Hi,i created new test tenant to try Endpoint device DLP, i inboard devices and i created DLP policy for devices , with block action but i its not working . can you help thanks

GuillaumeB i'll tell you what you need to look at. For endpoint dlp to work window defender service needs to be running. If you run just this command MDEClientAnalyzer.cmd (without -t) it will produce the result in web page. There on web page make sure it says defender service is running.Note: you can run defender with any other AV solution your org uses. If defender detects other AV , it will run in passive mode.Microsoft Defender Antivirus compatibility with other security products | Microsoft Learn

DP-IT Just to give more information ,i am able to see all activities in the activity explorer in the compliance center. for example i can see upload to the cloud activity which i block in the policy but nothing happened

DP-IT Hey man, I am having the exact same problem. The events get audited but still no actions taken on the Endpoint aka Windows 10 devices. Did you ever find a solution to this?

GuillaumeB Maybe the files are not actually scanned by a policy?I believe those files that appear in the Activity Explorer are audited because the “Always audit file activity for devices” option is On, in the Data loss prevention -> Endpoint DLP settings, in the Compliance portal.I cant see what is wrong because if they can be audited then they should been scanned and blocked by the dlp polices. My device is Windows 10 Pro and is onboarded be script through the Compliance portal. Anyone, any ideas are appreciated.

Hi, thanks for your reply ; actually Microsoft Support gave me this procedure to execute from my device to troubleshoot. I'm waiting for them to come back to me with their analysis ; the log generated is giving a lot of valuable information.1. Download latest stable version from: https://aka.ms/Betamdeanalyzer2. Extract contents to "C:\MDATP\MDEClientAnalyzerPreview"3. From an elevated CMD prompt, run: "C:\MDATP\MDEClientAnalyzerPreview\MDEClientAnalyzer.cmd -t"4. Specify the maximum number of minutes to collect traces: 6-10 min5. Reproduce the issue.6. When completed, send us "C:\MDATP\MDEClientAnalyzerPreview\MDEClientAnalyzerResult.zip

Endpoint DLP not working as expected | Microsoft Community Hub

DP-IT
Copper Contributor
Feb 28, 2022
DP-IT
Just to give more information ,
i am able to see all activities in the activity explorer in the compliance center. for example i can see upload to the cloud activity which i block in the policy but nothing happened
- AdminAt845
  Copper Contributor
  Jun 06, 2022
  DP-IT
  
  Hey man, I am having the exact same problem. The events get audited but still no actions taken on the Endpoint aka Windows 10 devices. Did you ever find a solution to this?
  - Jordi_Nogues
    Copper Contributor
    Jul 21, 2022
    AdminAt845, DP-IT, @All...
    I'm having the same problem: "events get audited but still no (block) actions taken on the Endpoints". Did you find the solution?
    I've been succesful in a number of previous deployments, and the only differences I can identify here are:
    a- the endpoint is managed from SCCM (no Intune);
    b- device join type is "hybrid azure AD join";
    c- the UPN I use to authenticate to Azure AD doesn't match my email address.
Anshulbeniwal
Copper Contributor
Aug 15, 2022
Microsoft DLP is bit different. After creating the policy for endpoint devices you'll have to go to Microsoft Purview > Data Loss Prevent > Endpoint Settings > Browser and domain restrictions to sensitive data and Set service domain to block.
Also add the domain where you are trying to block the upload on
Assumptions:
1- Device is already onboarded
2- Policy has a action set to block or block with user override for sensitive data
yodaPREDATOR
Copper Contributor
Oct 18, 2022
DP-IT
Hi, I know its been a long time since this thread was active but I am experiencing the same from my endpoint DLP rules, so i thought I ask a question here.
Did you manage to solve the problem back then?
In my scenario the protected files gets audited (I can see that in the Activity Explorer) but they are not blocked as they should.
The device is already onboarded via script.
Any ideas what might be wrong?
JAMES DELORN HOWLAND JR
Copper Contributor
Jan 23, 2023
How do I use a calculated field in access to test if hours is greater than 40 to calculate overtime pay(hours - 40) * (1.5 * payrate), else 0.
Waseemabbasss
Copper Contributor
Aug 20, 2024
DP-IT
Certainly! To troubleshoot Endpoint DLP issues:
Check Policy Configuration:
Verify that the DLP policy is correctly configured for the desired devices.
Review Logs and Alerts:
Examine logs and alerts to identify any specific errors or issues.
Contact Support:
If the problem persists, reach out to technical support for further assistance. 🌟

Forum Discussion

Endpoint DLP not working as expected

Share

Resources