Endpoint DLP for blocking sensitive file from uploading to site

hi,

I tried to configure Endpoint DLP policy for blocking Graphic files (DWG, SLDPRT, SLDASM) from upload to person drive (Box, Google, dropbox, etc), the MS Defender onboarded on the computer already, And I think I am in the right setting place,

however, I cannot figure out how I can create "Sensitive site group" or "Sensitive Service domains", the menu only allow me to select, but I have to create them somewhere first,

your help is appreciated! many thanks!