Endpoint DLP still shows disabled even after onboarding the device in MDE

Bree 5

I've seen somewhere that onboarding the device in MDE won't be requiring to onboard the device to Purview portal for DLP to work but below image shows that my Endpoint DLP Status is disabled. Take note that these machines are non-domain joined.

User's image

In the GPO, below is the configured setting

User's image

What am I missing? :(

Chandra Boorla 3,230 Reputation points Microsoft Vendor

2024-09-27T06:10:31.36+00:00

Hi @Bree

Just checking in to see if the below answer provided by @ Crystal-MSFT helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Chandra Boorla 3,230 Reputation points Microsoft Vendor

2024-10-11T13:49:12.6533333+00:00

Hi @Bree

Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thank you.

1 answer

Crystal-MSFT 49,436 Reputation points Microsoft Vendor

2024-09-26T02:08:08.48+00:00
@Bree, Thanks for posting in Q&A. To enable Endpoint DLP, based on my researching, we need to make sure the followings are in place:

Make sure you have one of these subscriptions or add-ons in this link.

Make sure the device is Windows 10, 1809 and later, Windows 11 https://learn.microsoft.com/en-us/purview/dlp-configure-endpoint-settings#endpoint-dlp-windows-1011-and-macos-settings

Make sure all the steps in this link we have followed to enable Endpoint DLP https://petervanderwoude.nl/post/getting-started-with-endpoint-data-loss-prevention/ Note: Non-Microsoft link, just for the reference.

However, if it still not working, please contact Microsoft Purview support to help on this issue.

https://info.microsoft.com/ww-landing-microsoft-purview-contact-me.html?culture=en-us&country=us

Thanks for your understanding.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Chandra Boorla 3,230 Reputation points Microsoft Vendor

2024-09-30T15:15:24.81+00:00

Hi @Bree

Just checking in to see if the above answer provided by @ Crystal-MSFT helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Bree 5 Reputation points

2024-10-01T12:18:31.86+00:00

Hi @Crystal-MSFT please give until Thursday to check. Thanks for the understanding

Chandra Boorla 3,230 Reputation points Microsoft Vendor

2024-10-01T18:44:30.74+00:00

Hi @Bree

Thanks for confirming! Looking forward to hearing back from you.

Bree 5 Reputation points

2024-10-02T15:12:31.0833333+00:00

@Chandra Boorla Hello! The suggestion seems to work and some DLP settings are now working as expected but I'm currently encountering some challenges in blocking upload to a service domain (*.pcloud.com) via Edge Browser.

I'm using the policy below and it shows as "synced" in my device but I'm still able to upload a file with sensitivity label.

Below link suggests that upload to service domain created from sensitive group can be blocked that doesn't seem to work

https://learn.microsoft.com/en-us/purview/dlp-configure-endpoint-settings

Chandra Boorla 3,230 Reputation points Microsoft Vendor

2024-10-05T03:05:49.1466667+00:00

Hi @Bree

Thank you for your update. It's great to hear that some of the DLP settings are now working as expected.

Regarding the current challenge you're facing with blocking uploads to a specific service domain (*.pcloud.com) via Edge Browser, let's delve into the details and possible solutions.

Steps to ensure blocking uploads to Service Domain:

Review Policy Configuration: Ensure that the policy you’ve configured includes rules for the specific service domain (*.pcloud.com). Double-check that the rule is correctly targeting the Edge Browser and includes the necessary conditions (e.g., file sensitivity labels).

Policy Sync Verification: Confirm that the policy is showing as "synced" on the device. You mentioned this is already done, but it’s crucial to ensure there are no sync issues. Re-sync policies manually if needed to make sure all changes are reflected.

Service Domain Configuration: Verify that the service domain (*.pcloud.com) is correctly specified in the policy settings. Ensure that the service domain is not whitelisted or excluded from the DLP policies inadvertently.

Browser Compatibility: Confirm that the policy supports the Edge Browser version installed on the device. Endpoint DLP policies should be compatible with the Microsoft Edge versions listed in the official documentation. Test the policy on different versions of Edge if possible, to rule out browser-specific issues.

Testing and Logs: Perform a detailed test by attempting to upload a file with a sensitivity label to *.pcloud.com and capture the logs. Review the logs for any errors or indications of why the policy might not be enforced.

Policy Priority and Conflicts: Ensure that there are no conflicting policies that might override the blocking rule. Policy priority can sometimes affect how rules are enforced.

For more details, please refer: Configure endpoint data loss prevention settings

I hope this information helps, please do let us know if you have any further queries.

Thank you.

Bree 5 Reputation points

2024-10-05T06:25:25.67+00:00

Hi @Chandra Boorla I have clicked the "Accept Answer" cause it helps me resolve the issue. For Edge, it is working now as well and I just realized that I need to wait almost a day for the policy to be completely deployed.

Another issue from my end is the time showing up in %%BlockedMessageInfo%% token when I enable the user notification in the policy cause it is showing as UTC. How can I change it? In my account, my timezone shows the correct one which is UTC+8

I'm sending this at around 10pm my time.

Chandra Boorla 3,230 Reputation points Microsoft Vendor

2024-10-09T12:21:05.9533333+00:00

Hi @Bree

Apologies for the delay in response.

The %%BlockedMessageInfo%% token pulls information directly from the system logs, which are standardized in UTC to ensure consistency across all users and regions. Microsoft has chosen this approach to ensure that there's no ambiguity in the timestamps and that they can be easily interpreted by users in different time zones.

Currently, Microsoft Purview does not provide a built-in feature to change the timezone of the timestamps displayed in the %%BlockedMessageInfo%% token directly from UTC to your local timezone (UTC+8). The timestamps in these tokens are standardized to UTC for consistency.

I hope this information helps.

Thank you.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Endpoint DLP still shows disabled even after onboarding the device in MDE

1 answer

Your answer