11.1 Device Requirements for Endpoint DLP Including Extensions

The July 28, 2026 SC-401 outline asks you to specify device requirements for Endpoint DLP, including extensions. That is a prerequisites bullet. A perfect Devices-scoped DLP policy still does nothing on a laptop that is not onboarded, that has Microsoft Defender Antivirus real-time protection off, or that uploads through Chrome without the Purview extension. Microsoft's Learn about Endpoint DLP article (updated 2026-08-05) and Onboard Windows devices overview (updated 2026-06-26) are the current facts to study.

Endpoint data loss prevention (Endpoint DLP) extends Microsoft Purview DLP to sensitive items that live on the device. After onboarding, the service can see what users do with those items and enforce DLP policy actions. Classification is not continuous OCR of the whole disk. Endpoint DLP fully scans a file for sensitive information types and labels when the file is created or modified. When an already classified file is read, it checks whether policies, rules, or SITs changed and re-evaluates, but it does not re-extract text. It cannot read a sensitivity label applied by another tenant. If the user never saves the data to a local file — for example Word content written straight to a USB stick — Endpoint DLP cannot classify or block that unsaved stream. That last trap belongs with the rule activities in the next section; the requirement here is that the device is even eligible.

Licensing is not a fake SKU on this exam. Microsoft's getting-started page points to Microsoft 365 Enterprise plans and the Purview service description. Say the tenant must be licensed for Endpoint DLP. Do not invent E5-only wording Microsoft does not publish on that page.

Operating systems Microsoft actually lists

Microsoft's current client list is Windows 10, Windows 11, and macOS (the three latest released major versions). Do not pin a macOS marketing name such as Catalina unless the service description you are citing still uses it; the Endpoint DLP Learn articles now say three latest released major versions. macOS devices with x64 and Apple silicon (M1, M2, M3 / ARM64) are supported. On Windows ARM64, onboarding documents Windows 11 21H2 through 24H2; do not assume every Windows 10 ARM image is in that table.

Windows Server 2019 and later can be onboarded (the Windows overview also lists Windows Server 2022 from 21H2). Two hard exclusions: Endpoint DLP is not supported on Windows Servers configured as Domain Controllers, and not supported on Windows Servers installed with the Core Server option. Installing the supported Windows Server KBs disables the Classification feature on the server. Endpoint DLP will not classify files on that server after those KBs. It will still protect files that were already classified before the KBs, if you install Microsoft Defender version 4.18.23100 (October 2023) or later. By default, Endpoint DLP is not enabled for Windows servers when they first onboard. You must turn on Endpoint DLP support for onboarded servers in Endpoint DLP settings before Activity explorer shows server events. The same DLP policies can then apply to Windows PCs and those servers.

Defender Antivirus, identity, Office, and network

Microsoft's Prepare your Windows devices list is the exam checklist:

Chrome and Firefox extensions raise the anti-malware floor to 4.18.2202.x or later on Windows 10 x64 build 1809 or later. Feature-specific floors keep moving (for example hyperlinks in toast messages at 4.18.25010, Teams Endpoint DLP at 4.18.25050). If the stem names a roadmap feature, match the published client version; do not invent one.

Onboard the device, then turn monitoring on

Device management is the telemetry pipe for Endpoint DLP and Insider Risk Management. Open the Microsoft Purview portal > Settings > Device onboarding > Devices. Enable device onboarding / device monitoring, then download a package. Deployment methods Microsoft documents: Microsoft Intune, Microsoft Configuration Manager, Group Policy, a local script (up to 10 machines), and VDI scripts for non-persistent machines. macOS uses Intune, Jamf Pro, or another MDM; if the Mac is already in Microsoft Defender for Endpoint, the extra steps shrink. After Windows device monitoring is on, macOS still needs Turn on macOS device monitoring.

Onboarding is shared with Microsoft Defender for Endpoint. Machines already in MDE appear in the Purview devices list — you still turn on device monitoring, but you do not onboard them twice. Onboarding in Purview also onboards into MDE. Microsoft says enablement often takes about 60 seconds; wait up to 30 minutes before opening a support case. Offline onboarded devices remain on the list for 180 days.

Device management currently supports Microsoft Entra roles, not Purview roles. To enable device management, the account needs Security admin, Compliance admin, or Global admin. Viewing settings, opening onboarding/offboarding, and toggling monitoring have overlapping Entra-role lists (Compliance admin / Security admin / Global admin, plus Compliance data admin and Global reader for some view tasks). Do not answer this bullet with Information Protection Admin from the DLP-policy chapter.

Virtual desktops can onboard with the same packages. Microsoft publishes support for Azure Virtual Desktop, Windows 365, Citrix Virtual Apps and Desktops 7 (2209+), Amazon WorkSpaces, and Hyper-V on named Windows 10/11/Server combinations. Two published gotchas: you cannot monitor Copy to clipboard or enforce Endpoint DLP via browsers on AVD — the same egress is monitored over Remote Desktop Session; Citrix XenApp does not support access-by-restricted-app monitoring. In those virtualized environments, USB storage is treated as a network share, which is a rule-activity fact for the next section.

Browser extensions are part of the device requirement

Microsoft Edge on Windows has the deepest Endpoint DLP integration (print the site, copy from the site, save-as, paste to supported browsers, upload to a restricted cloud service domain). Google Chrome and Mozilla Firefox on Windows need the Microsoft Purview extension. Microsoft's Chrome article is explicit: the extension only works on Windows devices; you do not need it to enforce DLP on macOS. On macOS (three latest majors) Endpoint DLP documents Microsoft Edge, Safari, Chrome, and Firefox (latest versions) without that Windows extension package.

If you force-install Chrome or Firefox org-wide, remove that browser from the unallowed browsers and unallowed apps lists. The extension bypasses those lists on machines where it is installed, but leaving Chrome on the unallowed list while you test a handful of machines is the supported mixed mode. If Chrome has a NativeMessageBlocklist, add the Purview extension to NativeMessageAllowlist.

Service-domain upload controls (next two sections) apply to files uploaded with Edge, or with Chrome or Firefox that have the Purview extension. An unallowed browser that tries to open a file matching a block or block-with-override cloud-upload rule is blocked and the user is told to open the file in Edge.

What this section does not configure

Just-in-time protection can hold egress until evaluation finishes; Activity explorer starts receiving audit events even before you deploy a Devices policy. Both are real. Both are the next chapter. Here, your job is: OS + Defender RTP/behavior monitoring + Entra device identity + onboarding/monitoring + the right browser extension story. If any of those are missing, advanced DLP rules and Endpoint DLP settings have nowhere to run.