Question

Your organization has onboarded 200 Windows 11 devices to Microsoft Purview Endpoint DLP. Security notices that users are copying documents containing credit card numbers to removable USB drives. You must configure an Endpoint DLP rule that blocks copying such files to USB devices but still allows copying to corporate-approved USB drives without any prompt. What should you configure?

Accepted Answer

Set the 'Copy to a USB removable media device' activity to Block, define an allowed 'Removable storage device groups' entry in Endpoint DLP settings, and apply that group as an exclusion in the rule

Answer

Set the 'Copy to a USB removable media device' activity to Block, and add the approved drives to the 'Unallowed USB devices' list

Answer

Set the 'Copy to a USB removable media device' activity to Block, and add the approved drives as 'Printer groups' exclusions in Endpoint DLP settings

Answer

Enable just-in-time protection for all devices and rely on the default policy to allow corporate USB drives