Help protect files that Endpoint Data Loss Prevention fails to scan

This article uses the process you learned in Design a data loss prevention policy to show you how to create a Microsoft Purview Data Loss Prevention (DLP) policy that helps protect files on supported Windows and macOS devices where the scanning process fails. Work through this scenario in your test environment to familiarize yourself with the policy creation UI.

How you deploy a policy is as important policy design. This article shows you how to use the deployment options so that the policy achieves your intent while avoiding costly business disruptions.

Apply controls to supported files that fail scanning

Use this scenario when you want to apply Audit, Block, or Block with override controls on user activities for files that are on the Monitored files list but fail to be scanned by Endpoint DLP.

Prerequisites and assumptions

This scenario requires that you already have devices onboarded and reporting into activity explorer. If you haven't onboarded devices yet, see Get started with Endpoint data loss prevention.

Policy intent statement and mapping

Sometimes scanning fails for files that endpoint DLP supports. There might be sensitive information in those files, but we don't know. When scanning fails for a file on any of our onboarded devices, we want to prevent users from copying that file to a USB device or to a network share.

When you configure the conditions, the summary looks like this:

Configure policy actions

1. Sign in to the Microsoft Purview portal.
2. Open Data Loss Prevention > Policies.
3. Select Create policy.
4. Select Data stored in connected sources.
5. Select the Custom from the Categories then Custom policy template from Regulations.
6. Name your new policy and provide a description.
7. Select Full directory under Admin units.
8. Scope the location to Devices only.
9. Create a rule where:
   1. In Conditions:
      1. Select Document could not be scanned
   2. In Actions:
      1. Select Audit or restrict activities on devices.
      2. Clear Upload to a restriced cloud service domain or access from an unallowed browser
      3. Select Apply restrictions to specific activity
      4. Select Copy to a removable USB device, and Block with override
      5. Select Copy to a network share, and Block with override
      6. Clear Copy to clipboard, Print, Copy or move using unallowed Bluetooth app, and Copy or move using RDP
10. Save.
11. Choose Turn on the policy immediately. Choose Next.
12. Review your settings and choose Submit.