How to Monitor and Block Uploads to Custom Domains in Microsoft Endpoint DLP
Question details
The user is trying to determine if Microsoft Endpoint DLP can effectively monitor and block users from uploading sensitive files to custom domains or arbitrary websites.
- Product
- Microsoft Purview Endpoint DLP
- Device & OS
- not provided
- Scenario
- An IT administrator needs to prevent sensitive data leakage by restricting specific file uploads to unauthorized or custom web domains.
- Observed behavior
- The goal is to enforce data loss prevention policies that detect and block sensitive file uploads to arbitrary websites while allowing approved service domains.
Ensure you have global administrator or compliance administrator rights in the Microsoft Purview compliance portal, and verify that your users' devices and browsers are fully onboarded to Endpoint DLP.
Review Web Protection and Service Domain Configurations
Configure Microsoft Purview Endpoint DLP policies to monitor web browsers and restrict uploads based on sensitive information types and domain settings.
Microsoft Endpoint DLP can monitor and block uploads to custom websites, provided the correct browser extensions are installed and the service domains are properly configured in your data loss prevention policies.
Log in to the Microsoft Purview compliance portal using your administrator credentials.
Go to 'Data loss prevention' in the left navigation pane, select 'Endpoint DLP settings', and then find the 'Browser and domain restrictions to sensitive data' section.
In the 'Service domains' section, specify the custom domains or arbitrary websites where file uploads should be blocked or monitored. Ensure that the 'Block' or 'Audit' action is correctly applied to these domains.
Ensure that your active DLP policies include the target sensitive information types and apply the configured endpoint restrictions to the necessary user groups.
Evaluate Purview DLP for Cloud Applications
If the specific custom-domain scenario is not fully supported by Endpoint DLP alone, utilize Microsoft Defender for Cloud Apps to monitor uploads.
Secure Your Business Documents with WPS Office
If you are dealing with complex Microsoft Office data protection policies and looking for a more streamlined, cost-effective solution, consider WPS Office. It is a highly compatible, lightweight, and free alternative that includes built-in document encryption and security features, making enterprise file management simpler.
- 1. Download the installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the software: Run the downloaded installer and follow the on-screen prompts to complete the setup process.
- 3. Secure your documents: Open your documents in WPS Office and use the 'Encrypt' feature under the 'Protect' tab to password-protect sensitive files before sharing or uploading them.
Frequently Asked Questions
Which browsers are supported by Microsoft Endpoint DLP for blocking uploads?
Microsoft Edge natively supports Endpoint DLP policies. For Google Chrome and Mozilla Firefox, you must deploy the Microsoft Purview extension to effectively monitor and block sensitive file uploads.
Can I block uploads to all websites except for a few approved ones?
Yes. In the Endpoint DLP settings, you can define a list of 'Unallowed browsers' or use the 'Service domains' configuration to block uploads to all unapproved domains while specifically allowing internal or sanctioned websites.
Why are my Endpoint DLP policies not blocking uploads to custom domains?
This typically happens if the user's device is not properly onboarded to Microsoft Purview, the necessary browser extension is missing (for Chrome/Firefox), or the domain URL format in the DLP policy is incorrectly configured.
