Blocking file uploads to all sites, unless safelisted

[DanSec]

We're trying to verify if we can block file uploads through the browser to all sites, unless these sites are part of an approved list or the user has an exception. We currently have a similar solution through a different vendor, but wanted to see if Defender for Endpoint is an alternative.

So, if someone creates a new site, this site would not be allowed to be uploaded to unless the domain is added to an approved list. The alternative would be to block if the file has a specific label. 

Thanks, 

[#2]

Thanks. Looking forward to your response.

[#3]

@miller34mike, it WORKED. It finally WORKED. Thanks a mill for your help. 

[#4]

@The737 

Happy to hear it is working for you! Glad I could help. Just finished building the policy too, will still give it a test. Thanks for running through all of this with me!

Btw, if you block Chrome or Firefox from handling sensitive data (endpoint DLP settings) the Microsoft Purview Extension will override that block BUT specific blocks like this should still work.