Skip to content

SCDLPCompliancePolicy

Parameters

Parameter Attribute DataType Description Allowed Values
Name Key String The Name parameter specifies the unique name of the DLP policy. If the value contains spaces, enclose the value in quotation marks.
Comment Write String The Comment parameter specifies an optional comment.
EndpointDlpLocation Write String[] The EndpointDLPLocation parameter specifies the user accounts to include in the DLP policy for Endpoint DLP when they are logged on to an onboarded device. You identify the account by name or email address. You can use the value All to include all user accounts.
EndpointDlpLocationException Write String[] The EndpointDlpLocationException parameter specifies the user accounts to exclude from Endpoint DLP when you use the value All for the EndpointDlpLocation parameter. You identify the account by name or email address.
OnPremisesScannerDlpLocation Write String[] The OnPremisesScannerDlpLocation parameter specifies the on-premises file shares and SharePoint document libraries and folders to include in the DLP policy. You can use the value All to include all on-premises file shares and SharePoint document libraries and folders.
OnPremisesScannerDlpLocationException Write String[] The OnPremisesScannerDlpLocationException parameter specifies the on-premises file shares and SharePoint document libraries and folders to exclude from the DLP policy if you use the value All for the OnPremisesScannerDlpLocation parameter.
PowerBIDlpLocation Write String[] The PowerBIDlpLocation parameter specifies the Power BI workspace IDs to include in the DLP policy. Only workspaces hosted in Premium Gen2 capacities are permitted. You can use the value All to include all supported workspaces.
PowerBIDlpLocationException Write String[] The PowerBIDlpLocationException parameter specifies the Power BI workspace IDs to exclude from the DLP policy when you use the value All for the PowerBIDlpLocation parameter. Only workspaces hosted in Premium Gen2 capacities are permitted.
ThirdPartyAppDlpLocation Write String[] The ThirdPartyAppDlpLocation parameter specifies the non-Microsoft cloud apps to include in the DLP policy. You can use the value All to include all connected apps.
ThirdPartyAppDlpLocationException Write String[] The ThirdPartyAppDlpLocationException parameter specifies the non-Microsoft cloud apps to exclude from the DLP policy when you use the value All for the ThirdPartyAppDlpLocation parameter.
ExchangeLocation Write String[] The ExchangeLocation parameter specifies Exchange Online mailboxes to include in the DLP policy. You can only use the value All for this parameter to include all mailboxes.
ExchangeSenderMemberOf Write String[] Exchange members to include.
ExchangeSenderMemberOfException Write String[] Exchange members to exclude.
Mode Write String The Mode parameter specifies the action and notification level of the DLP policy. Valid values are: Enable, TestWithNotifications, TestWithoutNotifications, Disable and PendingDeletion. Enable, TestWithNotifications, TestWithoutNotifications, Disable, PendingDeletion
OneDriveLocation Write String[] The OneDriveLocation parameter specifies the OneDrive for Business sites to include. You identify the site by its URL value, or you can use the value All to include all sites.
OneDriveLocationException Write String[] This parameter specifies the OneDrive for Business sites to exclude when you use the value All for the OneDriveLocation parameter. You identify the site by its URL value.
OneDriveSharedBy Write String[] The OneDriveSharedBy parameter specifies the users to include in the DLP policy (the sites of the OneDrive user accounts are included in the policy). You identify the users by UPN.
OneDriveSharedByMemberOf Write String[] The OneDriveSharedByMemberOf parameter specifies the distribution groups or mail-enabled security groups to include in the DLP policy (the OneDrive sites of group members are included in the policy). You identify the groups by email address.
ExceptIfOneDriveSharedBy Write String[] The ExceptIfOneDriveSharedBy parameter specifies the users to exclude from the DLP policy (the sites of the OneDrive user accounts are included in the policy). You identify the users by UPN.
ExceptIfOneDriveSharedByMemberOf Write String[] The ExceptIfOneDriveSharedByMemberOf parameter specifies the distribution groups or mail-enabled security groups to exclude from the DLP policy (the OneDrive sites of group members are excluded from the policy). You identify the groups by email address.
Priority Write UInt32 Priority for the Policy.
SharePointLocation Write String[] The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.
SharePointLocationException Write String[] This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.
TeamsLocation Write String[] Teams locations to include
TeamsLocationException Write String[] Teams locations to exclude.
Ensure Write String Specify if this policy should exist or not. Present, Absent
Credential Write PSCredential Credentials of the Exchange Global Admin
ApplicationId Write String Id of the Azure Active Directory application to authenticate with.
TenantId Write String Id of the Azure Active Directory tenant used for authentication.
CertificateThumbprint Write String Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
CertificatePassword Write PSCredential Username can be made up to anything but password will be used for CertificatePassword
CertificatePath Write String Path to certificate used in service principal usually a PFX file.
ManagedIdentity Write Boolean Managed ID being used for authentication.
AccessTokens Write String[] Access token used for authentication.

Description

This resource configures a Data Loss Prevention Compliance Policy in Purview.

Permissions

Purview

To authenticate with Microsoft Purview, this resource requires the following permissions:

Roles

  • Read
  • Security Reader
  • Update
  • Organization Configuration

Role Groups

  • Read
  • Security Reader
  • Update
  • Compliance Data Administrator

Graph

To authenticate with the Graph API, this resource requires the following permissions:

Delegated permissions

  • Read

  • None

  • Update

  • None

Application permissions

  • Read

  • GroupMember.Read.All

  • Update

  • GroupMember.Read.All

Office 365 Exchange Online

To authenticate with the Office 365 Exchange Online API, this resource requires the following permissions:

Delegated permissions

  • Read

  • None

  • Update

  • None

Application permissions

  • Read

  • Exchange.ManageAsApp

  • Update

  • Exchange.ManageAsApp

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        SCDLPCompliancePolicy 'SCDLPCompliancePolicy-Example'
        {
            Name                                  = "Customer Financial Data Protection"
            Comment                               = "Blocks sharing of credit card numbers"
            Priority                              = 1
            SharePointLocation                    = @("All")
            SharePointLocationException           = @("https://contoso.sharepoint.com/sites/publicrelations")
            EndpointDlpLocation                   = @("All")
            EndpointDlpLocationException          = @("securityoperations@contoso.com")
            OnPremisesScannerDlpLocation          = @("All")
            OnPremisesScannerDlpLocationException = @("\\fs01.contoso.com\PublicArchive")
            ThirdPartyAppDlpLocation              = @("All")
            ThirdPartyAppDlpLocationException     = @("Dropbox")
            ExchangeLocation                      = @("All")
            ExchangeSenderMemberOfException       = @("executives@contoso.com")
            OneDriveLocation                      = @("All")
            ExceptIfOneDriveSharedBy              = @("avery.howard@contoso.com")
            ExceptIfOneDriveSharedByMemberOf      = @("legal@contoso.com")
            TeamsLocation                         = @("All")
            TeamsLocationException                = @("engineering@contoso.com")
            Mode                                  = "TestWithoutNotifications"
            Ensure                                = "Present"
            ApplicationId                         = $ApplicationId
            TenantId                              = $TenantId
            CertificateThumbprint                 = $CertificateThumbprint
        }
    }
}