Skip to main content
Microsoft Purview Endpoint DLP

Stop sensitive data walking out through USB, personal email, cloud uploads and print.

Endpoint DLP watches what users actually do with sensitive files on Windows and macOS laptops: copying to a USB stick, uploading to a personal cloud account, pasting into a personal webmail tab, printing, moving to a network share. It audits first, blocks second, and it is already included in the Microsoft 365 E5 family that many Indian organizations own without ever switching it on. We deploy it, tune it for Indian data patterns like Aadhaar and PAN, and run it, remotely from Hyderabad for clients across India.

Book a DLP design sessionSee what it watches
Microsoft
Microsoft
Purview
Cloud Solution Partner
  • USB to cloudEvery endpoint egress path watched
  • Aadhaar, PANIndian data types detected natively
  • Audit firstVisibility before any blocking
  • No new agentRides on Defender onboarding
What Endpoint DLP watches

Every path data uses to leave a laptop, monitored from one policy engine.

Data loss prevention at the network edge misses the laptop at home. DLP in email misses the USB stick. Endpoint DLP sits on the device itself, where the copy, print, paste or upload actually happens, and it sees all of these paths with a single policy set.

Copy to USB and removable media

The classic exfiltration path. Endpoint DLP can audit, warn on, or block copying sensitive files to removable storage, and the incident record it captures is forensic grade: file name, hash, the sensitive info types found inside, the application used, and the make, model and serial number of the specific USB device. That level of evidence turns a suspicion into a conclusive investigation.

Uploads to unsanctioned cloud services

Personal Google Drive, Dropbox, WeTransfer, file-sharing sites: uploads from the browser to service domains you have not sanctioned can be audited or blocked based on allowed and blocked domain lists. Uploads attempted from an unsupported browser are redirected to Microsoft Edge, where the policy can actually evaluate the file before it leaves.

Clipboard and paste into webmail

Copying customer records out of an Excel sheet and pasting them into a personal Gmail tab never creates a file, so file-based controls miss it entirely. Endpoint DLP monitors copy to clipboard and paste into browsers as distinct activities, evaluating the pasted content itself, which closes the most casual and most common leak path in any office.

Print

A printed customer list is invisible to every digital control after the print job completes, which is exactly why departing employees like it. Print is a monitored, restrictable activity: sensitive documents can require a recorded business justification before printing, or be blocked outright for the highest-sensitivity classifications.

Network shares, Bluetooth and remote desktop

Copying to network shares, transferring files through unallowed Bluetooth apps, and moving data over RDP sessions are all monitored activities. For organizations where contractors and vendors reach systems through remote desktop, the RDP path is often the one nobody had thought to watch.

Restricted applications

Applications you designate as restricted, unsanctioned sync clients, unauthorised archiving or messaging tools, can be prevented from accessing sensitive files at all. This is how you stop a personal cloud sync agent quietly mirroring a folder of contracts without banning the software from the machine entirely.

Content-aware, not just port-aware

This is the difference from blanket USB blocking. Endpoint DLP reads the content: a file containing Aadhaar numbers is treated differently from a holiday photo, even on the same USB stick. Files are scanned for sensitive information types and sensitivity labels when created or modified, so the classification is already known the moment someone tries to move the file.

Visibility before enforcement

From the moment devices are onboarded, audited activity flows into Activity Explorer even before any policy exists. You see which egress paths your people actually use, which departments touch sensitive data most, and where the real risk sits, all before a single user is blocked from anything. That free visibility period is where good policy design comes from.

Built for Indian data

Aadhaar, PAN, GSTIN and bank account patterns, detected out of the box or built to order.

A DLP deployment tuned for generic Western data patterns misses the data Indian regulators actually care about. Purview ships with sensitive information types for Indian identifiers and lets us build custom ones for everything else your business handles.

  • Aadhaar numbers are detected by a built-in sensitive information type that validates the checksum, not just the 12-digit shape, which is what keeps false positives on invoice numbers and mobile numbers under control.
  • PAN detection uses the structured 10-character format with keyword corroboration, so a policy can treat a spreadsheet of PANs as the regulated dataset it is.
  • GSTIN, Indian bank account numbers, IFSC-coded payment records, CIF numbers, policy numbers and employee IDs are covered through custom sensitive information types we build with regex, checksums and keyword evidence.
  • Trainable classifiers go beyond patterns: they learn to recognise whole document categories, loan applications, KYC packets, medical records, source code, from samples of your real documents, catching sensitive content that contains no matchable number at all.
  • Sensitivity labels applied through the wider Purview deployment become policy conditions too, so a document labelled Confidential is protected on the endpoint even if no pattern inside it matches.
Ask about your data patterns
Why GR IT for Endpoint DLP

Four things that decide whether endpoint DLP survives contact with users.

