Data Loss Prevention - Devices

DaNmAN 201

We are looking into creating DLP policies to protect our data.

I am creating a test policy and one of the options I can see allows us to target devices.

Under the device section it only gives me the option to target users. I cannot see any devices listed.

How do we get the devices to show here?

Do we have to onboard them 1st using one of the methods listed here

https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-configure-endpoints?view=o365-worldwide

1 answer

VipulSparsh-MSFT 16,236 Reputation points Microsoft Employee

2021-06-29T04:11:30.59+00:00

@DaNmAN Thanks for reaching out. Yes you are correct, you will need to board them first using https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-endpoints?view=o365-worldwide

Once added you can monitor Windows 10 devices and detect when sensitive items are used and shared. This gives you the visibility and control you need to ensure that they are used and protected properly, and to help prevent risky behavior that might compromise them.

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.
Please sign in to rate this answer.
DaNmAN 201 Reputation points

2021-06-29T13:56:07.223+00:00

Hi

Thanks for the response.

My question though is why are we asked for users and groups in the devices section?

Does this mean that when a device is onboarded any user that the policy is scoped to will be targeted by the dlp policy on that device?

So lets say we have 2 users log on to an onboarded device. One user is in the scope of the DLP policy and one is not.

The user that is not scoped in the policy will not be affected? Only the user that has been scoped will be affected?

VipulSparsh-MSFT 16,236 Reputation points Microsoft Employee

2021-06-30T05:13:15.12+00:00

@DaNmAN If you target a device, the DLP policy applies to that irrespective of which user logs into that. if will be applied to all users who access that machine. IF you apply the DLP policy to users, the policy stay with users to whichever device they login.

DaNmAN 201 Reputation points

2021-06-30T09:00:55.847+00:00

So how do we target a device within a DLP policy? The device section only allows you to choose users and groups.

The Microsoft documentation for this also states that when targeting devices the options we are given are users or groups.

VipulSparsh-MSFT 16,236 Reputation points Microsoft Employee

2021-07-02T06:15:05.057+00:00

@DaNmAN yeah my bad, any devices onboarded with Defender for endpoint is eligible for DLP policy. And the options are indeed for users and groups.
So if you make a user selection there, only those selected users will be applied with the DLP policy.

JamesTran-MSFT 36,476 Reputation points Microsoft Employee

2021-07-07T23:48:16.41+00:00

@DaNmAN
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Sign in to comment

Share via

Data Loss Prevention - Devices

1 answer