Question

Contoso wants to prevent credit card numbers from being shared. Compliance requires that the DLP policy apply to Exchange email, SharePoint sites, OneDrive accounts, and Teams chat and channel messages, but the security team explicitly wants the SAME rule conditions and actions enforced identically across all these workloads with a single policy. When designing this DLP policy, what should the administrator do to meet the requirement most efficiently?

Accepted Answer

Create one DLP policy, select the multiple locations (Exchange, SharePoint, OneDrive, Teams) within that policy, and define the credit card rule once.

Answer

Create four separate DLP policies, one per workload, each containing an identical rule for credit card numbers.

Answer

Create a single DLP policy scoped only to Exchange, since Exchange transport rules automatically extend enforcement to SharePoint, OneDrive, and Teams.

Answer

Create a sensitivity label that detects credit card numbers and publish it to all four workloads instead of using a DLP policy.