Question

Contoso has deployed Endpoint DLP to onboarded Windows devices. Users routinely upload documents to sanctioned corporate cloud services but occasionally paste sensitive files into personal cloud storage sites through the browser. Security wants Endpoint DLP to ALLOW uploads to approved corporate cloud domains while BLOCKING uploads of sensitive content to all other web destinations. Which configuration should you implement?

Accepted Answer

Configure a list of 'Service domains' (sensitive service domains / allowed domains) in Endpoint DLP settings, then create a DLP rule that blocks the 'Upload to a restricted cloud service domain' activity for content matching the sensitive info types.

Answer

Add the corporate cloud domains to the 'Unallowed browsers' list and set the 'Upload to cloud services' action to Block.

Answer

Enable Just-in-time protection so that any file uploaded to an unclassified browser destination is automatically blocked until evaluated.

Answer

Add the corporate cloud domains as exclusions under 'Restricted apps and app groups' and block all browser processes globally.