11.2 Configure Advanced DLP Rules for Devices

The July 28, 2026 bullet is Configure advanced DLP rules for devices in DLP policies. In the Purview wizard that is the Devices location plus Create or customize advanced DLP rules, then Audit or restrict activities on devices. Templates can pre-fill SITs. The device-specific work is still an advanced rule: conditions, per-activity actions, user notifications, overrides, and incident reports.

A DLP policy is the container. A rule is the business logic. Devices can use sensitive information types and sensitivity labels to define content. Retention labels are not a Devices content-definition method. Trainable classifiers are supported as a Devices condition, but Endpoint DLP needs advanced classification scanning and protection (next section) before EDM, named entities, trainable classifiers, credential classifiers, and document fingerprinting work on the laptop. Adaptive Protection's device policy also documents that you must enable advanced classification or use a File type is condition — that Adaptive Protection design was the previous chapter; here you still must not build an endpoint rule that assumes cloud classifiers with advanced classification off.

Devices location: both the user and the device

When the policy includes Devices, you scope users/groups and devices/device groups. Microsoft's policy reference (updated 2026-06-26) is blunt: the policy is enforced on an endpoint only when both the user and the device are in scope. User in, device out: no. Device in, user out: no. Default is all users and all devices. Typical exam patterns:

Device scoping does not support Microsoft Entra registered. Joined and hybrid-joined devices can be targeted by device or device group. Registered devices can still be onboarded (previous section), but Microsoft does not document putting an Entra-registered machine in a specific devices include list. On macOS, device and device-group scoping needs Defender build 101.25072 or newer.

If a policy is scoped to devices whose signed-in users do not meet the user criteria, Microsoft says to explicitly exclude those users or devices. Leaving the mismatch in place produces unintended enforcement. All onboarded devices still receive endpoint policies so a multi-user device can evaluate the right user's rules; scanning is not limited to "this device's primary user."

The Devices and device groups control applies to Audit or restrict activities on devices. It does not apply to Audit or restrict activities when users access sensitive sites in Microsoft Edge. Apply restrictions to only unsupported file extensions also does not support device-and-group scoping.

Activities you set on the rule

Under Audit or restrict activities on devices you configure service-domain/browser activities and file activities for all apps. Microsoft's Learn about Endpoint DLP activity table (updated 2026-08-05) is the list to memorize:

Access by apps not included in the restricted apps list is Windows-only in the settings support matrix. Create/rename do not take Block.

Enforcement modes on Windows: Allow, Audit only, Block with override, Block, and Off. Microsoft documents Allow as a Devices-location action (audit, no user notifications or alerts). On macOS, the policy-reference wording is Audit only, Block with override, or Block — do not promise Allow on a Mac stem. Off means no block and no audit. Block with override: the toast Allow / Edge OK lets the user proceed. After override, Endpoint DLP automatically resumes for copy to network share, copy to USB, and print. Other activities require the user to override again.

Microsoft's rollout advice is still start least-restrictive: Allow (devices) / Audit only (other locations), read the data, then tighten. Simulation mode is the policy state; it is not a substitute for picking the activity actions.

Clipboard, unsaved files, and virtual USB

Clipboard Block / Block with override is not "any paste anywhere." Intra-file copy inside the same Word/Excel/PowerPoint file that already matched is allowed. Copy from a matching Office file into a different Office file is blocked. Copy from a matching Office file into Notepad is blocked. Copy from Notepad (or any non-Office app) that contains matching content is blocked to any destination. Copy from a non-matching Notepad file is allowed. Extra trap: while a DLP-blocked file is open, copying from other files in the same application — even files with no DLP rule — is restricted.

If data is never saved to a file on the local device, Endpoint DLP cannot scan it. Saving a Word document directly to USB without a local copy is the textbook miss.

In virtualized environments, USB storage is treated as a network share. Include Copy to a network share, not only Copy to USB, or you will miss the copies. Activity explorer and alerts label those events as copy to a network share. AVD browser clipboard enforcement is a known gap; RDP-path clipboard is monitored.

Restricted app groups (configured in Endpoint DLP settings, consumed on the rule) override the restricted-apps list in the same rule. You can Allow a sanctioned CAD group and Block everyone else. Maximum 50 apps per group and 10 groups. If Restricted app activities is Block, the user never gets to the file, so File activities for all apps never run. If it is Audit only or Block with override, the user gets in and then USB/print/clipboard actions apply.

Sync time, evaluation, and what you leave for later

DLP evaluation of sensitive items is central. Microsoft says it generally takes about an hour for policy updates in the Purview portal to synchronize; items re-evaluate the next time they are accessed or modified. Authorized Groups changes need 24 hours. Offline Windows devices keep enforcing already pushed policies on already classified files; new or edited policies wait until the device reconnects. That offline behavior is not supported the same way on macOS. Enforcement events from an offline device do not show in Activity explorer until the device is online — investigation is the next chapter.

Just-in-time protection can block egress on items that have never been evaluated or whose evaluation is stale. Do not configure JIT here. Do not build the Activity explorer attribute list here. This section stops when the advanced rule's Devices activities and actions are correct.