Complete Compliance Setup: Prevent Credit-Card Data Leaks in Exchange, SharePoint & OneDrive with a Credit Card DLP Rule
- Hanna Korotka
- Jun 5
- 4 min read
Why your business needs a Credit Card DLP Rule
One misplaced card number can trigger PCI-DSS penalties and cyber-insurance exclusions. Microsoft 365 already ships with everything you need to stop that risk. Below you’ll create two Microsoft Purview DLP policies—one for Exchange Online and one for SharePoint/OneDrive
Licensing & role prerequisites
Microsoft Entra ID P1 (or any suite that includes it).
Compliance Administrator or Global Admin role.
Policy A – Block credit-card data in Exchange email
Imagine the daily workflow in a finance department:
Any email that holds a credit-card number must be blocked for everyone.
One exception: messages sent by anyone on the Finance Team to externaluser@domain.com are allowed.
When a block happens, the Compliance Admin gets an alert, the sender sees a policy-tip, and no one can override the block.
Every incident is logged in detail so it can be investigated later.
The Exchange-only policy below is built precisely to meet that requirement—without third-party tools or manual inbox audits.
Purview portal > Data loss prevention > Policies > Create policy.
Templates > Financial > U.S. Financial Data > Next.
Name the policy PCI-Email – Credit Card DLP Rule.
Locations: turn on Exchange email only. Click Next.
Choose Next.
On the Define policy settings page the Create or customize advanced DLP rules option should already be selected.
Select Next.
Select Create rule. Name the rule and provide a description.
Under Conditions select Add condition > Content contains
(Optional) Enter a Group name.
(Optional) Select a Group operator
Select Add > Sensitive info types > Credit Card Number.
Choose Add.
Next, beneath the Content contains section, choose Add group.
Leave the Boolean operator set to AND, then set the toggle to NOT.
Select Add condition.
Select Sender is a member of.
Select Add or remove distribution groups.
Select Finance Team and then choose Add.
Choose Add condition > Recipient is.
In the email field, enter "externaluser@domain.com" and select Add .
Under Actions, select Add an action > Restrict access or encrypt the content in Microsoft 365 locations
Select Block users from receiving email or accessing shared SharePoint, OneDrive, and Teams files, and then select Block everyone.
Set the User notifications toggle to On.
Select Email notifications > Notify the person who sent, shared, or last modified the content.
Choose whether or not to Attach matching email message to the notification.
Choose whether or not to add Policy tips.
Under User ovverides, make sure that Allow overrides from Microsoft 365 apps and services ... is NOT selected.
Under Incident reports, set Use this severity level in admin alerts and reports to High.
Set Send alert every time an activity matches the rule toggle to On..
Choose Save.
Choose Next, then choose Run the policy in simulation mode.
Choose Next and then choose Submit.
Choose Done.
Test: Send an email containing 4111 1111 1111 1111 + “Visa.” The message is blocked and a policy-tip explains why.
Policy B – Block external sharing of card data in SharePoint & OneDrive
Imagine you want to stop staff from sending sensitive files outside the company, but only when those files contain credit-card numbers, U.S. Social Security numbers. HR needs to keep working with their own data, so they’re exempt. Whenever a block happens, both the user and the security team should know immediately—no overrides allowed, and every event must appear in Purview audit logs.
Create another policy (same path as above), choose Custom policy.
Select Next.
Accept the default Full directory on the Assign admin units page.
Choose Next.
Choose where to apply the policy.
Ensure that the the SharePoint sites and OneDrive accounts locations are selected.
Deselect all other locations.
Select Edit in the Actions column next to OneDrive accounts.
Select All users and groups and then select Exclude users and groups.
Choose +Exclude and then Exclude groups.
Select Human Resources.
Choose Done and then choose Next.
On the Define policy settings page, the Create or customize advanced DLP rules option should already be selected. Choose Next.
On the Customize advanced DLP rules page, select + Create rule.
Give the rule a Name and a description.
Select Add condition and use these values:
Choose Content is shared from Microsoft 365.
Select with people outside my organization.
Under Actions, add an action with these values:
Restrict access or encrypt the content in Microsoft 365 locations.
Block only people outside your organization.
Set the User Notifications toggle to On.
Select Notify users in Office 365 services with a policy tip and then select Notify the user who sent, shared, or last modified the content.
Under User overrides, make sure that Allow override from M365 services is NOT selected.
Under Incident reports:
Set Use this severity level in admin alerts and reports to Low.
Set the toggle for Send an alert to admins when a rule match occurs to On.
Under Send email alerts to these people (optional), choose + Add or remove users and then add the email address of the security team.
Choose Save and then choose Next.
On the Policy mode page, choose Run the policy in simulation mode and Show policy tips while in simulation mode.
Choose Next and then choose Submit.
Choose Done.
Test: Upload a spreadsheet with card numbers to a SharePoint site and try to create an external sharing link—link creation should be blocked.
Result
With two coordinated policies you now have a Microsoft 365 Credit Card DLP Rule that stops card data in email and prevents external file sharing—covering the core PCI-DSS use-cases without third-party tools.
How PlexHosted can help
PlexHosted’s engineers map every PCI control to native Microsoft 365 settings, craft user-friendly policy-tip wording, automate roll-outs, and deliver quarterly reports your auditors (and insurers) will love. Book a 30-minute call and claim our free 12-point PCI readiness checklist to see where you stand.
Comments