Modules 10 and 11 protected data in the cloud: Exchange, SharePoint, OneDrive, Teams. Those policies stop at the cloud. Once a user downloads a file, they cannot see it any more.
This module follows the file onto the laptop.
Endpoint DLP runs inside Windows and macOS. It sees the user copy a file to USB, print it, upload it in a browser, or paste it into a web form. It checks the file against your policy. Then it audits, blocks, or blocks with override.
Everything else in this module is detail around four questions.
| Question you will get | Short answer | Tab |
|---|---|---|
| Can it block this activity? | Create and rename: audit only. Copy, print, upload: restrictable. | 1 |
| How do devices get in? | Onboard, or already in Defender for Endpoint. Then turn on device monitoring. | 2 |
| Which setting fits? | Exclusions, restricted apps, browsers and domains, groups. | 3, 4 |
| What does the policy do at runtime? | User and device in scope. Most restrictive action per activity. | 5 |
| Unclassified file leaves too fast? | Just-in-time protection. | 6 |
EXAM = tested, learn it. SKIM = context, read once. Questions test only EXAM parts. Each tab: the one idea, tenant screens with numbered marks, "pick X when" tables, traps, then questions. Answer in the page. The Review tab has "Copy my results".
The module and two vendor items differ from today's product pages. The exam follows the product. Use the right-hand column.
| Module or bank says | Product docs say (opened 15 Nov 2026) | Answer on the exam |
|---|---|---|
| Module unit 8: JIT is available on Windows 10 and 11 | JIT get-started page: Windows 10, Windows 11 and the three latest macOS versions | Windows and macOS |
| Module: actions are audit, warn, block with override, block | Portal actions: Allow (Devices only), Audit only, Block with override, Block | Use the portal names |
| Module: macOS onboarding with Intune or JAMF Pro | Intune, JAMF Pro or any other MDM | Any MDM. Never Group Policy. |
Module example C:\Temp\* as a common exclusion | \* excludes only subfolders. Files directly in C:\Temp stay in scope. | Know the three endings |
| SC400-040.1 key: install Edge = Yes | Edge is not a listed requirement or setup step | No (as SC401-050.1) |
| SC401-052 explanation: E5 makes a device visible | Visibility comes from onboarding in Purview or Defender for Endpoint | Key B still right |
The device does the work. On Windows it runs through the Microsoft Defender anti-malware client (the MpDlpService.exe process). On macOS it runs through the Defender app.
The agent gets policies from the Purview cloud. It enforces them on the device. It reports activity back to Activity explorer.
This is the most tested table of the module. Two activities can only be watched. All others can be watched or stopped.
| Activity | Audit | Block |
|---|---|---|
| Upload to a restricted cloud service domain, or access from an unallowed browser | Yes | Yes |
| Paste to supported browsers | Yes | Yes |
| Copy to clipboard | Yes | Yes |
| Copy to USB removable device | Yes | Yes |
| Copy to a network share | Yes | Yes |
| Yes | Yes | |
| Copy or move using unallowed Bluetooth app | Yes | Yes |
| Copy or move using RDP (Remote Desktop Protocol) | Yes | Yes |
| Access by restricted apps | Yes | Yes |
| Create an item | Yes | No |
| Rename an item | Yes | No |
Source: "Learn about Endpoint data loss prevention", activity table. Windows Recall snapshots (preview) is also restrictable, Windows x64 only.
TRAP"Restrict users from renaming a file" or "from creating a file": the answer is No. Endpoint DLP sees it but cannot stop it.
Most things work on both. Learn the short list of macOS gaps instead of the long list of matches.
| Feature | macOS |
|---|---|
| Copy or move using RDP | Not supported |
| Windows Recall snapshots | Not supported |
| VPN settings | Not supported |
| Offline enforcement | Not supported |
| "Access by apps not on the restricted list" | Not supported |
| Paste to supported browsers | Preview |
| Advanced label-based protection | Windows only |
Sources: endpoint-dlp-learn-about (settings and activity tables), dlp-configure-endpoint-settings. Supported platforms: Windows 10/11, the three latest macOS versions, Windows Server 2019 and later.
