MICROSOFT PURVIEW DLP — PILOT RUN SHEET
Revised 2026-10-19. This is a procedure, not a record of completed tests.

Run ID:
Operator:
Approved lab SharePoint URL:
Test library:
Policy name: TSC-LAB-DLP-SharePoint-External-v1
Policy ID and version:
Custom SIT name: TSC DLP Lab Marker
Standard internal member (store identity privately):
External test identity (store identity privately):
Browser profiles used:
Original site sharing setting:
Temporary lab grants introduced:
Internal account privilege check:
Licensing and permissions checked:
Existing policies or access restrictions:

TIMELINE (UTC)
Classifier saved:
Classifier tests completed:
Policy saved in simulation:
Policy sync status and time (separate from scan status):
Existing-content scan completion:
Reporting date window and arrival time:
Fixture upload / sharing times:
Internal positive-file baseline:
04-change-control.txt initial clean external read:
Simulation match recorded:
Enforcement enabled:
Enforcement sync and match recorded:
Access checks completed:
04-change-control.txt content-change time / new version / new match / external result:
Rollback requested / verified WITH LINKS INTACT:
External test access removed / verified AFTER successful recovery:
Original site sharing restored:

EVIDENCE
For each case record file URL, file version/hash, policy/rule, actor role, time, outcome and screenshot filename.
Use live SharePoint requests in separate authenticated browser profiles. Do not use previously downloaded copies.
Use the same site, fixtures and identities across the experiment. E04 changes the content of a pre-shared file; it is not a new-upload test. Do not alter permissions or replace the file. Verify the clean external control in the same session.
Mask email addresses, avatars, tenant identity and unrelated content before publication. Keep policy mode, relevant settings, synthetic fixture names and meaningful timestamps visible.
Never replace an observed result with its expected result.

STOP CONDITIONS
Clean guest-access baseline fails.
Classifier controls fail.
Policy scope includes anything beyond the approved lab site.
Another policy makes causal attribution unclear.
Unexpected impact on non-lab content.

SUCCESS
Classifier positive and negative controls pass; simulation matches the intended item without this policy blocking it; enforced matched-file access is denied externally; internal and clean external controls succeed; recovery and cleanup are recorded.
