Data Loss Prevention

Content is matched using sensitive-information types and classifiers, then labelled with sensitivity labels that can also apply encryption. Labels travel with the file across email, SharePoint and OneDrive, so protection follows the data rather than the location, and policies can act on the label instead of re-inspecting content.

At each exit point a policy can audit, warn the user with a policy tip, block or encrypt. Policies usually start in audit mode to measure real activity, then tighten to warn and block once matches have been reviewed, which limits disruption to normal work while still stopping genuine data leaks.

Email, endpoints, SharePoint, OneDrive, Teams, cloud apps and removable media, plus shared links. Endpoint policies cover actions such as copying to USB or uploading through a browser, while cloud app controls limit sharing outside the organisation, so the main routes data uses to leave are covered by one policy set.

Every match is logged to a central console, reviewed during incident triage and used to refine conditions, thresholds and exceptions. Over time this removes noisy rules and adds precision, so users see fewer needless warnings and security teams spend their time on genuine incidents instead of clearing false alerts.