dlpEdmSchemas

Exact Data Match Schemas. Define exact-data-match schemas that DLP uses to detect sensitive records. The dlpEdmSchemas entity set lives under /exchange/v1.0/dlpEdmSchemas in the Governance & protection category.

Fact	Value
Path	`/exchange/v1.0/dlpEdmSchemas`
Category	Governance & protection
Tier	Tier 5, Compliance
Read role	`Compliance.IPPS.Read.All` (Community)
Write role	`Compliance.IPPS.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-DlpEdmSchema, New-DlpEdmSchema, Set-DlpEdmSchema, Remove-DlpEdmSchema

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/dlpEdmSchemas`	List Exact Data Match (EDM) schemas - XML column definitions used by DLP rules to match customer-supplied data sets.	`Compliance.IPPS.Read`	Community
POST	`/exchange/v1.0/dlpEdmSchemas`	POST /dlpEdmSchemas - upload a new EDM schema XML. Body: { “fileData”: “<base64-encoded EDM-schema-XML>” }. Returns 204. IPPS-side - omitConfirm: true.	`Compliance.IPPS.ReadWrite`	Enterprise
PUT	`/exchange/v1.0/dlpEdmSchemas`	PUT /dlpEdmSchemas - replace existing EDM schema XML. Body: { “fileData”: “<base64>” }. Returns 204. IPPS-side - omitConfirm: true.	`Compliance.IPPS.ReadWrite`	Enterprise
GET	`/exchange/v1.0/dlpEdmSchemas/{key}`	Get a single EDM schema by Identity. Returns 404 if absent.	`Compliance.IPPS.Read`	Community
DELETE	`/exchange/v1.0/dlpEdmSchemas/{key}`	DELETE /dlpEdmSchemas/{key} - remove an EDM schema by Identity. Returns 204. IPPS-side - omitConfirm: true.	`Compliance.IPPS.ReadWrite`	Enterprise

GET /exchange/v1.0/dlpEdmSchemas

List Exact Data Match (EDM) schemas - XML column definitions used by DLP rules to match customer-supplied data sets.

Backing cmdlet: Get-DlpEdmSchema. Role: Compliance.IPPS.Read (Community).

List Exact Data Match schemas

List the Exact Data Match (EDM) schemas in the tenant. Each schema defines the column layout for a customer-supplied sensitive data set used by EDM sensitive information types.

GET /exchange/v1.0/dlpEdmSchemas HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "https://contoso.com/exchange/v1.0/$metadata#dlpEdmSchemas",
  "value": []
}

POST /exchange/v1.0/dlpEdmSchemas

POST /dlpEdmSchemas - upload a new EDM schema XML. Body: { “fileData”: “<base64-encoded EDM-schema-XML>” }. Returns 204. IPPS-side - omitConfirm: true.

Backing cmdlet: New-DlpEdmSchema. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`fileData`	body		yes
`dryRun`	query	bool (switch)

Upload an EDM schema

Upload an Exact Data Match schema XML via New-DlpEdmSchema on the IPPS pool. The schema defines the column layout for an EDM lookup table that DLP rules consult to detect sensitive values from a customer-supplied data set. FileData-only cmdlet: body carries a single base64-encoded XML payload; the schema’s Name, Description, and column definitions live inside it. The controller base64-decodes before invoking the cmdlet. EDM lookups are paired with a separately-uploaded EDM data file (out-of-band via Defender admin tooling).

POST /exchange/v1.0/dlpEdmSchemas HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "fileData": "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+PEVkbVNjaGVtYT4uLi48L0VkbVNjaGVtYT4="
}

HTTP/1.1 204 No Content

PUT /exchange/v1.0/dlpEdmSchemas

PUT /dlpEdmSchemas - replace existing EDM schema XML. Body: { “fileData”: “<base64>” }. Returns 204. IPPS-side - omitConfirm: true.

Backing cmdlet: Set-DlpEdmSchema. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`fileData`	body		yes
`dryRun`	query	bool (switch)

Replace an Exact Data Match schema

Replaces an existing Exact Data Match (EDM) schema with an uploaded XML payload, backed by Set-DlpEdmSchema. The schema name, description, and column definitions are carried inside the base64-encoded fileData; matching is by the schema name embedded in the XML.

PUT /exchange/v1.0/dlpEdmSchemas HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "fileData": "PEVkbVNjaGVtYSB4bWxucz0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS9vZmZpY2UvMjAxOC9lZG0iPjxEYXRhU3RvcmUgbmFtZT0iYXRoZW5hb25lLXNhbXBsZS1kbHBFZG1TY2hlbWFzIiBkZXNjcmlwdGlvbj0iQXRoZW5hT25lIHNhbXBsZSBFRE0gc2NoZW1hIiB2ZXJzaW9uPSIyIj48L0RhdGFTdG9yZT48L0VkbVNjaGVtYT4="
}

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative. fileData is a base64-encoded EDM-schema XML document; the controller base64-decodes it to the cmdlet’s Byte[] -FileData parameter before invocation.

GET /exchange/v1.0/dlpEdmSchemas/{key}

Get a single EDM schema by Identity. Returns 404 if absent.

Backing cmdlet: Get-DlpEdmSchema. Role: Compliance.IPPS.Read (Community).

DELETE /exchange/v1.0/dlpEdmSchemas/{key}

DELETE /dlpEdmSchemas/{key} - remove an EDM schema by Identity. Returns 204. IPPS-side - omitConfirm: true.

Backing cmdlet: Remove-DlpEdmSchema. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete an Exact Data Match schema

Removes an Exact Data Match (EDM) schema by Identity, backed by Remove-DlpEdmSchema. The {key} is the schema Identity (the schema name, e.g. exonaut-sample-dlpEdmSchemas).

DELETE /exchange/v1.0/dlpEdmSchemas/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Remove-DlpEdmSchema is invoked with -Identity bound to the {key} segment; the IPPS-pool cmdlet omits -Confirm.

?dryRun=true previews of any write stay on Community.