Job Search

Our client has a remote contract opportunity for a Microsoft Purview DLP Rule Creation Consultant to configure and implement Microsoft Purview Data Loss Prevention (DLP) policies within the Microsoft 365 compliance center, targeting Microsoft Teams chat and channel messages, with a focus on monitoring and protecting sensitive data from exposure—particularly to unauthenticated or high-risk external entities.

Scope:

• Apply to 1:1 chats, group chats, and channel messages in Microsoft Teams.
• Cover communication with both internal and external users, including guest accounts and unauthenticated participants.
• Focus on detecting and preventing sharing of:
  • Personally identifiable information (PII)
  • Financial data (e.g., credit card numbers, bank accounts)
  • Regulated data (e.g., HIPAA, GDPR-related)
  • Internal confidential content (e.g., project codes, strategy documents).
• Ensure integration with existing Microsoft Purview Information Protection (MPIP) labels and sensitivity metadata.

Requirements:

• Create DLP policies that inspect Teams messages (including attachments) for defined sensitive information types and custom expressions.
• Include detection logic for: 
  • Communication involving unauthenticated users or high-risk entities (e.g., external domains not on allowlist).
  • Sharing attempts from guest accounts or unmanaged devices.
• Policy actions must:
  • Block message delivery when high-risk sharing is detected.
  • Show policy tips to warn users in real time. 
  • Alert compliance officers via incident reports and integration with Microsoft Sentinel (if applicable).
• Configure separate rules or conditions for internal vs. external users, with stricter controls for external/unauthenticated interactions.
• Enable audit logging for all policy matches, with tagging for external user identifiers and device compliance state.
• Support test mode for initial policy deployment, followed by full enforcement.

Deliverables:

• Configured DLP policies in Microsoft Purview compliance portal.
• Rules scoped by user risk level (internal, guest, unauthenticated).
• Documented logic and matching criteria.
• Incident workflow documentation and example alerts.
• Testing plan with sample results and final validation sign-off.