Endpoint DLP: labeled files on devices An administrator sets up Endpoint DLP for Windows devices with rules based on sensitivity labels. An employee then copies labeled files to a USB drive and uploads one to a private cloud service, and sees a request for a justification and two blocks. W DATA LOSS PREVENTION · DEVICES Endpoint DLP: labeled files on devices Ada Admin Eli Employee Microsoft Purview Home Data Loss Prevention Policies Activity explorer Information Protection Insider Risk Management DSPM for AI Settings Data Loss Prevention Device onboarding Information Protection Insider Risk Management Roles and scopes Settings · Data Loss Prevention Browser and domain restrictions to sensitive data Restrict sensitive files that match your policies from being shared with unallowed browsers and service domains. Unallowed browsers No browsers added. Chrome and Firefox with the Microsoft Purview extension are not blocked. Off ▼ Service domains Choose 'Allow' to specify safe domains. Labeled files can then only be uploaded to these domains. + Add cloud service domain Service domain contoso.sharepoint.com All other domains are restricted, for example: Save Settings saved Policies + Create policy TEMPLATENAMEDESCRIPTION Custom policy Label-based rules for activities on devices LOCATIONS + Create rule Create rule EP-Label · DLP rules NAME CONDITIONS Content contains: sensitivity labels Select a label ▼ AUDIT OR RESTRICT ACTIVITIES ON DEVICES Save EP-Label · Rules RULEUPLOAD TO CLOUDCOPY TO USB Policy mode EP-Label Simulation running Shows which activities would match each rule, without blocking anything or notifying users. Policy is on. Changes can take up to an hour to apply. PREREQUISITES Before Endpoint DLP works The rest of this video assumes that this is in place. Documents Home Documents This PC USB drive (E:) NAMESENSITIVITY Dropbox dropbox.com/home Personal My files Upload files Drop files here Open Documents Open Data loss prevention This action needs a business reason Customer contract.docx is labeled Confidential. Your organization restricts copying it to a removable USB device. Choose a reason to continue Allow Cancel Data loss prevention Learn more THE USER EXPERIENCE What Eli sees on the PC Eli copies labeled files to a USB drive and uploads one to a private cloud service. Good to know NEXT DLP for sensitive information 1/7 DATA LOSS PREVENTION Endpoint DLP: labeled files on devices An administrator sets up a DLP policy for Windows devices with rules based on sensitivity labels. Then we see what happens when an employee copies labeled files to a USB drive or uploads them to a private cloud service. informasjonsbeskyttelse.no