Forum Discussion

ALI_hamed17's avatar
ALI_hamed17
Copper Contributor
May 17, 2023

Microsoft Defender for Endpoint policy not working for office documents

I created endpoint DLP policy to block copying data to USB devices , the condition i used is file types and i include all office documents and pdf. the policy is working on pdf but not applied to off...
microsoft 365 compliance center
miller34mike's avatar
miller34mike
Icon for Microsoft rankMicrosoft
May 25, 2023

ALI_hamed17 

 

If you go to activity explorer, do you see the office files showing up as DLP Rule Match or as the "File copied to removeable media" action?

ALI_hamed17's avatar
ALI_hamed17
Copper Contributor
May 29, 2023

miller34mike  Hi 

No it is not showing DLP Rule Match , its showing File copied to removeable media.

 

i attach both events the PDF and DOCX

 

thanks

 

  • Alex_Octav's avatar
    Alex_Octav
    Copper Contributor
    Jun 08, 2023

    ALI_hamed17 I just had a case with MS regarding the same issue. They advised that in order for the policy to trigger, the document must be classified by their classification engine. This engine is triggered by different actions taken on the document (open, close, save, download....) so if you have a file, at rest, on your device this won't be seen by the classification engine. You will be able to copy it on the removable media and if you delete it and try to paste it again, the action will trigger the DLP policy and block the copy operation.

     

    I hope this helps!  

Resources