Forum Discussion

The737's avatar
The737
Brass Contributor
Jun 04, 2023

Blocking file uploads to specific URLs

Hi. I am trying to prevent uploading of files (regardless if they're protected or not) to specific websites, like wetransfer.com. Can this be done in Defender for Endpoint or Defender for Cloud Apps?...
microsoft defender for endpoint
miller34mike's avatar
miller34mike
Icon for Microsoft rankMicrosoft
Jun 05, 2023

Hi The737 

 

Your options from an MDE/MDCA perspective would be to either mark it as unsanctioned in MDCA or manually add the website as an Indicator of Compromise within the MDE settings (marking as unsanctioned in MDCA does this for you and includes subdomains) which will allow you to prevent the site from being accessed on your managed endpoints all together.

 

On the endpoint DLP side, which I know you already added it as unallowed service domain but did you scope an Endpoint DLP policy to include blocking service domain uploads after you added it? You could have an Endpoint DLP policy that blocks uploads to that specific domain (would want to create a service domain group) based on file type and/or file extension, which can be matched regardless of the file having a sensitivity label or containing sensitive information types/trainable classifiers. 

Resources