the benefits of endpoint DLP
- Onboard devices for endpoint DLP
- Configure endpoint DLP settings
- Create and manage endpoint DLP policies
Configure DLP policies for Microsoft Defender for Cloud Apps and Power Platform
In this module you learn to:
- Describe the integration of DLP with Microsoft Defender for Cloud Apps.
- Configure policies in Microsoft Defender for Cloud Apps.
Investigate and Respond to Microsoft Purview Data Loss Prevention Alerts.
In this module you learn to:
- Investigate DLP alerts in Microsoft Purview and Microsoft Defender XDR
- Review alert details, related user activities, and matched events
- Apply remediation actions and update alert or incident statuses
- Assign ownership, document decisions, and support accountability
- Recognize when DLP policies might need adjustments based on investigation outcomes

Syllabus

Understand and plan data loss prevention
- Introduction
- Understand the role of data loss prevention (DLP)
- Understand how DLP applies protection
- Plan and design DLP policies
- Understand DLP deployment and simulation mode
- Evaluate advanced DLP controls for your environment
- Module assessment
- Summary
Create and manage data loss prevention policies
- Introduction
- Understand how DLP policy decisions fit together
- Choose a template or create a custom policy
- Define what the policy detects
- Align policy scope to risk
- Define how the policy responds
- Validate policy behavior using simulation mode
- Manage DLP policies
- Adjust enforcement dynamically based on risk
- Guided walkthrough: Create a DLP policy
- Module assessment
- Summary
Implement endpoint data loss prevention (DLP) with Microsoft Purview
- Introduction
- Endpoint data loss prevention (DLP) overview
- Understand the endpoint DLP implementation workflow
- Onboard devices for endpoint DLP
- Configure settings for endpoint DLP
- Create and manage endpoint DLP policies
- Deploy the Microsoft Purview browser extension
- Configure just-in-time (JIT) protection
- Module assessment
- Summary and resources
Configure DLP policies for Microsoft Defender for Cloud Apps and Power Platform
- Introduction
- Configure data loss prevention policies for Power Platform
- Integrate data loss prevention in Microsoft Defender for Cloud Apps
- Configure policies in Microsoft Defender for Cloud Apps
- Manage data loss prevention violations in Microsoft Defender for Cloud Apps
- Module assessment
- Summary and resources
Investigate and respond to Microsoft Purview Data Loss Prevention alerts
- Introduction
- Understand data loss prevention (DLP) alerts
- Understand the DLP alert lifecycle
- Configure DLP policies to generate alerts
- Investigate DLP alerts in Microsoft Purview
- Investigate DLP alerts in Microsoft Defender XDR
- Investigate DLP alerts with Security Copilot and AI agents
- Respond to DLP alerts
- Exercise - Investigate a DLP alert and related incident
- Module assessment
- Summary