The rule blocks clipboard copy. Word file 123 is sensitive. Word file 789 is not. What happens?
| Copy from → paste into | Result |
|---|---|
| 123 → 123 (same file) | Allowed |
| 123 → 789 (other Office file) | Blocked |
| 789 → 123 | Allowed |
| 123 → Notepad | Blocked |
| Sensitive Notepad file → anything | Blocked |
One more rule. While a blocked file is open, copying from any file in the same app is restricted.
| Event | What Endpoint DLP does |
|---|---|
| File created or modified | Full scan for SITs and labels |
| Already classified file is opened | Re-evaluates rules if policy changed. Keeps old extracted text. |
| Data never saved locally | Cannot scan. Cannot block. |
| Label from another tenant | Not detected |
Example. You make a SIT more precise. Old files that users only open are re-evaluated against rules. Their text is not rescanned until someone saves them.
GAPRenaming a .docx to .txt does not hide it. Endpoint DLP detects .doc, .docx, .xls, .xlsx, .ppt, .pptx and .pdf by MIME type, whatever the extension.
Onboarding is shared with Microsoft Defender for Endpoint. A device onboarded there already appears in Purview. A device onboarded in Purview is also onboarded into Defender for Endpoint.
TRAPDevices are "already onboarded to Defender for Endpoint". Do not onboard them again. The first step is to turn on device monitoring in Purview (SC401-097.1).
| Your devices | Method |
|---|---|
| Windows, managed by Intune | Intune (MDM) |
| Windows, domain-joined | Group Policy |
| Windows, Configuration Manager | Configuration Manager |
| Non-persistent virtual desktops | VDI onboarding script |
| Test, up to 10 devices | Local script |
| macOS | Intune, JAMF Pro or another MDM |
| macOS with Defender for Endpoint | The "for MDE customers" variant |
TRAP"100 notebooks" rules out the local script. It is "optimized for use on up to 10 devices". Microsoft Monitoring Agent (MMA) is never a Purview onboarding method.
TRAPmacOS has no Group Policy and no local script option.
| Requirement | Value |
|---|---|
| Windows build (x64) | Windows 10 22H2, Windows 11 21H2 to 24H2 |
| Windows Server | 2019 (1809+) and 2022. Not domain controllers, not Server Core. |
| Anti-malware client | 4.18.2110 or newer (update: KB4052623) |
| Defender features | Real-time protection and Behavior monitor on |
| Identity | Entra joined, hybrid joined or registered |
| Network | Can reach the cloud. Allow MpDlpService.exe through firewalls. |
Source: "Onboard Windows devices into Microsoft 365 overview", Prepare your Windows devices. Microsoft 365 Apps 16.0.14701.0 or later is recommended.
TRAPMicrosoft Edge is not a requirement. Intune enrolment is not a requirement. Windows 8 is not supported.
TRAPA device that looks onboarded but enforces nothing: check the proxy first.
Device management accepts Microsoft Entra roles only. Purview role groups do not work here.
| Task | Roles |
|---|---|
| Turn on device management, onboarding page, device monitoring on/off | Compliance admin, Security admin, Global admin |
| Only view device management settings | Also Compliance data admin, Global reader |
| Case | What to know |
|---|---|
| Windows Server | Off after onboarding. Turn on "Endpoint DLP support for onboarded servers". |
| USB in VDI | Seen as a network share. Add "Copy to network share". |
| AVD in a browser | Clipboard not monitored. RDP activity covers it. |
| Citrix XenApp | No restricted app monitoring |
| Windows offline | Old policy keeps working. No new policy. Events upload later. |
| macOS offline | Not supported |
| Device gone offline | Stays in the list 180 days |
Path: Purview › Data loss prevention › Overview › settings gear › Data Loss Prevention › Endpoint DLP settings.
A setting alone does nothing to users. It only defines a list or a group. A policy rule then says what to do with that list.
An excluded path gets no DLP monitoring, no alerts and no enforcement. Files there are not audited.
| You type | Excluded |
|---|---|
C:\Temp\ | Files directly in C:\Temp only |
C:\Temp\* | Files in subfolders only |
C:\Temp | The folder and all subfolders |
C:\Users\*(1)\Downloads\ | Downloads one level under Users |
%SystemDrive%\Test\* | Environment variables work |
Windows excludes AppData\Roaming and AppData\Local by default. macOS excludes /System, plus a recommended list (on by default).
TRAPNever answer "file path exclusion" when the goal is to protect files. It removes protection.
