About this FAQ
Data & More DLP works without Microsoft Purview sensitivity labels, but many organisations choose to combine the two. This FAQ is written for procurement and data protection officers. The permission answers are precise enough for a Microsoft 365 administrator to assess.
The solution has two independent building blocks:
DLP (real-time data loss prevention): Data & More's own classification engine detects sensitive content in OneDrive, SharePoint, Exchange Online, Teams and Copilot, and blocks, alerts or logs. It uses no Microsoft labels.
Microsoft labelling (optional): Data & More can read the sensitivity labels your organisation already uses, and can apply them to files and emails based on its own classification.
The Data & More app can be registered in Microsoft Entra ID in one of two ways. Both request the same permissions; they differ in who owns the app and who is billed for metered Microsoft APIs.
Model | Who owns the app registration | Who is billed for metered Microsoft APIs |
|---|---|---|
Data & More app | Data & More (multi-tenant app; your admin grants consent) | Data & More, passed on at cost on your invoice |
Your own app | Your organisation (created in your tenant by our guided setup) | Your organisation's Azure subscription |
Permissions
What rights does the Data & More app registration need for DLP to work?
The standard package is Production + DLP: application permissions, granted tenant-wide by a Global Administrator, plus three one-time setup steps. DLP is not available with delegated (per-user) access. The full, maintained list for every package is in the support article Rights overview.
Application permissions (Production + DLP)
API | Permission | Why it is needed |
|---|---|---|
Microsoft Graph | User.Read.All, Directory.Read.All | List users, groups and verified domains (used to tell internal from external sharing) |
Microsoft Graph | Mail.Send | Send DLP notifications and release held mail |
Microsoft Graph | Mail.ReadWrite, MailboxSettings.ReadWrite, Contacts.Read | Scan mail; move blocked mail to a quarantine folder |
Microsoft Graph | Files.ReadWrite.All, Sites.ReadWrite.All | Scan OneDrive and SharePoint; subscribe to change notifications (Microsoft requires write access for app-only file subscriptions); remove and restore external sharing links; apply sensitivity labels |
Microsoft Graph | Sites.FullControl.All | Policy actions on SharePoint sites (delete, restore) outside DLP |
Microsoft Graph | Team.ReadBasic.All, ChannelMessage.Read.All, Chat.Read.All | Scan Teams channel posts and chats |
Microsoft Graph | AppCatalog.Read.All, TeamsAppInstallation.ReadWriteForUser.All, TeamsAppInstallation.ReadWriteForTeam.All, TeamsAppInstallation.ReadWriteForChat.All | Install the Data & More DLP bot that alerts users in Teams |
Microsoft Graph | AiEnterpriseInteraction.Read.All, AuditLogsQuery.Read.All | Read Copilot prompts and responses (alert only) |
Microsoft Graph | InformationProtectionPolicy.Read.All | Read your tenant's sensitivity label definitions (only if labels are used) |
SharePoint | Sites.FullControl.All, User.Read.All | Identify site owners through the SharePoint REST API (certificate credential only) |
Office 365 Exchange Online | Exchange.ManageAsApp | Create and maintain Data & More's own mail-flow rules; no other rules are touched |
One-time setup steps (delegated, signed in as an administrator)
Grant Exchange access (Exchange administrator): registers the app in Exchange and assigns it the Exchange roles Transport Rules and View-Only Configuration.
Install the Teams bot (Teams administrator): AppCatalog.ReadWrite.All.
Allow Teams message deletion (optional; Global Administrator, or each message author): ChannelMessage.ReadWrite and Chat.ReadWrite. Microsoft offers no application permission for deleting channel messages.
Write permissions do not mean automatic deletion. Deletions through policies go through a human approval step in Data & More first.
Can the permissions be narrowed to specific sites or mailboxes?
Not today. DLP needs tenant-wide application permissions, because it must see every new external share and outgoing mail. Microsoft's Sites.Selected model and Exchange application access policies are not supported. You can switch off individual workloads (for example Copilot or Teams), and their permissions are then not requested.
Does the app use a certificate or a client secret?
The Production packages use a certificate by default. A client secret is possible, but SharePoint rejects app-only REST calls made with a secret, so site-owner lookup is then unavailable.
How do we revoke access?
Delete the Data & More enterprise application in Microsoft Entra ID (or revoke admin consent). Access stops immediately. Data & More's mail-flow rules can be removed in the Exchange admin center; they also expire and fail open on their own (see Operations).
Microsoft licensing
Which Microsoft licences do we need to run Data & More DLP?
Data & More DLP needs no Microsoft Purview or E5 licence. Classification and enforcement are done by Data & More, not by Microsoft. Your users need only the licences that give them the workloads being protected: an Exchange Online mailbox, OneDrive, SharePoint and Teams (for example Microsoft 365 Business Premium, E3 or E5).
One exception: Copilot monitoring only covers users who hold a Microsoft 365 Copilot licence, because Microsoft only records Copilot interactions for those users.
