What data loss prevention is and is not
Data loss prevention looks at content and destination: may this type of data leave, go to a guest, or go to a personal mailbox? It is not antivirus, not training, and not a substitute for who may share which folder. A sensitivity label says “this is confidential”; data loss prevention says “if this type of data leaves the tenant, warn or block”.
Microsoft ships templates for known data types. Not all of them fit a small company in the Netherlands. Too strict means legitimate quotes and client attachments get stuck. Too loose means you notice a bulk export or a misaddressed attachment only when it is too late — or never.
When an SME should start
A sensible starting point is often when one or more of these apply:
- You process personal data or financial data in mail and files — and that must not go freely to a private address or a random external party.
- External sharing is already limited, but content can still leave as an attachment — labels and sharing settings alone do not cover that.
- You want to see first, not block immediately — warn mode gives insight without stopping the business.
- There is one owner who may review notifications — otherwise every notification becomes ignored mail.
Start small: one rule for personal data to external recipients, or one for financial data. Measure for a few weeks. Then tune — see also alert policies for signals that sit beside data loss prevention.
Warn first, block later
For an SME, warn or log-only is usually the first step. Blocking follows once you know which false positives you get and who may approve exceptions. Without that agreement, blocking feels like “IT stops our work” — and then the policy gets turned off.
Name who receives notifications (not “every Global Admin” with no agreement), what a user should do on a warning, and when Floor ICT or the director escalates. Tie this to who may roll out labels and who manages external guests.
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant we typically: turn on or tune the agreed data loss prevention rules; cover the channels you want (mail, Teams, SharePoint, OneDrive); choose warn versus block; and briefly explain which notifications you should expect. We filter templates that mostly add noise for your size unless you ask for them.
You still decide: which data types are in scope, how strict the first version may be, who handles exceptions, and whether a notification may become a Floor ICT ticket. Essential, Advanced, or Elite say nothing about data loss prevention; that is tenant configuration beside the MSP package. Data loss prevention works best next to sensitivity labels, external sharing policy, and a working audit log.
More depth
Checklist for SME directors
1) Name one or two data types that must not leave freely. 2) Choose warn or log as the first mode. 3) Name one owner for notifications. 4) Have Floor ICT publish the rule on mail plus files. 5) Review false positives after two to four weeks. 6) Only then apply blocking if needed — not everything at once.
Data loss prevention versus sensitivity labels
Labels classify and can apply protection on a document. Data loss prevention watches whether sensitive content leaves the organisation through channels. Use them side by side; do not confuse them — see sensitivity labels.
Licensing and expectations
Which data loss prevention features are available depends on your Microsoft 365 licenses. At intake Floor ICT says what your tenant can do without promising a large Purview programme. No promises of “zero data loss” — yes to a working first rule with an owner.
Questions
Frequently asked questions
Should we immediately block everything that looks sensitive?
No. Start with one or two high-signal rules in warn mode. Blocking follows once you know false positives and have an owner for exceptions.
Is data loss prevention the same as a sensitivity label?
No. A label classifies (and can protect) on the document. Data loss prevention watches whether sensitive content leaves the organisation through mail, Teams, or files.
Do we need special licenses?
It depends on your Microsoft 365 licenses. At intake Floor ICT checks what your tenant can enable before we promise rules you cannot turn on.
Does Floor ICT do this by default with Microsoft 365 management?
At intake or when Microsoft 365 is in scope, we propose a small first rule and an owner. Which data types and whether you warn or block stays your call. The MSP package says nothing about data loss prevention; that is separate tenant configuration.