How long it takes after enable device monitoring for a new End Point DLP policy on Microsoft Purview to start working?

Question

Hello,

For Microsoft Purview, device monitoring has been enabled a couple of days ago and 1 DLP policy has been created for 1 End Point. Currently, we can see all the devices on the devices list dasboard. Also, all files activity audits for all the devices on the activity explorer, however the policy isnot applied. The policy currently including only 1 device for testing. Does it take some time for an end point policy to work? The configuration/policy status is showing as 'active'. Device is online. Tried different options for the policy, however those activities are not reported for that device and non of the policy actions are being applied. It has been almost 24 hours since we created the policy. Other policies for locations such as exchange are working fine. The issue with the end point and it is the first policy to be created

Thanks in advance for any suggestions

Answer 1

Hello Bibi2010_E,

Welcome to the MS Q&A platform.

As per the below document, it will take 60 mins for the DLP policy to sync

 

When a DLP policy is created or edited in the Microsoft Purview compliance portal, how long does it take for the updated policy to sync to the device?

Syncing new or updated DLP policies should occur on onboarded devices within 60 minutes.

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/common-questions-on-microsoft-purview-data-loss-prevention-for/ba-p/3732610

Can you please check the policy configuration to ensure it's correct and properly configured for the device you're testing with?

If the issue still persists, please let me know. I will check with my internal team and get back to you.