Which licences do we need if we also want to use sensitivity labels?
To create and use sensitivity labels at all, users need a licence that includes manual sensitivity labelling: for example Microsoft 365 Business Premium, E3 or E5, Office 365 E3 or E5, or Azure Information Protection P1. Microsoft licenses this per user who benefits from the feature (Microsoft Purview service description).
Microsoft has not stated whether labels applied by a third-party app such as Data & More count as automatic labelling, which requires Microsoft 365 E5 or the E5 Information Protection & Governance add-on. Microsoft's own service description (updated 29 October 2026) is not consistent on this point. We recommend confirming with your Microsoft licensing partner before applying labels automatically at scale.
Do we need any extra Microsoft licence for Data & More to apply labels?
No extra licence. The paid Microsoft label API (see Cost) is billed per call through Azure, not as a licence. Labelling of files in SharePoint and OneDrive must be switched on in your tenant (Set-SPOTenant -EnableAIPIntegration $true) if you want SharePoint to recognise and process labels.
Sensitivity and retention labels
Does Data & More DLP need Purview sensitivity labels to work?
No. DLP classifies content with Data & More's own engine and blocks or alerts on that basis. It does not read or apply labels. Labels are an optional addition: many organisations use Data & More to apply labels consistently, so that Microsoft tools (Office, Purview DLP, Copilot) can also act on them.
What can Data & More do with Microsoft labels?
Action | Sensitivity labels | Retention labels |
|---|---|---|
Read the label definitions in your tenant | Yes | Not supported |
Read the label on a file | Yes (read from the file itself) | Not supported |
Create new labels or label policies | No | No |
Apply a label to a file | Yes: Word, Excel, PowerPoint (old and new formats) and PDF | Not supported |
Apply a label to an email | Yes (see below) | Not supported |
Remove a label | No | Not supported |
Labels are created and published by your administrators in the Microsoft Purview portal. Microsoft provides no Graph API for creating labels, and Data & More does not use the PowerShell route that would allow it.
Labels on emails are written as message metadata (the same header Outlook writes). Microsoft offers no official API for labelling a stored email. These labels are recognised by Outlook and Purview, but no encryption is applied.
How does Data & More apply a sensitivity label to a file?
You choose one of two methods per workspace. We are neutral: the choice depends on your priorities.
Stamping (default) | Microsoft label API | ||
|---|---|---|---|
How it works | Data & More downloads the file, writes the label into the file's metadata and uploads it again | Data & More asks Microsoft (assignSensitivityLabel) to label the file; Microsoft changes the file itself | |
Cost | Free | USD 0.00185 per file (see Cost) | |
File types | doc, docx, xls, xlsx, ppt, pptx, pdf | docx, xlsx, pptx, pdf | |
Encryption configured on the label | Not applied | Applied by Microsoft (expected; not yet tested by Data & More) | |
Headers, footers, watermarks | Not applied | Not applied (Microsoft does not add them for this API) | |
Files already encrypted | Skipped | Some protected labels cannot be changed app-only; Microsoft rejects them | |
Version history | New version; Modified and Modified by change (see Last modified) | The modified date of the file is not updated: https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically?tabs=apply-label | |
Purview audit log | Shows as a file modification | Logged by Microsoft as a label event | |
Requirements | None | Azure billing linked to the app registration |
If the API call fails, Data & More falls back to stamping. Microsoft confirms the API request asynchronously, and Data & More does not currently check the final result, so a rejection after acceptance is visible only in Microsoft's audit log.
When Data & More applies a label, does it overwrite a label set manually by a user?
Yes, it can. Data & More applies labels as privileged, which Microsoft treats like a manual or administrator action, so it can replace a label a user chose, including with a lower one. Microsoft's API does not prevent this, and stamping replaces the existing label metadata.
The safeguards are in your policy configuration:
A file is left alone if it already carries the label the policy would apply.
In Purview Repair, each rule targets a specific combination of Data & More class and current label, so you decide exactly which existing labels may be replaced (for example only unlabelled files).
In scan policies, if several policies match, the highest-ranked label is chosen.
There is currently no switch that protects all manually set labels. Because the label is applied as privileged, Microsoft's own auto-labelling policies will not override it afterwards.
Can Data & More set retention labels?
Not for now. Data & More does not read, apply or remove retention labels.
Cost
Does applying sensitivity labels incur a Microsoft API cost?
Only with the Microsoft label API. Microsoft classes assignSensitivityLabel as a metered API at USD 0.00185 per call (Microsoft metered API list). Stamping, reading labels and all scanning and DLP calls are free.
Files labelled with the API | Microsoft charge |
|---|---|
10,000 | USD 18.50 |
100,000 | USD 185 |
1,000,000 | USD 1,850 |
Each labelling is one call, so re-labelling a file costs again. Data & More counts every accepted call per month, so the charge can be reconciled.