They overlap. They are not interchangeable.
| Restricted apps (list) | Restricted app groups | |
|---|---|---|
| Controls | Opening (access) the file | Access, or clipboard, USB, network share and print from the app |
| Size | One list | 10 groups × 50 apps |
| Same rule, same app | Loses | Wins |
| Pick | When |
|---|---|
| Restricted apps | "This app must not open sensitive files." |
| Restricted app group | "These apps may open them, but not print or copy to USB." |
| Group set to Allow + all other apps Block | "Block every app except an approved list." |
Windows: type only the executable name, like notepad.exe. macOS: type the full path, from Activity Monitor › Open Files and Ports.
Problem: OneDrive sync (onedrive.exe) tries again and again to upload a blocked file. The user gets endless toasts.
Fix: add the sync app to Restricted apps with Auto-quarantine. The file moves to an admin folder. A .txt placeholder can tell the user where it went.
| Setting | Pick it when the stem says |
|---|---|
| Advanced classification scanning and protection | EDM, trainable classifier, named entity or credential SIT must work on devices |
| Always audit file activity for devices | See Office, PDF, CSV activity with no policy. Or turn off to cut audit volume. |
| Set up evidence collection | Keep a copy of the matched file (Azure storage) |
| Network share coverage and exclusions | Extend device policies to shares and mapped drives |
Advanced classification sends content to the cloud. Limits: 64 MB text, 50 MB image with OCR. You can cap bandwidth per device per rolling 24 hours. Paste to browser does not use it.
For file types not on the monitored list, use the condition Document could not be scanned with Apply restrictions to only unsupported file extensions. It blocks by extension. It does not read content. Type extensions without the dot.
Disable classification does the reverse: it stops content scanning for an extension.
| Browser | Windows | macOS |
|---|---|---|
| Microsoft Edge | Native | Native |
| Safari | n/a | Native |
| Chrome | Purview extension | No extension needed |
| Firefox | Purview extension | No extension needed |
Deploy the extension with Intune or Group Policy (force-install). Users then cannot remove it.
TRAP"Install the Purview extension on macOS": wrong. The extension only works on Windows.
Both answer "Chrome is a problem". They do opposite things.
| Pick | When |
|---|---|
| Unallowed browsers | Push users to Edge. The browser cannot open the sensitive file. |
| Purview extension | Keep Chrome or Firefox and enforce inside it |
Unallowed browsers only bites when the policy sets upload to Block or Block with override. The user gets a toast: open it in Edge.
If the extension is installed on a device, it bypasses the Unallowed browsers list there. Microsoft says to remove Chrome from that list when you roll the extension out to all devices.
The list is global. You choose its meaning.
| Mode | Listed site | Site not listed |
|---|---|---|
| Block | Policy applies. Alert. | Audited only. No alert. |
| Allow | Audited only. No alert. | Policy applies. Alert. |
Example. Block mode, dropbox.com listed, policy action Block. Upload to dropbox.com: blocked. Upload to box.com: allowed, audited.
contoso.com matches its subsites, not its subdomains. *.contoso.com matches both.TRAPPaste into a browser does not follow the Service domains list. Use sensitive service domain groups on the rule.
Groups of sites with their own action. Up to 150 groups of 100 sites. Match by URL, IP address or IP range (preview).
| Site action | Edge | Chrome/Firefox + extension |
|---|---|---|
| Upload a sensitive file | Yes | Yes |
| Paste sensitive data | Yes | Yes |
| Print the site | Yes | No |
| Copy data from the site | Yes | No |
| Save the site as local files | Yes | No |
A built-in group, Generative AI websites, is used by DSPM for AI. You cannot edit or delete it.
Each group lets a rule treat some destinations differently from the global action. Actions: Allow, Audit only, Block with override, Block.
| Group | Typical stem | Limits |
|---|---|---|
| Removable USB device groups | "Only our encrypted backup drives" | 20 × 50 |
| Printer groups | "Contracts only on Legal printers" | 20 × 50 |
| Network share groups | "Only this share" | Path prefix, wildcards |
| VPN settings | "Only while on corporate VPN" | Windows only |
| Unallowed Bluetooth apps | "No Bluetooth transfer" | App list |
USB devices are identified by friendly name, USB vendor ID, product ID, serial number, device ID, instance path or hardware ID. VPN: run Get-VpnConnection and use ServerAddress or Name.
| User in scope | Device in scope | Policy applied |
|---|---|---|
| Yes | Yes | Yes |
| Yes | No | No |
| No | Yes | No |
Device scoping does not support Microsoft Entra registered devices. Every onboarded device still receives all endpoint policies, because several users can sign in to one device.
| Action | User can proceed? | Notifications and alerts |
|---|---|---|
| Allow (Devices only) | Yes | None. Audit data only. |
| Audit only | Yes | Can be added |
| Block with override | Yes, with a reason | Yes |
| Block | No | Yes |
You can mix actions in one rule. Example: audit clipboard, block USB.
