Endpoint DLP: Advanced Rules & Monitoring
Go beyond basic blocks. Create advanced DLP rules for specific device activities, monitor endpoint events in Activity Explorer, and fine-tune policies based on real-world device behaviour.
Advanced device rules
Basic Endpoint DLP says “block sensitive files from going to USB.” Advanced rules say “block sensitive files from going to USB unless it’s a company-encrypted USB, and only warn if the user is in the Finance group, and audit everything else.”
Advanced DLP rules for devices let you build nuanced, context-aware policies. Instead of blanket blocks, you can configure different actions for different activities, specific device types, specific apps, network locations, and more.
Endpoint activities you can control
Each DLP rule for devices can configure actions for individual endpoint activities:
| Activity | What It Detects | Typical Action |
|---|---|---|
| Copy to removable media | USB drives, external hard drives, SD cards | Block or JIT encrypt |
| Copy to network share | Files copied to SMB/NFS shares | Audit or block for non-corporate shares |
| Upload to cloud service | Files uploaded via browser or sync client | Block personal cloud, allow corporate |
| Sending sensitive files to any printer | Block or warn | |
| Copy to clipboard | Copy-paste of sensitive content between apps | Audit or block |
| Access by unallowed apps | Unallowed applications attempting to open sensitive files | Block the application |
| Access by unallowed Bluetooth apps | Bluetooth transfer of sensitive files | Block |
| RDP access | Accessing sensitive files via Remote Desktop session | Audit or block |
| Upload to restricted service domain | Uploading to specific blocked domains | Block |
Service domains — corporate vs personal
A powerful advanced feature is service domain classification. You define which domains are corporate (allowed) and which are personal/restricted:
| Domain Type | Example | DLP Action |
|---|---|---|
| Allowed service domain | onedrive.com, sharepoint.com, box.com/company | Allow upload |
| Restricted service domain | dropbox.com/personal, drive.google.com/personal | Block or warn |
| Unclassified | Any domain not in either list | Apply default action |
This lets you block uploads to personal Dropbox while allowing uploads to the corporate Box instance.
Device groups
Create device groups to apply different rules to different device types:
| Device Group | Example Devices | Rule |
|---|---|---|
| Clinical workstations | Nursing stations, doctor devices | Block all USB + block printing of patient data |
| Executive devices | C-suite laptops | Warn on external sharing, audit USB |
| Developer machines | Engineering team | Block personal cloud upload, allow corporate GitHub |
| Shared kiosks | Reception, waiting room devices | Block all sensitive file activities |
Scenario: Priya creates device-specific rules
Priya configures advanced rules at Meridian Financial:
Trading floor devices:
- Copy to USB: Hard block — no financial data leaves on removable media
- Print: Block — no paper copies of trading data
- Upload to cloud: Block personal cloud, allow corporate SharePoint
- Clipboard: Audit — log copy-paste of financial data between apps
Wealth management devices:
- Copy to USB: Block with override — occasionally needed for client presentations
- Print: Warn — policy tip explaining the risk
- Upload to cloud: Block personal, allow corporate
Different rules for different teams, same policy framework.
Monitoring endpoint activities
Activity Explorer for endpoints
Activity Explorer shows a timeline of all DLP-related endpoint events:
| Event | What You See |
|---|---|
| DLP rule matched | Which rule, which file, which activity, which user |
| File copied to removable media | Device name, USB device ID, file name, SIT matches |
| File printed | Printer name, file name, user, SIT matches |
| File uploaded via browser | Domain, file name, browser used, SIT matches |
| App access blocked | Application name, file name, user, policy rule |
Investigating endpoint events
| Investigation Step | Tool | What You Learn |
|---|---|---|
| 1. Check Activity Explorer | Purview portal → Data classification → Activity Explorer | What activities are happening, which users, which files |
| 2. Filter by activity type | Filter on “Copy to removable media” or “File printed” | Focus on specific risk activities |
| 3. Drill into events | Click individual events for details | Exact file, SIT matches, device, policy rule |
| 4. Export report | Export events for further analysis | Trend analysis, reporting to management |
Key metrics to monitor
| Metric | What It Tells You | Action |
|---|---|---|
| High USB copy volume | User copying many files to removable media | Investigate — potential data exfiltration |
| Frequent override usage | Users consistently overriding DLP blocks | Review if policy is too strict or users are circumventing |
| Unallowed app access attempts | Blocked applications trying to open sensitive files | Verify app blocks are correct, investigate shadow IT |
| Print volume spikes | Unusual printing of sensitive documents | Correlate with Insider Risk signals |
Exam tip: endpoint monitoring data flow
Endpoint DLP events flow into two places:
- Activity Explorer in the Purview portal — the primary investigation surface
- DLP alerts in the Purview compliance portal — for policy matches that generate alerts
If the exam asks where to view endpoint DLP activities, the answer is Activity Explorer. If it asks where to triage DLP alerts, the answer is the DLP alerts page in the Purview portal or Microsoft Defender XDR (for integrated alerting).
Zara at Atlas Global wants to block employees from uploading sensitive files to personal Dropbox but allow uploads to the corporate Dropbox instance. How should she configure this?
Dr. Liam notices in Activity Explorer that a nurse at St. Harbour Health has copied 350 files containing patient identifiers to a USB drive over the past week. Endpoint DLP is set to 'warn' for USB copies. What should Dr. Liam do?
🎬 Video coming soon
Next up: Retention: Plan Your Data Lifecycle — shift from protecting data in motion to managing data through its entire lifecycle.