Endpoint DLP isn't working as expected

Copper Contributor

Hi All, 


I have onboarded a couple of devices as a test into MS Defender for endpoint and we already have Microsoft Defender for Endpoint Plan 2 enabled in our tenant as part of our A5 License. 


I have created a DLP policy to stop copying files with a certain label to a removable storage device/printing but it's not working as expected. 


I can see the activity under the activity explorer and it's matching my rule but it's coming as auditing not blocking  but I have set the rule to block. 


any advise please ? I have been on this for some time now. Thank you. Policy MatchPolicy MatchDLP-2.png


0 Replies