Endpoint DLP: Setup & Configuration

Why Endpoint DLP?

Device requirements and onboarding

Supported platforms

Platform	Minimum Version	Onboarding Method
Windows 10	Version 1809+ (Enterprise, Pro, Education)	Defender for Endpoint, Intune, Group Policy, Configuration Manager, local script
Windows 11	All versions	Same as Windows 10
macOS	12 (Monterey)+	Intune, JAMF, local script

Onboarding methods

Choose the onboarding method that fits your device management infrastructure

Method	Best For	Scale
Microsoft Intune	Cloud-managed devices already enrolled in Intune	Large scale — thousands of devices
Microsoft Defender for Endpoint	Devices already onboarded to Defender	Seamless — no extra deployment needed
Group Policy	Domain-joined Windows devices in on-premises AD	Large scale — AD-based deployment
Configuration Manager	SCCM/MECM managed devices	Large scale — existing SCCM infrastructure
Local script	Testing, pilot groups, non-domain-joined devices	Small scale — manual per device

Endpoint DLP settings

Configure global Endpoint DLP behaviour in Microsoft Purview portal → Settings → Endpoint DLP settings:

Unallowed apps

Define applications that cannot access sensitive files:

Setting	What It Does
Unallowed apps (Windows)	Block specific Windows applications from opening sensitive files
Unallowed browser activities	Control browser-based activities for sensitive content
Unallowed Bluetooth apps	Prevent Bluetooth transfer of sensitive files

File path exclusions

Exclude specific folders from Endpoint DLP monitoring — useful for system directories, temp folders, or approved applications:

Example Exclusion	Why
%AppData%\CompanyApp\	Your internal app needs access to sensitive files
%SystemRoot%\System32\	System files should not trigger DLP
%ProgramFiles%\ApprovedTool\	An approved security tool that needs file access

Browser extension

The Microsoft Purview browser extension for Chrome and Microsoft Edge monitors uploads from browsers:

Feature	Without Extension	With Extension
Upload monitoring	Cannot see what users upload via browser	Detects when sensitive files are uploaded to non-corporate cloud services
Paste monitoring	Cannot see browser clipboard actions	Detects when sensitive content is pasted into web forms
Policy enforcement	No browser-level DLP	Block or warn on sensitive uploads and paste actions

Just-in-time protection

Just-in-time (JIT) protection is an Endpoint DLP feature that temporarily blocks an egress action on a file DLP hasn’t evaluated yet — or whose classification is stale — while Purview finishes evaluating it against your DLP policies. It does not encrypt anything; it closes the timing gap between a file being created and DLP classifying it.

Aspect	Detail
What it does	Temporarily blocks a qualifying egress action on a not-yet-evaluated (or stale-classification) file while DLP evaluates it, then applies the policy verdict
Egress activities	Copy to removable media, copy to a network share, print, copy/move over RDP, copy/move via a blocked Bluetooth app, upload to a restricted cloud domain. Copy to clipboard is JIT Audit by default
When it triggers a block	The user is in scope for JIT, a DLP rule is set to Block or Block with override for that activity, the destination isn’t an allowed location, and evaluation doesn’t complete quickly
What happens next	Once evaluation completes, the file’s DLP policy action applies (audit / block / block with override). Some activities resume automatically; others prompt the user to retry
Fallback action	If evaluation can’t complete, the configured fallback — Allow or Block — applies
Benefit	Stops sensitive data leaving before it has been classified, without pre-labelling every file (encryption, when needed, comes separately from sensitivity labels)

JIT protection scenario

Without JIT: a user copies a brand-new, not-yet-classified sensitive file to USB before DLP evaluates it → the file leaves unprotected. With JIT: the user attempts the copy → because the file is unevaluated and a Block rule applies, Endpoint DLP briefly blocks the action while Purview evaluates the file → the resulting DLP policy action then applies (allowed, or blocked / blocked with override). If evaluation can’t finish in time, the configured fallback (Allow or Block) applies.

💡 Scenario: Dr. Liam deploys Endpoint DLP

St. Harbour Health needs to prevent patient data from leaving devices via USB or personal cloud:

1. Onboarding: Clinical workstations enrolled via Intune → devices onboarded to Endpoint DLP automatically
2. Unallowed apps: Personal Dropbox, personal Google Drive client, WeTransfer marked as unallowed
3. Browser extension: Deployed to Chrome and Edge on all clinical workstations
4. JIT protection: Enabled for removable storage — a not-yet-classified file copied to USB is briefly held while DLP evaluates it, then allowed or blocked per policy (with a configurable fallback if evaluation can’t complete)
5. Policy: Block USB copy of files matching patient health identifier SIT. Block with override for printing (nurses may need to print discharge summaries).

Question

What is the purpose of the Microsoft Purview browser extension for Endpoint DLP?

Click or press Enter to reveal answer

Answer

The browser extension monitors uploads and clipboard paste operations in Chrome and Microsoft Edge. Without it, Endpoint DLP cannot see what users upload via browser or paste into web forms. With it, DLP can block or warn when sensitive content is uploaded to non-corporate cloud services.

Click to flip back

Question

What does just-in-time (JIT) protection do in Endpoint DLP?

Click or press Enter to reveal answer

Answer

JIT temporarily blocks an egress action (like copying to USB) on a file DLP hasn't evaluated yet — or whose classification is stale — while Purview evaluates it against your DLP policies. The file's policy action (audit, block, or block with override) is then applied; if evaluation can't complete, a configurable fallback (Allow or Block) applies. JIT does NOT encrypt files — it closes the gap between file creation and classification.

Click to flip back

Question

Name three methods for onboarding devices to Endpoint DLP.

Click or press Enter to reveal answer

Answer

1. Microsoft Intune — for cloud-managed devices. 2. Microsoft Defender for Endpoint — for devices already in Defender. 3. Group Policy — for domain-joined Windows devices. Also: Configuration Manager (SCCM/MECM), and local scripts for testing/pilot.

Click to flip back

Knowledge Check

Marcus at NovaTech wants Endpoint DLP to block developers from uploading source code files to personal GitHub accounts via the browser. The developers use Chrome. What must Marcus deploy in addition to the Endpoint DLP policy?

AMicrosoft Defender for Cloud Apps connector for GitHubBThe Microsoft Purview browser extension for ChromeCA custom sensitive information type for source codeDMicrosoft Intune app protection policies

Check Answer

Knowledge Check

Dr. Liam enabled JIT protection on clinical workstations at St. Harbour Health, with a DLP policy that blocks patient-identifier files from USB. A nurse copies a brand-new file containing patient identifiers to a USB drive before it has been classified. What does JIT protection do?

AIt encrypts the file so the USB copy requires authentication to openBIt temporarily blocks the copy while Purview evaluates the file, then applies the policy action — here, block — once evaluation completesCIt allows the copy immediately and raises a DLP alert afterwardsDIt permanently locks the USB drive until IT approves

Check Answer

---

Next up: Endpoint DLP: Advanced Rules & Monitoring — create sophisticated device-specific DLP rules and monitor what’s happening on endpoints.