🔒 Guided

Pre-launch preview. Authorised access only.

Incorrect code

Guided by A Guide to Cloud
Explore AB-900 AI-901
Guided SC-401 Domain 2
Domain 2 — Module 4 of 8 50%
12 of 25 overall

SC-401 Study Guide

Domain 1: Implement Information Protection

  • Know Your Data: Sensitive Info Types Free
  • Custom Sensitive Info Types: Build Your Own Free
  • EDM & Fingerprinting: Detect Exact Data
  • Trainable Classifiers: AI-Powered Detection Free
  • Sensitivity Labels: Create & Protect Free
  • Sensitivity Labels: Publish & Auto-Apply
  • Email Encryption: Lock Down Messages
  • Purview IP Client: Classify Files at Scale

Domain 2: Implement DLP and Retention

  • DLP Foundations: Stop Data Leaks
  • DLP Policies: Build, Manage & Extend
  • DLP: Precedence & Adaptive Protection
  • Endpoint DLP: Setup & Configuration
  • Endpoint DLP: Advanced Rules & Monitoring
  • Retention: Plan Your Data Lifecycle
  • Retention Labels: Publish & Auto-Apply
  • Retention: Policies, Precedence & Recovery

Domain 3: Manage Risks, Alerts, and Activities

  • Insider Risk: Foundations & Setup
  • Insider Risk: Policies & Indicators
  • Insider Risk: Investigate & Close Cases
  • Adaptive Protection: Risk Levels Meet DLP
  • Purview Audit: Investigate & Retain
  • Activity Explorer & Content Search
  • Alert Response: Purview, XDR & Cloud Apps
  • DSPM for AI: Setup & Controls
  • DSPM for AI: Policies & Monitoring

SC-401 Study Guide

Domain 1: Implement Information Protection

  • Know Your Data: Sensitive Info Types Free
  • Custom Sensitive Info Types: Build Your Own Free
  • EDM & Fingerprinting: Detect Exact Data
  • Trainable Classifiers: AI-Powered Detection Free
  • Sensitivity Labels: Create & Protect Free
  • Sensitivity Labels: Publish & Auto-Apply
  • Email Encryption: Lock Down Messages
  • Purview IP Client: Classify Files at Scale

Domain 2: Implement DLP and Retention

  • DLP Foundations: Stop Data Leaks
  • DLP Policies: Build, Manage & Extend
  • DLP: Precedence & Adaptive Protection
  • Endpoint DLP: Setup & Configuration
  • Endpoint DLP: Advanced Rules & Monitoring
  • Retention: Plan Your Data Lifecycle
  • Retention Labels: Publish & Auto-Apply
  • Retention: Policies, Precedence & Recovery

Domain 3: Manage Risks, Alerts, and Activities

  • Insider Risk: Foundations & Setup
  • Insider Risk: Policies & Indicators
  • Insider Risk: Investigate & Close Cases
  • Adaptive Protection: Risk Levels Meet DLP
  • Purview Audit: Investigate & Retain
  • Activity Explorer & Content Search
  • Alert Response: Purview, XDR & Cloud Apps
  • DSPM for AI: Setup & Controls
  • DSPM for AI: Policies & Monitoring
Domain 2: Implement DLP and Retention Premium ⏱ ~13 min read

Endpoint DLP: Setup & Configuration

Extend DLP beyond the cloud to Windows and macOS devices. Configure device onboarding, Endpoint DLP settings, browser extensions, and just-in-time protection for files on user devices.

Why Endpoint DLP?

☕ Simple explanation

Cloud DLP is like a security guard at the office door. Endpoint DLP is a guard who follows you home.

Cloud DLP protects data in SharePoint, OneDrive, Exchange, and Teams — data that lives in Microsoft’s cloud. But what about the file a user downloads to their laptop? Or prints on a home printer? Or copies to a USB drive?

Endpoint DLP extends protection to the device itself. It monitors and controls what users do with sensitive files on their Windows or macOS computers — copying to USB, printing, uploading to personal cloud services, accessing with unallowed apps, or pasting into a browser.

Microsoft Purview Endpoint DLP extends data loss prevention to Windows 10/11 and macOS devices. It monitors user activities on managed devices — file copies to removable storage, printing, uploading to non-corporate cloud services, clipboard operations, and access by unallowed applications. Endpoint DLP uses the same SITs, sensitivity labels, and DLP policy framework as cloud DLP, providing unified policy management.

Endpoint DLP requires device onboarding (via Microsoft Defender for Endpoint, Intune, or Group Policy), configuration of Endpoint DLP settings in the Purview portal, and optionally the Microsoft Purview browser extension for Chrome and Edge to monitor uploads via web browsers.

