Hi All,
I have onboarded a couple of devices as a test into MS Defender for endpoint and we already have Microsoft Defender for Endpoint Plan 2 enabled in our tenant as part of our A5 License.
I have created a DLP policy to stop copying files with a certain label to a removable storage device/printing but it's not working as expected.
I can see the activity under the activity explorer and it's matching my rule but it's coming as auditing not blocking but I have set the rule to block.
any advise please ? I have been on this for some time now. Thank you. 