Business justification in policy tips (global): default options and text box, only default options, or only text box. Up to five custom options.
GAPThe module says "warn". In the portal the action is called Block with override. Exam options use the portal names.
| Configured | Simulation, tips OFF | Simulation, tips ON |
|---|---|---|
| Block | Audit | Block with override |
| Block with override | Audit | Block with override |
| Audit only | Audit | Audit |
| Allow | Allow | Allow |
| Location | What is enforced |
|---|---|
| Devices | The most restrictive action per activity, from all matching policies |
| Exchange, SharePoint, OneDrive | One rule: the highest-priority, most restrictive |
Tie-breakers on devices:
| Need | Tool |
|---|---|
| All device activity, last 30 days | Activity explorer |
| Older than 30 days | Audit search (Standard: 180 days) |
| Work alerts | DLP Alerts dashboard, or Defender XDR incidents |
| Which device and file | Alert Events tab: hostname, IP address, file path, SHA-1/256 |
TRAPEmail recipients, site URL and file created are not device event fields.
JIT pauses the egress action. It classifies the file. Then it applies the verdict.
A JIT candidate is a file that was never evaluated, or whose classification is stale because a policy changed.
| Item | Value |
|---|---|
| Anti-malware client | 4.18.23080 or later. Better experience from 4.18.25080. |
| Platforms | Windows 10, Windows 11, three latest macOS |
| Where | Settings › Data Loss Prevention › Just-in-time protection |
| Locations | Devices |
| First fallback | Allow users to complete actions |
| Change takes | Up to an hour to reach devices |
Check a device: DLP Diagnostics › Endpoint DLP not working, or an Advanced hunting query on DeviceRegistryEvents.
TRAP4.18.2110 is for Endpoint DLP. 4.18.23080 is for JIT. Read the number in the stem.
JIT blocks only when all of these are true:
Otherwise JIT only audits. A JIT event shows JIT triggered = true in Activity explorer. It creates no DLPRuleMatch event and no alert.
| Activity | If evaluation is fast |
|---|---|
| Copy to USB, copy to network share | Resumes automatically (within 3 s) |
| Print, RDP, Bluetooth, clipboard | User must retry |
After 5 seconds the user sees "Just-in-time in progress". JIT waits 30 more seconds. Then the fallback action applies.
| Fallback | When classification fails |
|---|---|
| Allow users to complete actions | The action goes through |
| Block users from completing actions | The action is blocked |
TRAPFallback does not turn JIT Block on or off. Scope does that. Fallback only covers failures.
| Where | Effect |
|---|---|
| JIT settings › File path exclusions | No JIT for that path. DLP still classifies and protects. |
| Endpoint settings › File path exclusions for Windows | No DLP at all for that path |
| JIT › App exclusions (50 Windows, 50 Mac) | No JIT for that app, everywhere |
Rollout maths: N devices with JIT events ÷ S devices in scope = share of devices that may see a JIT block.
| If the stem says | Answer |
|---|---|
| Restrict rename or create | No. Audit only. |
| Already in Defender for Endpoint | Turn on device monitoring |
| 100 devices | Intune, Group Policy, Configuration Manager. Not local script. |
| Device prerequisite | Anti-malware client 4.18.2110+. Entra joined/registered. |
| Onboarding role, least privilege | Compliance Administrator (Entra) |
| Server silent | Endpoint DLP support for onboarded servers |
| USB in VDI | Copy to network share |
| EDM or classifier on devices | Advanced classification |
| Data with no policy | Always audit file activity for devices |
| Endless OneDrive toasts | Restricted apps + Auto-quarantine |
| Chrome to Dropbox | Service domains (Block) + Unallowed browsers, or the extension |
| Paste into web forms | Sensitive service domain groups, not Service domains |
| Only these drives or printers | Removable USB device group, printer group |
| Several device policies | Most restrictive per activity |
| JIT prerequisite | Anti-malware client 4.18.23080+ |
| Skip JIT, keep DLP | JIT file path exclusion |
Paste the results in the thread. I grade the misses and build the re-test.
Confidence 0.85. Every key and table cell was checked against Microsoft Learn pages opened on 15 November 2026. It is not higher for three reasons.