Data Protection Issues

Prevent Highly Confidential Files from Saving to OneDrive or SharePoint

Chanuka Geekiyanage Oct 13, 2026 870 views

Question details

The user needs to prevent documents labeled as Highly Confidential from being saved to OneDrive or SharePoint via the Office Save As menu without globally blocking cloud saving for all files.

How to Prevent Highly Confidential Files from Saving to OneDrive or SharePoint

Product: Microsoft Word and Excel
Device & OS: not provided
Scenario: Implementing Endpoint DLP and Defender for Cloud Apps to enforce conditional save locations based on document sensitivity labels.
Observed behavior: Users can bypass Endpoint DLP restrictions and save Highly Confidential documents to cloud locations using the native Save As menu in Word and Excel.

Before you start

Ensure you have global administrator or compliance administrator privileges in your Microsoft 365 tenant to review Endpoint DLP and sensitivity label policies.

Solution 1Recommended

Review Current Microsoft DLP Limitations for Office Save As

Understand how Microsoft Office processes sensitivity labels and why the native Save As menu bypasses conditional cloud restrictions.

Currently, Microsoft Office's built-in global policies allow you to disable cloud save locations entirely, but they lack the granularity to disable these paths exclusively for documents with specific sensitivity labels.

Because the 'Save As' menu operates independently of certain Endpoint DLP blocking mechanisms in this specific scenario, files can still bypass label restrictions natively within the Office desktop applications.

Access the Microsoft Purview Compliance Portal

Log in to the Microsoft Purview compliance portal with your admin credentials to review your current Data Loss Prevention policies.

Review Endpoint DLP Policy Scope

Verify that your Endpoint DLP policy is correctly scoped to targeted devices and is actively detecting the 'Highly Confidential' labels.

Audit Blocked Actions

Check the Activity Explorer to confirm that other restricted actions (like copying to USB or uploading via unauthorized browsers) are successfully blocked by your current configuration.

Review Current Microsoft DLP Limitations for Office Save As

Current Limitation: There is currently no direct configuration that completely applies a sensitivity-label condition specifically to selectively hide Office Save As cloud locations.

Solution 2

Consult the Microsoft Tech Community for Advanced Workarounds

Engage with Microsoft Defender experts to report the issue and seek potential backend workarounds for this specific compliance scenario.

Free Microsoft Office alternative

Try WPS Office for Secure and Local Document Management

If Microsoft Office's forced cloud integrations and complex DLP limitations pose challenges for your organization's data protection policies, consider switching to WPS Office. It provides a highly compatible, secure alternative that prioritizes local storage preferences, ensuring you maintain complete control over where sensitive files are saved.

1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
3. Configure Default Save Locations: Open WPS Office, go to Settings, and configure your default save directories to secure, local on-premise servers or encrypted drives.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Defaults to local storage saving, reducing the risk of unintended cloud syncing for highly confidential documents.Lightweight application with a familiar user interface for seamless and secure migration.Free to use with comprehensive offline document processing capabilities.

microsoft office alternative - wps office

Frequently Asked Questions

Why doesn't Endpoint DLP block the 'Save As to OneDrive' option in Word?

Microsoft Office's native 'Save As' menu operates independently of some Endpoint DLP policies, meaning label-based conditions cannot selectively remove cloud storage paths from the application's user interface.

Can I disable OneDrive and SharePoint saving for all files in Office?

Yes, you can use Global Office Group Policies to completely block cloud save locations. However, this applies to all files being edited on that device, not just those with specific sensitivity labels.

Does Defender for Cloud Apps prevent uploading confidential files via web browsers?

Yes, properly configured Defender for Cloud Apps and Endpoint DLP can successfully block users from manually uploading highly confidential files to unauthorized cloud storage services via web browsers.

Microsoft Office Security Issues