Device requirements and onboarding

Supported platforms

PlatformMinimum VersionOnboarding Method
Windows 10Version 1809+ (Enterprise, Pro, Education)Defender for Endpoint, Intune, Group Policy, Configuration Manager, local script
Windows 11All versionsSame as Windows 10
macOS12 (Monterey)+Intune, JAMF, local script

Onboarding methods

Choose the onboarding method that fits your device management infrastructure
MethodBest ForScale
Microsoft IntuneCloud-managed devices already enrolled in IntuneLarge scale — thousands of devices
Microsoft Defender for EndpointDevices already onboarded to DefenderSeamless — no extra deployment needed
Group PolicyDomain-joined Windows devices in on-premises ADLarge scale — AD-based deployment
Configuration ManagerSCCM/MECM managed devicesLarge scale — existing SCCM infrastructure
Local scriptTesting, pilot groups, non-domain-joined devicesSmall scale — manual per device

Endpoint DLP settings

Configure global Endpoint DLP behaviour in Microsoft Purview portal → Settings → Endpoint DLP settings:

Unallowed apps

Define applications that cannot access sensitive files:

SettingWhat It Does
Unallowed apps (Windows)Block specific Windows applications from opening sensitive files
Unallowed browser activitiesControl browser-based activities for sensitive content
Unallowed Bluetooth appsPrevent Bluetooth transfer of sensitive files

File path exclusions

Exclude specific folders from Endpoint DLP monitoring — useful for system directories, temp folders, or approved applications:

Example ExclusionWhy
%AppData%\CompanyApp\Your internal app needs access to sensitive files
%SystemRoot%\System32\System files should not trigger DLP
%ProgramFiles%\ApprovedTool\An approved security tool that needs file access

Browser extension

The Microsoft Purview browser extension for Chrome and Microsoft Edge monitors uploads from browsers:

FeatureWithout ExtensionWith Extension
Upload monitoringCannot see what users upload via browserDetects when sensitive files are uploaded to non-corporate cloud services
Paste monitoringCannot see browser clipboard actionsDetects when sensitive content is pasted into web forms
Policy enforcementNo browser-level DLPBlock or warn on sensitive uploads and paste actions

Just-in-time protection

Just-in-time (JIT) protection is a newer Endpoint DLP feature that provides dynamic, on-demand encryption:

AspectDetail
What it doesAutomatically encrypts a sensitive file when a user attempts a restricted action
When it triggersWhen a DLP policy detects a sensitive file being copied, moved, or accessed by an unallowed app
Encryption typeApplies Microsoft Purview Information Protection encryption on the fly
User experienceThe file is encrypted before the action completes — even if the user copies it to USB, the copy is encrypted
BenefitProtects data at the point of risk without pre-labeling every file

JIT protection scenario

Without JIT: User copies a sensitive file to USB → file is unencrypted on the USB drive. With JIT: User tries to copy a sensitive file to USB → DLP detects the action → file is encrypted before the copy completes → USB copy is encrypted and requires authentication to open.

💡 Scenario: Dr. Liam deploys Endpoint DLP

St. Harbour Health needs to prevent patient data from leaving devices via USB or personal cloud:

  1. Onboarding: Clinical workstations enrolled via Intune → devices onboarded to Endpoint DLP automatically
  2. Unallowed apps: Personal Dropbox, personal Google Drive client, WeTransfer marked as unallowed
  3. Browser extension: Deployed to Chrome and Edge on all clinical workstations
  4. JIT protection: Enabled for removable storage — any sensitive file copied to USB is automatically encrypted
  5. Policy: Block USB copy of files matching patient health identifier SIT. Block with override for printing (nurses may need to print discharge summaries).
Question

What is the purpose of the Microsoft Purview browser extension for Endpoint DLP?

Click or press Enter to reveal answer

Answer

The browser extension monitors uploads and clipboard paste operations in Chrome and Microsoft Edge. Without it, Endpoint DLP cannot see what users upload via browser or paste into web forms. With it, DLP can block or warn when sensitive content is uploaded to non-corporate cloud services.

Click to flip back
Question

What does just-in-time (JIT) protection do in Endpoint DLP?

Click or press Enter to reveal answer

Answer

JIT protection automatically encrypts a sensitive file at the moment a user attempts a restricted action (like copying to USB). The file is encrypted before the action completes, so even if copied to removable storage, the copy requires authentication to open. This protects data without requiring every file to be pre-labelled.

Click to flip back
Question

Name three methods for onboarding devices to Endpoint DLP.

Click or press Enter to reveal answer

Answer

1. Microsoft Intune — for cloud-managed devices. 2. Microsoft Defender for Endpoint — for devices already in Defender. 3. Group Policy — for domain-joined Windows devices. Also: Configuration Manager (SCCM/MECM), and local scripts for testing/pilot.

Click to flip back
Knowledge Check

Marcus at NovaTech wants Endpoint DLP to block developers from uploading source code files to personal GitHub accounts via the browser. The developers use Chrome. What must Marcus deploy in addition to the Endpoint DLP policy?
Knowledge Check

Dr. Liam enabled JIT protection on clinical workstations at St. Harbour Health. A nurse copies a file containing patient identifiers to a USB drive. What happens to the file on the USB drive?

🎬 Video coming soon

Next up: Endpoint DLP: Advanced Rules & Monitoring — create sophisticated device-specific DLP rules and monitor what’s happening on endpoints.

← Previous

DLP: Precedence & Adaptive Protection

Next →

Endpoint DLP: Advanced Rules & Monitoring

Guided

I learn, I simplify, I share.

A Guide to Cloud YouTube Feedback

© 2026 Sutheesh. All rights reserved.

Guided is an independent study resource and is not affiliated with, endorsed by, or officially connected to Microsoft. Microsoft, Azure, and related trademarks are property of Microsoft Corporation. Always verify information against Microsoft Learn.