Data Protection Issues

How to Monitor or Block OneDrive and SharePoint Uploads to Cloud Apps

Steve K Oct 12, 2026 869 views

Question details

Organizations need a way to monitor activity or completely block users from uploading sensitive files stored in OneDrive and SharePoint to unauthorized third-party cloud services.

How to Monitor or Block OneDrive and SharePoint Uploads to Cloud Apps

Product: OneDrive and SharePoint
Device & OS: not provided
Scenario: Securing enterprise data and preventing data leaks to unapproved third-party cloud storage platforms like Dropbox or Google Drive.
Observed behavior: Administrators require a policy-driven method to identify, track, and restrict sensitive files from being transferred out of the Microsoft 365 ecosystem to external apps.

Before you start

Ensure you have Global Administrator or Compliance Administrator permissions in your Microsoft 365 tenant to access and configure Microsoft Purview and Defender for Cloud Apps.

Solution 1Recommended

Use Microsoft Purview DLP and Defender for Cloud Apps

Configure Data Loss Prevention (DLP) policies to detect sensitive information and utilize Defender to block unauthorized uploads to external cloud services.

By integrating Microsoft Purview Data Loss Prevention with Microsoft Defender for Cloud Apps, administrators can create robust session controls. This allows the organization to monitor user activities in real-time and block the upload of sensitive documents to unsanctioned third-party cloud applications.

Access the Compliance Portal

Create a new DLP policy

Navigate to 'Data loss prevention' in the left menu, select 'Policies', and click the 'Create policy' button.

Select sensitive information types

Choose the industry template or custom sensitive information types (like credit card numbers or internal project data) that you want to monitor or block.

Define the policy locations

Under locations, toggle on 'SharePoint sites' and 'OneDrive accounts' to ensure the policy applies to files stored in these Microsoft cloud services.

Configure protection actions

Create a rule within the policy to 'Restrict access or encrypt the content in Microsoft 365 locations'. To block uploads specifically to third-party apps, ensure integration with Microsoft Defender for Cloud Apps is enabled to enforce session policies that block file uploads to unsanctioned apps.

Use Microsoft Purview DLP and Defender for Cloud Apps

Alert Generation: You can configure incident reports within the DLP rule to send automated email alerts to administrators whenever a user attempts to upload a restricted file.

Free Microsoft Office alternative

Looking for a Secure, Lightweight Office Suite? Try WPS Office

While enterprise data protection policies for SharePoint and OneDrive require Microsoft Purview, managing everyday documents doesn't have to be complicated. WPS Office is a highly compatible, secure, and lightweight alternative to Microsoft Office, offering an intuitive interface for editing Word, Excel, and PowerPoint files without the heavy enterprise overhead.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the quick on-screen instructions to set up the suite on your computer.
3. Open Your Documents: Launch WPS Office and instantly open your existing Microsoft Office files with perfect formatting compatibility.

Fully compatible with Microsoft Office formats including DOCX, XLSX, and PPTX.Secure local saving and built-in document encryption to protect sensitive data.Lightweight installation that runs smoothly on Windows, Mac, and Linux.Free to use with a familiar, easy-to-navigate user interface.

microsoft office alternative - wps office

Frequently Asked Questions

Can I block uploads to specific cloud apps like Google Drive but allow others?

Yes. By using Microsoft Defender for Cloud Apps, you can tag specific third-party applications as 'unsanctioned'. Your policies can then be configured to block uploads specifically to those unsanctioned services while allowing transfers to approved ones.

Does Microsoft Purview DLP require special licensing?

Yes, utilizing advanced DLP policies and integrating with Microsoft Defender for Cloud Apps generally requires a Microsoft 365 E5 license or a specific compliance and security add-on license for your tenant.

Will users be notified if their upload to a third-party app is blocked?

Administrators can enable 'Policy Tips' and email notifications within the DLP rule settings. This informs users in real-time why their upload was blocked, helping educate them on company data protection guidelines.

Microsoft Office Security Issues