What is Microsoft Purview Data Loss Prevention? Understanding the security coverage boundaries between E3 and E5
About This Article
This article is generated using an automated workflow powered by generative AI. Based on official Microsoft documentation as of September 18, 2026, it provides a practical overview of Microsoft Purview Data Loss Prevention (DLP) differences between E3 and E5, Teams, Endpoint, and Simulation mode.Verification Status: 📘 Confirmed via official Microsoft documentation – Hardware not tested
DLP is a framework designed to detect and control the unintended exfiltration of sensitive information via email, files, Teams, and endpoints. Rather than enforcing immediate blocks, it allows for a phased rollout:Audit -> Policy Tip -> Selective blockingThis enables gradual implementation.
Key initial differences between E3 and E5
| Location / Feature | Microsoft 365 E3 | Microsoft 365 E5 / Purview Suite family |
|---|---|---|
| Basic DLP for Exchange, SharePoint, and OneDrive | Target | Target |
| Teams files | Verify protection on the underlying SharePoint/OneDrive side | Same as above |
| Teams chat/channel message DLP | Do not assume all features are available with E3 alone | Verify applicable rights |
| Endpoint DLP / Advanced features | Check additional rights per feature | Target features are expanded |
DLP depends not only on whether it is E3 or E5,but also on which locationyou are protecting to verify the license.
flowchart TD P[DLP Policy] --> EX[Exchange] P --> SP[SharePoint] P --> OD[OneDrive] P --> TM[Teams messages] P --> EP[Endpoints] EX --> A[Audit / Tip / Block] SP --> A OD --> A TM --> A EP --> A
Start with Simulation mode
Purview portal → Solutions → Data Loss Prevention → Policies → Create policy → 対象をテスト範囲へ限定 → Simulation mode
Check here
Which sensitive information types were detected
Whether there are many false positives
Whether the target users/sites are too broad
Whether policy tips are understandable to users
Success criteria: Only the expected test data is detected, without production blocking.
Change one setting
Under the same conditions, switch from "Audit only" to "Show policy tips" and compare how it appears to users. Do not block yet.
Administrative staff example: External sharing
条件: テスト用のクレジットカード番号を検知 場所: テスト用SharePointサイト 相手: 組織外 動作: Simulation / 監査 + Policy Tip
Do not use real credit card numbers or personal information for testing. Use dummy data to check for false positives and user messages.
sequenceDiagram participant U as 利用者 participant S as SharePoint/Exchange等 participant D as DLP participant A as 管理者 U->>S: 機密情報を含む操作 S->>D: 条件評価 D-->>U: Policy Tip D-->>A: Event/Alert A->>A: 誤検知・業務影響を確認
Keep 2026 expansions separate from traditional DLP
Areas such as data outside Microsoft 365, Network Data Security, and AI-related features may involve pay-as-you-go pricing or previews. Do not assume they share the same licensing and billing as traditional Microsoft 365 DLP.
Three perspectives
General users: Read policy tips not as errors, but as guidance to understand why the action was blocked.
Administrative staffHave exception procedures to distinguish between tasks that require external transmission and erroneous transmission prevention.
IT/SecurityDesign location, licensing, false positive rate, exceptions, and incident response as a cohesive set.
Points for administrators to review
Licenses per location
Rights differences between E3 file protection and Teams message DLP
False positives in simulation mode
Excessive growth of exception settings
Endpoint DLP device onboarding
Boundary between Preview and pay-as-you-go
Incident notification recipient
Official Microsoft information and primary sources
In practice, rather than blocking everything with DLP, it is safer to first visualize data, check for false positives and operational impacts, and then tighten controls only where necessary.
