Data Protection Issues

Can Microsoft DLP Prevent Users from Uploading Files to OneDrive?

Huma Ashraf Ch Oct 10, 2026 869 views

Question details

The user wants to know if Microsoft Purview Data Loss Prevention (DLP) policies can be configured to block users from uploading files to OneDrive.

Can Microsoft DLP Prevent Users from Uploading Files to OneDrive?

Product: Microsoft Purview / OneDrive
Device & OS: not provided
Scenario: Administrators are trying to restrict or prevent sensitive data from being uploaded to OneDrive to maintain enterprise data security.
Observed behavior: Microsoft Purview DLP does not provide a direct, built-in method to block all user file uploads to OneDrive.

Before you start

Verify your Microsoft 365 licensing tier, as deploying advanced cloud application controls and policies typically requires Microsoft Defender for Cloud Apps (included in E5 or available as a standalone add-on).

Solution 1Recommended

Use Microsoft Defender for Cloud Apps to Control Uploads

Since native Microsoft Purview DLP policies cannot directly block OneDrive uploads, you should use Microsoft Defender for Cloud Apps to enforce session and data protection policies.

Microsoft Defender for Cloud Apps acts as a Cloud Access Security Broker (CASB) and provides deeper integration with cloud environments. It allows administrators to create session policies that monitor, block, or control file uploads to OneDrive based on user groups, device compliance, and file sensitivity.

Access Microsoft 365 Defender

Navigate to Cloud Apps

In the left-hand navigation pane, locate the 'Cloud Apps' section and click on 'Policies' to access the policy management center.

Create a Session Policy

Click 'Create policy' and select 'Session policy'. Under the session control type, choose 'Control file download (with inspection)' or configure custom conditions to monitor and block uploads.

Configure App and User Filters

Set the app filter to 'Microsoft OneDrive' and apply specific user group filters or device conditions (like unmanaged devices) to target the restriction accurately.

Deploy the Policy

Set the action to 'Block' for non-compliant uploads, configure custom block messages for end-users, and click 'Create' to enforce the policy across the organization.

Use Microsoft Defender for Cloud Apps to Control Uploads

Consult Microsoft Support: For complex, environment-specific configurations or hybrid setups, it is highly recommended to consult the Microsoft 365 Defender Community or contact Microsoft Support directly.

Free Microsoft Office alternative

Secure Your Daily Productivity with WPS Office

While resolving enterprise-grade data loss prevention requires complex backend policies, equipping your team with a reliable, safe, and cost-effective daily office suite is much simpler. WPS Office is a robust, lightweight alternative to Microsoft Office that provides excellent format compatibility and built-in local document security.

1. Download the Installer: Visit the official WPS Office website and click the free download button.
2. Install the Software: Run the downloaded executable file and follow the simple on-screen instructions to complete the installation.
3. Start Working Securely: Open WPS Office to instantly view, edit, and encrypt your important documents without the heavy overhead of complex enterprise suites.

Highly compatible with Microsoft Office formats, including docx, xlsx, and pptx.Built-in document encryption and password protection to safeguard local files.Lightweight installation ensures smooth performance even on older hardware.Free to use, significantly reducing software licensing costs.

microsoft office alternative - wps office

Frequently Asked Questions

Can Endpoint DLP prevent files from being copied to the OneDrive sync folder?

Yes, Microsoft Endpoint DLP can be configured to monitor and block users from copying sensitive files into local cloud sync folders, including the local OneDrive directory on Windows devices.

Does Microsoft Purview DLP scan files already stored in OneDrive?

Yes. While it may not prevent the initial upload directly, Purview DLP actively scans files residing in OneDrive and SharePoint. It can automatically block external sharing or restrict access if sensitive information types are detected.

Can I block OneDrive uploads for only a specific group of users?

Yes, by utilizing Microsoft Defender for Cloud Apps in conjunction with Azure Active Directory (Entra ID) Conditional Access, you can scope upload restriction policies to specific user groups, leaving other users unaffected.

Microsoft Office Security Issues