Endpoint DLP onboarding checklist

Symptoms to confirm

• The device isn't in Settings › Device onboarding › Devices in the Microsoft Purview portal, or it is listed with one of these values:

Configuration status: Not updated
Configuration status: Not available
Policy sync status: Not updated
Policy sync status: Not available

• Activity explorer shows no endpoint events for the device, and copying a matching test file to USB triggers nothing.
• In advanced hunting, the device's DlpInfo data shows "IsDlpConfigurationValid": false, "IsDefenderRealTimeProtectionEnabled": false or "IsDefenderBehaviorMonitoringEnabled": false.

Likely causes

Device onboarding is shared between Microsoft Purview and Microsoft Defender for Endpoint.

• Defender prerequisites. The anti-malware client must be 4.18.2110 or newer, and versions older than N-2 lose support when new ones ship. Microsoft's requirement is that Windows Security components don't need to be active, but real-time protection and behavior monitoring must be enabled. A configuration that turns them off, for example alongside another antivirus product, leaves the device Not updated.
• Unsupported OS or join state. Supported builds include Windows 10 22H2 and Windows 11 21H2 through 24H2 with the required updates, plus Windows Server 2019 and 2022. Devices must be Microsoft Entra joined, hybrid joined or registered.
• Connectivity. A proxy that doesn't let the device reach the cloud DLP service, or a firewall, antivirus or application control product that blocks MpDlpService.exe.
• No policy, or offline. Without an endpoint DLP policy, policy sync shows Not available. Devices must be online to receive updates, and the list can take up to 2 hours to refresh.
• Servers. Endpoint DLP isn't enabled for onboarded Windows servers by default; you must turn on endpoint DLP support for servers first.

Checklist

1. 1

   Turn on device onboarding

   In the Purview portal go to Settings › Device onboarding › Devices and choose Turn on device onboarding. It usually takes about 60 seconds; Microsoft says to allow up to 30 minutes before contacting support.

2. 2

   Onboard the devices that aren't listed

   Devices already in Defender for Endpoint need nothing more. For the rest, choose Onboarding, pick a deployment method (Intune, Configuration Manager, Group Policy, local script or VDI) and download the package.

3. 3

   Check Defender and join state on the device

   powershell

   Get-MpComputerStatus |
     Select-Object AMProductVersion, AMEngineVersion, AMRunningMode,
                   RealTimeProtectionEnabled, BehaviorMonitorEnabled
   dsregcmd /status | Select-String "AzureAdJoined|DomainJoined|WorkplaceJoined"

   Good looks like AMProductVersion at 4.18.2110 or later (and current), both protection values True, and the device Entra joined, hybrid joined or registered. Update the platform through Windows Update (KB4052623) and fix whichever Intune, Group Policy or third-party setting disables real-time protection or behavior monitoring.

4. 4

   Fix connectivity

   Configure the device proxy as described in Microsoft's endpoint DLP proxy guidance and allow MpDlpService.exe through firewalls, third-party antivirus and application control. If you route Defender traffic through a proxy, streamlined connectivity for Defender for Endpoint helps you validate it.

5. 5

   Give the device a policy and a valid user

   Create at least one DLP policy with the Devices location, even in audit mode. The device details pane shows Valid user, which tells you whether the signed-in user has a Microsoft Entra account and is in scope of a device policy.

6. 6

   Wait for the device, then read the details pane

   Select the device to see Last seen, Last policy sync time, Defender engine version and Endpoint DLP status, plus the remediation steps Purview suggests. If the status doesn't move, check Last seen: an offline device can't sync.

Verify

• Both columns should show Updated. To check every device at once, run this in the Microsoft Defender portal under Investigation & response › Hunting › Advanced hunting:

DeviceInfo
| where DlpInfo != ""
| summarize arg_max(Timestamp, *) by DeviceId
| extend Dlp = parse_json(DlpInfo)
| where tobool(Dlp.IsDlpConfigurationValid) == false
    or tobool(Dlp.IsDefenderRealTimeProtectionEnabled) == false
    or tobool(Dlp.IsDefenderBehaviorMonitoringEnabled) == false
| project DeviceName, Timestamp, Dlp

• An empty result means every reporting device is healthy. Then copy a dummy sensitive file to a USB drive on a pilot device and confirm the event under the Endpoint DLP activities filter set in Activity explorer.

Prevent it next time

• Keep the Defender platform current; versions older than N-2 lose support, and newer endpoint DLP features need newer clients.
• Run the hunting query regularly, or feed DlpInfo into your own dashboard.
• Devices stay in the list for 180 days after they go offline, so check Last seen before chasing a stale entry.
• Once devices are healthy, configure endpoint DLP settings for USB, printers and cloud uploads, and for Macs see endpoint DLP on macOS.