In this module
AD4.10 Reporting Data Protection to Management
Figure AD4.10 — The quarterly management report now has four complete sections covering every security layer. Identity, Email, Devices, and Data — each with specific, measurable metrics that demonstrate risk reduction. This is the complete security posture report for your M365 environment.
The data protection metrics for management
Add these four metrics to your quarterly report:
1. Label adoption rate (target: 95%+). "98% of all documents and emails in our M365 environment are classified with sensitivity labels. Every new document starts with a label automatically. Sensitive documents (client contracts, financial data) are encrypted and restricted from external sharing."
2. DLP blocks (total and by type). "DLP policies blocked 23 attempts to share personal or financial data externally this quarter. 18 were blocked with user notification (the user corrected the issue). 5 required user override with business justification (legitimate external sharing that was logged and reviewed)."
3. External sharing controls. "Anonymous sharing links are disabled across the tenant. All external sharing requires recipient authentication. Sensitive sites (HR, Finance, Legal) have external sharing disabled entirely. External sharing link expiration is set to 30 days."
4. Stale access removed. "Quarterly sharing audit removed 12 stale external user accounts from SharePoint sites — former vendors and project collaborators who no longer need access. Total active external users: 8 across 3 project collaboration sites."
The complete executive summary — all four layers
Update your executive summary paragraph from AD3.10 to include the data protection metrics:
"This quarter, our security program protected Northgate Engineering across all four layers: credential attacks blocked (89 by MFA), phishing delivery stopped (47 emails blocked), unmanaged device access denied (15 sign-in attempts blocked by device compliance), and sensitive data protected (98% of documents classified, 23 external data shares blocked by DLP, anonymous sharing disabled). 100% of laptops are encrypted. DMARC is progressing to full enforcement. No security incidents from protected attack vectors this quarter. All controls are included in our existing E3 license — zero additional cost."
Four sentences. Four security layers. Every number is real and pulled from the tools you configured. This is the complete security improvement story — from no security controls to four operational layers in 8 weeks, at zero licensing cost.
The "what's next" conversation
After presenting the four-layer report, your manager will ask: "What's next?" Your answer:
"The four core security layers are operational and maintained with 30-45 minutes per week. The next priorities are: security monitoring (Module AD5 — building a structured weekly security review using Secure Score and the Defender portal), basic incident response procedures (Module AD6 — what to do when something does get through), and security governance (Module AD7 — policies that formalize these controls). Each module is 1-2 weeks of deployment at the same weekly time commitment. The complete security program — from first MFA deployment to full governance documentation — takes 12-16 weeks, all on E3."
This positions the remaining course modules as the natural continuation of a program that's already delivering measurable results.
Connect-IPPSSession
Connect-SPOService -Url https://northgateeng-admin.sharepoint.com
Write-Host "=== DATA PROTECTION METRICS ===" -ForegroundColor Cyan
# 1. Label adoption
Write-Host "`n--- Label Statistics ---"
Get-Label | ForEach-Object {
Write-Host "$($_.Name): Priority $($_.Priority), Enabled: $($_.Disabled -eq $false)"
}
# 2. DLP policy status
Write-Host "`n--- DLP Policy Status ---"
Get-DlpCompliancePolicy | Select-Object Name, Mode, Enabled | Format-Table
# 3. DLP matches last 30 days
Write-Host "`n--- DLP Matches (30 days) ---"
$matches = Get-DlpDetailReport -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date)
Write-Host "Total matches: $($matches.Count)"
$matches | Group-Object PolicyAction | Select-Object Name, Count | Format-Table
# 4. SharePoint external users
Write-Host "`n--- External Sharing ---"
$extTotal = 0
Get-SPOSite -Limit All | ForEach-Object {
$ext = (Get-SPOExternalUser -SiteUrl $_.Url -ErrorAction SilentlyContinue).Count
if ($ext -gt 0) { $extTotal += $ext; Write-Host "$($_.Url): $ext guests" }
}
Write-Host "Total external users: $extTotal"
# 5. Sharing configuration
Write-Host "`n--- Tenant Sharing Config ---"
Get-SPOTenant | Select-Object SharingCapability, DefaultSharingLinkType,
RequireAnonymousLinksExpireInDays | Format-ListYour quarterly report shows strong metrics across all four layers. Your manager is impressed and asks: "Should we upgrade to E5 to get more advanced data protection?" How do you assess this?
Option A: Yes — E5 auto-labeling, Endpoint DLP, and Teams chat DLP would significantly improve coverage.
Option B: Not yet — the E3 controls are operational and effective. E5 adds value (auto-labeling for existing documents, Endpoint DLP for USB/clipboard, Teams chat DLP) but the ROI depends on your organization's specific risk profile. Run the current controls for 2 quarters, collect data on where the gaps are (documents that should be Confidential but stay Internal, sensitive data copied to USB, sensitive data shared in Teams chat), and use that data to build a specific business case for E5 with quantified risk reduction.
The correct answer is Option B. E5 costs approximately £20/user/month more than E3. For a 200-user organization, that's £48,000/year. The business case for that investment needs to show specific risks that E3 controls don't address. After 2 quarters of E3 data (DLP match patterns, label adoption gaps, override analysis), you can quantify: "Auto-labeling would correctly classify an estimated 2,000 existing documents that are currently labeled Internal but contain Confidential content. Endpoint DLP would have caught 5 incidents of sensitive data copied to USB drives. The cost: £48,000/year. The risk reduction: [specific]." Data-driven E5 justification is far stronger than "we should upgrade because it's more advanced."
