Created by Claude - please verify

DLP policies - Purview data loss prevention policies and rules from Security & Compliance PowerShell.

Required Microsoft Graph permissions

Exchange.ManageAsApp Purview role for the app: Compliance Administrator (or a view-only compliance role) — application permissions, granted to the app registration with admin consent.

Licence: Microsoft 365 E3 for Exchange / SharePoint / OneDrive DLP; E5 (or E5 Compliance) for Teams and endpoint DLP.

Endpoints: Connect-IPPSSession (prefix Cc) · Get-DlpCompliancePolicy · Get-DlpComplianceRule

'Blocking' means at least one enabled rule has BlockAccess set. Policy tips and incident reports alone do not stop data leaving.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

DLP Policy Inventory

Which data loss prevention policies exist, which workloads they cover, and - most importantly - which of them actually block anything. Policies left in test (simulation) mode for months look like protection on paper but stop nothing.