Who pays the Microsoft charge?
Microsoft bills the Azure subscription linked to the app registration (metered API setup):
Data & More app: Data & More pays Microsoft and passes the cost on at cost on your invoice.
Your own app: Microsoft bills your Azure subscription directly. Linking it needs Contributor rights on the subscription and ownership of the app registration; Data & More's setup guide does the linking.
Until billing is linked, Microsoft rejects the API, and Data & More uses stamping instead.
Last modified
When Data & More sets a label, does the file's "last modified" date change, and who is shown as the author?
Yes, with either method.
Stamping: the file is uploaded again as a new version. Modified becomes the time of labelling and Modified by shows the Data & More app. Earlier versions remain in the version history with their original dates and authors.
Microsoft label API: Microsoft writes the label into the file itself. Microsoft does not document the effect, but independent reports, and how SharePoint treats label changes, indicate that Modified and Modified by also change, with the app (or SharePoint App) shown as modifier. Not yet verified by Data & More.
Neither method can preserve the original Modified values. Microsoft's own auto-labelling policies are the exception: they leave Modified and Modified by unchanged (Microsoft documentation).
If your records management, eDiscovery or retention depends on Modified dates, consider this before labelling existing files at scale. Labelling only new or unlabelled files limits the effect. The original creation date (Created) does not change.
Data handling and security
Does our content leave the Microsoft tenant?
Yes, for analysis. File and mail content is retrieved through Microsoft's APIs and classified on Data & More's infrastructure. Hosting location: Germany or Finland.
Is AI used, and is our data sent to an AI provider?
Data & More optionally uses language models as one step of classification. They are open models hosted and operated by Data & More. No content is sent to third-party AI providers such as OpenAI, Anthropic, Google or Microsoft.
What does Data & More store about our files and emails?
For each item: metadata (name, location, size, dates, author, last modifier), sharing permissions, the Data & More classes it matched, detected personal data values, any sensitivity label, and extracted text for search and re-classification. A No data mode removes the stored text.
The DLP audit log records what was detected and what action was taken (item, sender, link, action and classes). Free text in the log is masked.
Can Data & More DLP read files encrypted by a Purview sensitivity label?
Yes, if you grant one additional permission. Analysing encrypted files requires the Azure Rights Management permission Content.SuperUser, which lets the app decrypt content for analysis using Microsoft's Information Protection SDK. It is not part of the standard packages and is granted separately on request.
Without it, encrypted files are still listed with their metadata and label, but their content cannot be classified. Files protected with Double Key Encryption, Hold Your Own Key or user-defined permissions cannot be analysed. Data & More never removes or changes encryption on your files.
Is there an audit trail of what Data & More changed?
Yes, in two places. Every action the app takes appears in Microsoft's Purview audit log under the app's identity. Data & More also keeps its own DLP log of each detection and action. Removed sharing links can be restored from Data & More.
Operations and coverage
What does a DLP block actually do?
Each policy chooses one action: log, alert, block, or block after a grace period (the owner is warned first). The effect of a block depends on the workload:
Workload | What is checked | What a block does |
|---|---|---|
OneDrive and SharePoint | Files shared externally | Removes the external sharing; it can be restored from Data & More |
Exchange Online | Mail to external recipients | The mail is held until checked, then either released or moved to a DLP Quarantine folder in the sender's mailbox |
Teams | Channel posts and chats | Deletes the message on behalf of its author (requires the optional deletion consent) |
Copilot | Prompts and responses | No block: alert or log only |
Users are notified by email and by the Data & More bot in Teams. Data & More never deletes files or mailboxes as a DLP action.
What happens if Data & More is unavailable?
DLP fails open: business is not stopped. If an item cannot be classified, it is allowed. Data & More's mail-flow rules expire on their own if they are not renewed, so outgoing mail flows normally if the service is down. The trade-off is that items are not protected during an outage.
Will Data & More slow down our tenant or use up Microsoft API limits?
No noticeable effect is expected. Microsoft throttles API traffic largely per app, so Data & More's calls do not use your users' limits. Data & More respects Microsoft's throttling signals and retries later. The one user-visible effect is that external mail is held briefly while it is checked.
Can Data & More DLP run alongside Microsoft Purview DLP?
Yes. They work independently. Labels applied by Data & More can be used as conditions in Purview DLP and other Microsoft policies.
Which sources are covered?
Microsoft 365: Exchange Online (including the online archive for scanning), OneDrive, SharePoint, Teams and Copilot. Real-time DLP covers all five.
Google Workspace: Drive and Gmail are scanned for sensitive data; real-time DLP is not available.
Exchange Server (on-premises): scanning only.
Copilot: only users with a Microsoft 365 Copilot licence.
Sources
Microsoft documentation, read 6 November 2026:
Community: Practical365 on the assignSensitivityLabel API (Modified by behaviour, unverified by Microsoft)
Data & More: Rights overview; product behaviour as of 6 November 2026.