Purview endpoint DLP settings: USB, printers, cloud uploads, restricted apps and browsers

Endpoint DLP decisions happen in two places: global endpoint settings that define your groups, browsers, domains and apps, and the policy rules that decide what happens when sensitive content meets them. Most "it didn't block" tickets come from a gap between the two. In this post I'll walk through the settings that matter for USB, printing, cloud uploads and apps, then build a rule that uses them and test it.

How it works#

Endpoint settings apply to every DLP policy that includes the Devices location. In the Microsoft Purview portal they're under Data loss prevention › Overview › Data loss prevention settings › Endpoint settings. In a rule, the action Audit or restrict activities on devices sets an action per activity: Audit only, Block with override or Block, plus Allow and Off modes on devices running anti-malware client 4.18.25010 or newer. A policy applies only when both the user and the device are in its scope.

Copy to clipboard and Copy or move using RDP (Windows only) are also available. Devices must be onboarded and healthy first; see fixing endpoint DLP device status.

Step-by-step#

1. Set the global behaviors#

• File path exclusions for Windows: files in excluded paths are neither audited nor protected, so keep the list short. A path ending in \ covers only files directly in that folder, \* covers only subfolders, and no suffix covers both; wildcards such as C:\Users\*\Desktop\ and system variables such as %SystemDrive% work.
• Always audit file activity for devices is on by default and audits Office, PDF and CSV activity even without a policy match. Turn it off only if you want auditing limited to devices in an active policy.
• Business justification in policy tips: show built-in options, a custom text box or both, and customize up to five options users see when they override a block.

2. Control browsers and cloud uploads#

• Unallowed browsers (executable names on Windows, full paths on macOS) can't open files that match an enforced policy whose upload restriction is Block or Block with override. Users get a toast asking them to open the file in Microsoft Edge.
• Service domains run in Block mode (listed domains are restricted) or Allow mode (everything except listed domains is restricted; add at least one domain before it enforces). Enter FQDNs without the protocol and use *. for subdomains. The list applies only to uploads from Edge, or from Chrome and Firefox with the Microsoft Purview extension, and not to pasting. Microsoft also notes that the upload action on devices needs the sensitive service domains list configured.
• Sensitive service domain groups give specific sites their own actions for printing, copying, saving, uploading and pasting: up to 100 sites per group and 150 groups. A built-in Generative AI websites group can't be edited.

For Chrome and Firefox, deploy the extension first: endpoint DLP in Chrome and Firefox.

3. Define USB, printer and network share groups#

• Removable USB device groups: up to 20 groups of 50 devices, for exceptions such as approved backup drives. Activity explorer records the manufacturer, model and serial number of the removable media in USB copy events, which makes identifying approved drives easy.
• Printer groups: up to 20 groups of 50 printers, identified by friendly name (as shown in Device Manager), USB printer with vendor and product ID, IP range, print to file, Universal Print, corporate print server queue or print to local. The last four are Windows only. Microsoft advises against combining several of the type parameters (USB printer, IP range, print to file, Universal Print, corporate printer, print to local) for one printer.
• Network share groups and VPN settings (VPN is Windows only) let a rule treat specific shares or VPN connections differently. Get-VpnConnection on a client shows the VPN details you need.

4. Restrict apps#

Add apps to Restricted apps by executable name only on Windows, never a path. Restricted app groups hold up to 50 apps each, with up to 10 groups, and their actions override the restricted apps list when both are in the same rule. For cloud sync apps such as onedrive.exe, Auto-quarantine moves a sensitive file to an admin-defined folder instead of producing a stream of block notifications.

5. Build the rule#

Create a policy with the Devices location, a condition such as Content contains a sensitive info type, and the action Audit or restrict activities on devices › File activities for all apps › Apply restrictions to specific activity. A sensible starting point:

Turn on user notifications so users get a toast explaining the block; newer anti-malware clients (4.18.25010 or later) also support a hyperlink in warn and block toasts. Run the policy in simulation mode with tips first. Policy updates generally take about an hour to sync; Microsoft notes that changes to authorized groups, such as printer groups, need 24 hours.

Verify#

• On a pilot device, copy a dummy sensitive file to an unapproved USB drive (blocked with a toast) and to an approved one (allowed and audited).
• Print it to an ordinary printer (override prompt with justification) and to a Legal printer (allowed).
• Upload it from Edge to a blocked domain (blocked), then open it in an unallowed browser (redirected to Edge).
• In Activity explorer, the Endpoint DLP activities filter set shows each event with the rule, the enforcement and, for USB, the device details.

Tips and gotchas#

• Endpoint DLP is content-aware, not device control. To block USB storage regardless of content, use Defender device control.
• Virtual desktops: USB storage is treated as a network share there, so include Copy to a network share.
• Unsaved content isn't inspected. If a user saves a document straight to USB without storing it locally first, endpoint DLP can't classify it.
• Clipboard blocks still allow copy and paste within the same Office file.
• Policy design and alerts: see designing Purview DLP policies and investigating DLP alerts.

References#

• Configure endpoint DLP settings (Microsoft Learn)
• Learn about endpoint data loss prevention (Microsoft Learn)
• Create policy to manage file activities by implementing network exceptions (Microsoft Learn)