17.2 Configuring Endpoint DLP

Cloud-workload DLP protects content while it moves through Exchange, SharePoint, OneDrive, Teams, Power BI, and Copilot. But sensitive files also live on user laptops and desktops — files that get copied to USB drives, emailed through personal webmail, uploaded to unsanctioned cloud apps, or printed at home. Endpoint DLP closes that gap by extending Microsoft Purview DLP to Windows 10/11 and macOS devices, monitoring and restricting what users do with sensitive files at the endpoint itself.

---

Onboarding Requirements

Endpoint DLP is not a standalone product — it reuses the device enrollment established by Microsoft Defender for Endpoint (MDE). Before Endpoint DLP can monitor a device, the device must be:

1. Onboarded to Microsoft Defender for Endpoint — the device appears in the Microsoft Defender portal under Assets → Devices. Endpoint DLP uses this same enrollment; there is no separate Endpoint DLP onboarding client.
2. Licensed for Endpoint DLP — one of the following licenses per monitored user:
   • Microsoft 365 E5
   • Microsoft 365 E3 + the Microsoft 365 E5 Compliance add-on
   • Microsoft 365 E3 + the Endpoint DLP add-on (a standalone SKU)
3. Running a supported OS — Windows 10 (build 1809.rs3 or later), Windows 11, or macOS (recent supported versions per MDE requirements)
4. Connected to the tenant — the device syncs with Microsoft Purview via the MDE sensor, which typically takes 30 minutes to a few hours after onboarding

If a device is not onboarded to MDE, Endpoint DLP simply has no surface to protect — the Devices location will show zero devices and the policy will have nothing to evaluate.

---

Activities Endpoint DLP Can Audit and Restrict

Once a device is onboarded, Endpoint DLP can monitor and restrict the following file activities. Each activity can be set to Audit only (log the event) or Block (prevent the action and show an endpoint policy tip):

The unallowed browsers and unallowed apps lists are configured under Data loss prevention → Endpoint DLP settings in the Purview compliance portal. When a browser or app is on the unallowed list, the DLP policy can block sensitive-file uploads through it while still allowing uploads through sanctioned browsers and apps.

---

Configuring Endpoint DLP

Configuration happens in two places in the Purview compliance portal: Endpoint DLP settings (tenant-wide defaults) and the DLP policy scoped to the Devices location (per-policy rules).

Endpoint DLP Settings (tenant-wide)

Under Data loss prevention → Endpoint DLP settings, configure:

• File path exclusions — paths on the device that DLP should never scan (e.g., C:\Windows, C:\Program Files, application binaries). Exclusions reduce noise and avoid scanning system files.
• Browser restrictions — add browsers to the unallowed list for upload blocking. Microsoft Edge is the default sanctioned browser; Chrome and Firefox can be added to the unallowed list.
• App restrictions — add apps to the unallowed-apps list by process name (e.g., dropbox.exe, slack.exe). Any attempt to upload sensitive content through a listed app can be blocked.
• Cloud egress exclusion / allowed domains — refine which cloud destinations are permitted

DLP Policy Scoped to the Devices Location

Create or edit a DLP policy and select Devices as a location. The policy can be scoped to specific device groups or users, and the rule actions include endpoint-specific options:

• Audit only — log the file activity without interfering
• Block — prevent the activity and show the user a policy tip on the endpoint
• Block with override — let the user override with a business justification (logged)

The same policy can combine endpoint actions with cloud-workload actions. For example, a single policy can block copying a Confidential file to USB on the device and block sharing the same file through SharePoint Online in the cloud.

---

The Endpoint DLP Audit Log

All Endpoint DLP activity — audited or blocked — is written to the unified Purview audit pipeline and surfaced in Activity explorer under Data loss prevention. For each event you can see:

• The user and device
• The file name and path
• The activity type (copy to USB, print, upload to unallowed browser, etc.)
• The sensitive information types and sensitivity labels detected in the file
• The rule and policy that triggered
• Whether the activity was audited or blocked, and whether a user override was exercised

Activity explorer lets compliance officers filter by user, device, SIT, label, activity type, and time range — the same filters used for cloud DLP events — so endpoint and cloud events are investigated in a single view.

---

Common Configuration Pitfalls

A few issues recur in MS-102 exam scenarios and in production:

• Device not onboarded to MDE — the most common reason Endpoint DLP appears to do nothing. Verify onboarding in the Defender portal before assuming the policy is misconfigured.
• Wrong license — Endpoint DLP is not included in baseline Microsoft 365 E3; the E5 Compliance add-on or the Endpoint DLP add-on is required.
• Overly broad file path exclusions — excluding a user's entire Documents folder by mistake silently disables protection for that user.
• Unallowed app not matched — the process name in the unallowed list must match exactly (case-insensitive but spelling-sensitive). Listing Dropbox instead of dropbox.exe will not match.

---

Key Takeaways

• Endpoint DLP extends Purview DLP to Windows 10/11 and macOS devices that are already onboarded to Microsoft Defender for Endpoint
• Endpoint DLP can audit or restrict copy to USB, copy to network share, copy via RDP, print, clipboard copy, and uploads through unallowed browsers and apps
• Tenant-wide endpoint settings (file path exclusions, unallowed browsers, unallowed apps) are configured under Endpoint DLP settings; per-policy rules are configured in the DLP policy scoped to the Devices location
• All endpoint activity is logged to Activity explorer alongside cloud DLP events, enabling unified investigation
• Endpoint DLP requires Microsoft 365 E5, E3 + E5 Compliance add-on, or the standalone Endpoint DLP add-on