Purview endpoint DLP block file from copy directly from NAS to USB

Question

Purview endpoint DLP block file from copy directly from NAS to USB

Jaden Tang 20

Hi, All

I configured the Endpoint DLP Policy that block DWG file from copying to a external USB, where is a success, However, when I use the same computer and try to copy file directly from NAS location to a USB, it just copied through!

Is there a way we can blocking file copying to USB via nas directly?

Many Thanks!

Jaden

Accepted answer

0 additional answers

Your answer

Answer 1

Venkat Reddy Navari 5,255 Microsoft External Staff Moderator

Hi Jaden Tang This is a known limitation with Endpoint DLP. The DLP agent monitors files on local drives and synced cloud storage (like OneDrive or SharePoint), but it doesn't track files being copied directly from a network share like a NAS. That’s why your DLP policy blocks DWG files from local paths but not from a NAS the agent never sees that file activity.

Unfortunately, copying directly from NAS to USB bypasses Endpoint DLP entirely.

Workarounds you could consider:

Use Defender for Endpoint or Intune to enforce USB device control policies. This way, you can block or limit USB write access regardless of the file source.
Apply sensitivity labels to the files earlier in the flow (before they land on the NAS). You can build DLP rules around those labels to enforce USB restrictions.
There’s also a feature called Network Share Groups in Endpoint DLP settings, which lets you categorize network locations, but it won’t change this behavior DLP still won’t inspect files accessed directly over the network.

Here’s the official doc for reference: Configure Endpoint DLP settings (Microsoft Docs)

Hope this helps. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Jaden Tang 20 Reputation points

2025-08-11T09:55:30.63+00:00

Thanks, Venkat

Most of our company important data are stored on NAS, if this scenario can easily bypass the DLP policy, there will be no point to deploy.
is there any method we can restricted the where the file in Nas can copy to? for example, if we only allow file in Nas copy to C: drive, that can solve the issues. any possible way?

Thanks，

Jaden
Jaden Tang 20 Reputation points

2025-08-11T10:31:42.34+00:00

HI, Venkat Reddy Navari

Thanks for the information, most of our sensitive files are stored on NAS, and we also wish to block file upload to online drive, such as drobox, i tested and it uploaded. if operate file directly on NAS can bypass the DLP policy, then it will be pointless to deploy the solution, is there another way we can consider?

Many thanks!

Jaden
Venkat Reddy Navari 5,255 Reputation points Microsoft External Staff Moderator

2025-08-11T11:32:18.56+00:00
Jaden Tang Thanks for the detailed follow-up, your concerns are completely valid, especially in environments where NAS storage is a central repository for sensitive data.

As mentioned earlier, this behavior is currently a known limitation of Microsoft Purview Endpoint DLP. The DLP agent only monitors file activity on local drives and supported cloud services (e.g., OneDrive, SharePoint). It does not have visibility into file operations conducted directly over the network, such as copying from a NAS to a USB or uploading to cloud storage when files are opened directly from a network share.

Because of this limitation, files accessed directly from a NAS bypass DLP inspection, and actions like copying to USB or uploading to third-party cloud services (e.g., Dropbox) are not blocked by DLP.

Suggested Approaches to Mitigate This:

Use Defender for Endpoint (MDE) or Intune for USB Control Enforce USB write restrictions at the device level, regardless of file source. This adds an effective layer of protection even when DLP doesn’t apply.

Apply Sensitivity Labels Earlier in the File Lifecycle Consider using Microsoft Purview Information Protection to apply sensitivity labels when files are first created or modified ideally before they’re saved to the NAS. These labels can trigger policy enforcement across platforms and help mitigate data exfiltration even outside monitored paths.

Limit Direct NAS Access Where possible, redesign workflows to avoid direct end-user access to NAS shares. For example:

Route access through managed applications or mapped drives via systems under DLP monitoring.

Implement access controls that restrict file movement from NAS shares to USB devices.

Combine with Firewall or Network-Level Controls Explore setting up firewall rules or network ACLs to limit where files from the NAS can be moved. While this isn’t a DLP function, it helps enforce containment based on location.

Reevaluate File Storage Strategy If security is a primary driver, consider gradually moving sensitive content to DLP-aware platforms (e.g., SharePoint Online, OneDrive for Business) where policies can be enforced consistently.

Hope this helps. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Jaden Tang 20 Reputation points

2025-08-11T23:27:38.65+00:00

Thanks, Venkat Reddy Navari

one last question, sorry for the bothering, I tried one function called "Just in time protection" on purview setting->DLP setting, i find once i turn this on, the action of moving from from NAS to USB/Google Drive been blocked, however, it seems override the DLP policy itself, working differently?

do you think DLP+JIT together can somehow solve this issue? of if i map the nas via iSCSI?

Many thanks!
Venkat Reddy Navari 5,255 Reputation points Microsoft External Staff Moderator

2025-08-12T06:54:03.4633333+00:00

Jaden Tang you're right to notice that Just-in-Time (JIT) Protection behaves differently. When enabled, JIT temporarily moves files (even from NAS) into a monitored local path, allowing Endpoint DLP to inspect and enforce policies. That’s why actions like copying to USB or uploading to Google Drive get blocked even though they wouldn’t be without JIT.

So yes, DLP + JIT together can help close this gap for files accessed from NAS.

As for using iSCSI to map NAS that can work too. Since iSCSI volumes appear as local drives, Endpoint DLP can monitor them just like the C: drive. It's a valid workaround if you're open to infrastructure changes.

Share via

Purview endpoint DLP block file from copy directly from NAS to USB

0 additional answers

Your answer