A Deep Dive into Endpoint Data Loss Prevention (DLP) in Microsoft Purview

Protecting sensitive data is a top priority for organizations, especially with the rise of remote work, personal devices, and cloud storage. Companies must ensure their data remains secure and compliant with industry regulations. That’s why it is important to have Endpoint Data Loss Prevention (Endpoint DLP) in place.

Microsoft Purview’s Endpoint DLP helps organizations keep sensitive data secure by monitoring and controlling how it moves across devices. This blog explains how Endpoint DLP works, why it’s useful, and what new features are coming soon.

What is Endpoint DLP?

Endpoint DLP is a security feature in Microsoft Purview that prevents unauthorized sharing or movement of sensitive data from company devices. It applies rules to protect information and ensure compliance with security policies.

Why is Endpoint DLP Important?

• Prevents data leaks by blocking risky actions like copying data to USB drives.
• Keeps organizations compliant with regulations like GDPR and HIPAA.
• Protects confidential data such as financial records, personal details, and business strategies.
• Reduces security risks from insider threats and accidental data loss.

How Does Endpoint DLP Work?

Endpoint DLP watches how files are used and shared across different channels, such as:

• USB drives and external storage
• Cloud services like OneDrive and Google Drive
• Emails and messaging apps
• Clipboard copying and printing

Organizations can create rules that allow or block specific actions based on data sensitivity.

Key Features of Endpoint DLP

1. Policy-Based Protection

Admins can set up rules to stop sensitive files from being shared outside the company or moved to unapproved locations.

2. Works Across Devices and Apps

DLP policies apply to files used in Microsoft 365 apps, web browsers, cloud services, and even third-party tools like Slack and WhatsApp.

3. Device and File Transfer Control

Endpoint DLP can block or restrict actions such as:

• Copying files to USB drives
• Uploading documents to unapproved cloud storage
• Printing sensitive files
• Copying data to the clipboard

4. Alerts and Monitoring

Security teams get alerts when users try to share restricted data, so they can take action quickly.

5. Flexible Policy Settings

Organizations can apply different rules based on:

• User roles (e.g., stricter rules for finance teams)
• Device type (e.g., corporate vs. personal laptops)
• Activity type (e.g., blocking USB transfers but allowing email sharing with encryption)

How to Enable Endpoint DLP

Step 1: Set Up DLP in Microsoft Purview

The first step is to configure Endpoint DLP settings. After setting it up, follow the steps below.

1. Open Microsoft Purview compliance portal.
2. Go to Data loss prevention > Policies.
3. Click Create a policy and choose a template or make a custom policy.

You’ll need to create custom rules for the policy—click Create rule to get started.

• Provide a name and description for clarity.
• Under Conditions, select Content contains > Add > Sensitivity labels > Highly Confidential > Add.
• In Actions, choose Add an action > Audit or restrict activities on devices. Turn off service domains and select Don’t restrict file activity. Set Access by restricted apps to Block.

After the above steps, turn on the policy right away!

Best Practices for Using Endpoint DLP

1. Identify High-Risk Data: Protect critical files like financial records and customer information.
2. Use Sensitivity Labels: Label files based on their security level (e.g., Public, Confidential, Restricted).
3. Educate Employees: Make sure staff understand security policies and how to follow them.
4. Regularly Review Policies: Update settings based on security trends and new threats.
5. Monitor Activity: Keep an eye on alerts and take action if users try to bypass policies.

New Update: Blanket Protection for Unscannable Files

Microsoft is introducing a new blanket protection feature for files that cannot be scanned. This update ensures that all unsupported file types are automatically protected, reducing security risks.

• If a file cannot be scanned, Endpoint DLP will automatically apply protection to it.
• Admins can enable this feature in Policy settings > Create policy > Create rule > Apply restrictions to only unsupported file extensions.
• This will roll out in March 2025, with a Public Preview in mid-March and General Availability by late March.

Final Thoughts

Endpoint DLP is a powerful tool for preventing sensitive data from being leaked or misused. The new blanket protection feature for unscannable files makes Microsoft Purview even stronger by ensuring that all files—whether scanned or not—are protected.

By setting up and managing Endpoint DLP properly, organizations can stay compliant, reduce security risks, and protect their most valuable asset: data.