Extracting data protection metrics efficiently
Build a monthly data extraction routine that takes 10 minutes and feeds your quarterly report. Save these commands as Get-DataProtectionMetrics.ps1:
Run this on the first business day of each month. Copy the output into your metrics spreadsheet. After 3 months, the quarterly report data is already collected — you just summarize the trends.
Connecting data protection to GDPR compliance
For UK organizations, data protection isn't just a security best practice — it's a legal requirement under UK GDPR. Your sensitivity labels, DLP policies, and sharing controls provide evidence for several GDPR obligations:
Article 5(1)(f) — Integrity and confidentiality. Sensitivity labels with encryption demonstrate that personal data is protected against unauthorized access. DLP policies demonstrate that automated safeguards prevent accidental disclosure.
Article 30 — Records of processing activities. The DLP override log is a record of data processing decisions — each override documents who shared personal data externally, when, why, and to whom. This is exactly the type of record Article 30 requires.
Article 32 — Security of processing. The combination of encryption (labels), access controls (sharing restrictions), and monitoring (DLP Activity Explorer) demonstrates "appropriate technical measures" for data security.
Article 33 — Notification of breaches. DLP monitoring provides early detection of potential data breaches — if DLP detects bulk personal data being shared externally without override justification, that's an incident that may trigger the 72-hour breach notification requirement.
Include a one-sentence GDPR connection in your quarterly report: "Data protection controls (sensitivity labels, DLP policies, sharing restrictions) provide evidence of GDPR compliance under Articles 5, 30, 32, and 33 — demonstrated through 98% classification coverage, automated detection of personal data sharing, and a documented override audit trail."
This sentence resonates with compliance-aware management more than any technical metric — it connects your security work to the legal obligation that management is personally liable for.
The quarterly report format that works
After four modules of building metrics, your quarterly report has a proven format. Here's the one-page layout:
Page header: "M365 Security Posture Report — Q[X] 2026 — Northgate Engineering"
Executive summary: The 4-sentence paragraph covering all four layers (AD3.10, AD4.10). Print-ready for any audience.
Section 1 — Identity: 5 metrics in a simple table (MFA coverage, attacks blocked, compromised accounts, CA policies active, exceptions). One-line trend note: "Stable/improved/declined since last quarter."
Section 2 — Email: 5 metrics (phishing blocked, Safe Links clicks blocked, attachments detonated, DMARC status, user reports). One-line trend note.
Section 3 — Devices: 4 metrics (compliance rate, encryption coverage, unmanaged blocks, exceptions). One-line trend note.
Section 4 — Data: 4 metrics (label adoption, DLP blocks, sharing controls status, stale access removed). One-line trend note.
Footer: "Next steps: [upcoming module/action]. Time commitment: 30-45 min/week maintenance. Cost: included in E3."
This format fits on one page. Every number links to a specific dashboard or PowerShell query. The report takes 20 minutes to produce because the data collection is scripted. Print it, email it, or present it in a 5-minute standing meeting — the format works for any delivery method.
The ongoing improvement cycle
The quarterly report isn't the end — it's the beginning of the next improvement cycle. Each report reveals where the program is strong and where it has gaps:
Strong metrics that hold steady: MFA at 100%, compliance at 97%, label adoption at 98%. These need maintenance (30-45 min/week) but no additional deployment work.
Metrics that reveal gaps: "Only 3% of documents labeled Confidential when 15-20% should be" → targeted department communication. "15 DLP overrides per week from finance" → policy exception needed. "DMARC still at p=quarantine after 3 months" → investigate why p=reject hasn't been deployed.
New risks identified: "User copied Confidential document to USB drive — not caught because Endpoint DLP requires E5" → documented risk for E5 business case. "Sensitive data shared in Teams chat — not covered by E3 DLP" → documented gap for future licensing decision.
Each gap becomes an action item for the next quarter. After 4 quarters, your security program has evolved from "deploy the basics" to "continuously improve based on operational data" — which is exactly what a mature security program looks like. The quarterly report is both the measurement tool and the improvement driver.
Try it: Build the complete quarterly security report
Using data from all four modules, produce your quarterly report with four sections:
1. Identity (AD1): MFA coverage, attacks blocked, compromised accounts, CA policy count, exceptions 2. Email (AD2): Phishing blocked, Safe Links/Attachments stats, DMARC status, user reports 3. Devices (AD3): Compliance rate, encryption coverage, unmanaged blocks, exceptions 4. Data (AD4): Label adoption rate, DLP blocks and overrides, external sharing status, stale access removed
Write the executive summary paragraph (4 sentences, all four layers). Write the "what's next" section (next modules and timeline).
The entire report should fit on one page. No jargon. Every number sourced from a specific dashboard or PowerShell query. This is the artifact you present quarterly — the proof that your security program is operational, measured, and continuously improving.
When presenting data protection metrics to management, lead with outcomes rather than configuration details. "47 attempts to share sensitive data externally were blocked this quarter, with zero false positives after tuning" is more compelling than "DLP Policy 1 had 47 matches against SIT UK National Insurance Number with action set to Block." Management cares about risk reduction and operational impact — technical configuration details belong in the program summary (AD7.6), not the executive report.
You're reading the free modules of M365 Security: From Admin to Defender
The full course continues with advanced topics, production detection rules, worked investigation scenarios, and deployable artifacts.