Use Endpoint data loss prevention

This article provides guidance on using Endpoint Data Loss Prevention (DLP) capabilities within Microsoft Purview to help safeguard sensitive information across organizational devices. It focuses on practical, scenario-based approaches for creating and modifying DLP policies, including auditing, alerting, blocking actions, and enforcing controls on how sensitive data is accessed, shared, or transferred. By addressing common administrative use cases, it helps define how policies can be applied across endpoints and integrated services to monitor and regulate user activity effectively.

By applying these scenarios, administrators can reduce data loss risks, support compliance, and gain better visibility into user activity. This approach helps strengthen data governance and improves the organization’s overall security posture.

Important

These Endpoint DLP scenarios aren't the official procedures for creating and tuning DLP policies. For general situations, see the following topics:

Tip

Get started with Microsoft Security Copilot to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Security Copilot in Microsoft Purview.

Before you begin

SKU and subscription licensing

For information on licensing, see

These scenarios require that you already onboard devices and that they report to Activity explorer. If you didn't onboard devices yet, see Get started with Endpoint data loss prevention.

Important

Before you start, make sure you understand the difference between an unrestricted administrator and an administrative unit restricted administrator. For more information, see Administrative units.

Scenarios

See also