Question

Your organization has onboarded Windows 11 devices to Purview Endpoint DLP. The compliance team wants to prevent users from copying files that contain credit card numbers to unmanaged network file shares, while still allowing copies to a specific approved corporate share (\corp-fs01\secure). Copies to the approved share should be permitted without any user prompt. What is the correct way to configure the Endpoint DLP rule to meet these requirements?

Accepted Answer

Configure the 'Copy to a network share' activity to Block (without user override), and add \corp-fs01\secure as an excluded network share path group in Endpoint DLP settings.

Answer

Add \corp-fs01\secure to the list of unallowed network share paths and set the 'Copy to a network share' action to Block.

Answer

Set the 'Copy to a network share' activity to Audit only and rely on Adaptive Protection to block risky users automatically.

Answer

Create a sensitivity label that encrypts the files and publish it so only \corp-fs01\secure can decrypt them.