Enabling Endpoint DLP takes an afternoon. Making it stick, tuned for your data, accepted by your users, producing evidence your auditors respect, is the actual work.

We watch before we block

Every deployment starts with an audit-only period using the free visibility Activity Explorer provides from day one. We learn which egress paths your people actually use before any rule blocks anything, so the policy set reflects your business rather than a template.

Indian data patterns, tuned properly

Built-in Aadhaar and PAN detection plus custom sensitive information types for GSTIN, bank accounts and your own identifiers, tuned with corroborating evidence so false positives stay low enough that alerts still get read.

No new agent to deploy

Endpoint DLP rides on the Defender infrastructure built into Windows. Devices already onboarded to Defender for Endpoint appear in Purview automatically and need only monitoring switched on. No third-party DLP agent to buy, deploy, patch and troubleshoot.

Remote-first from Hyderabad

Purview is a cloud console; deployment, tuning and operations run remotely from our Gachibowli team for clients across India. Managed clients get a 30 minutes response SLA, and every engagement is delivered by the same engineers who run our wider Purview practice.

Who needs this

Six Indian situations where Endpoint DLP is the right control.

The common thread: data that is legitimately on an employee laptop and only becomes a problem when it moves somewhere it should not. That is precisely the gap between network controls and cloud controls.

BFSI under RBI and SEBI oversight

Banks, NBFCs, insurers and brokers face explicit regulatory expectations around data leakage controls. Endpoint DLP gives content-aware control over customer financial data on every laptop, with the incident evidence RBI and SEBI supervision teams expect to see.

Pharma and R&D protecting IP

Formulations, trial data, regulatory dossiers and process documentation are the crown jewels of Indian pharma. Trainable classifiers recognise these document categories even when no pattern matches, and departing-scientist scenarios are exactly what the Insider Risk integration was built for.

GCCs handling parent-company data

Global capability centres process customer and financial data belonging to overseas parents, under contractual controls the parent audits. Endpoint DLP gives the India entity demonstrable, reportable control over that data on local endpoints, which is increasingly a condition of the work itself.

DPDP Act personal-data processors

Any organization processing digital personal data at scale carries accountability obligations under the DPDP Act 2023. Content-aware endpoint controls over Aadhaar, PAN and customer records are among the clearest technical measures you can point to when demonstrating reasonable safeguards.

IT services and BPO under client audit

Client contracts in IT services and BPO routinely mandate DLP on delivery endpoints. Purview Endpoint DLP satisfies that requirement with tooling most delivery organizations already license, and Activity Explorer produces the per-engagement evidence client auditors ask for.

Healthcare handling patient records

Hospitals, diagnostics chains and health-tech companies hold health data the DPDP Act treats as personal data with real breach consequences. Clinicians need to print and move files, so blanket blocking fails; content-aware warn rules with recorded justification give a control clinical staff can actually work with.

Three positions

Purview Endpoint DLP vs third-party DLP agents vs blanket USB blocking.

Most Indian organizations sit in the middle or right columns today: either a separate DLP product bought years ago and half-deployed, or USB ports disabled and every other egress path wide open.
Feature
Purview Endpoint DLP
Built into Microsoft 365
Third-party DLP agent
Separate product
USB blocked, nothing else
Port-level control
Additional agent to deploy and maintain
No, rides on DefenderYes, on every deviceNo
Content-aware decisions (Aadhaar, PAN, labels)
YesYes, with separate policy engineNo, blanket only
Cloud upload and browser paste control
YesVaries by productNo
Print and clipboard control
YesVaries by productNo
Shares policy engine with email and SharePoint DLP
Yes, one policy setNo, parallel policiesNot applicable
Sensitivity labels as policy conditions
NativeLimited or via connectorNo
Insider risk behavioural scoring
Native integrationSeparate module or productNo
Separate licence purchase
Included in E5-family licensingYes, per endpointNo
Forensic evidence on incidents
File, hash, app, device serialVariesNone
Business disruption
Managed, staged rolloutManaged, second agent overheadHigh wherever USB is legitimate
The monitored activities

What can be audited, and what can actually be blocked.

Auditable means the activity appears in Activity Explorer with full detail. Restrictable means a policy can block it, warn the user, or allow an override with a recorded business justification.
ActivityWindowsmacOSAudit or block
Upload to unsanctioned cloud service domainSupportedSupportedAudit and block
Paste into supported browsersSupportedSupportedAudit and block
Copy to clipboardSupportedSupportedAudit and block
Copy to USB removable mediaSupportedSupportedAudit and block
Copy to a network shareSupportedSupportedAudit and block
PrintSupportedSupportedAudit and block
Transfer via unallowed Bluetooth appSupportedSupportedAudit and block
Copy or move over RDPSupportedNot supportedAudit and block
Access by restricted appsSupportedSupportedAccess prevention
Create or rename an itemSupportedSupportedAudit only
The deployment journey

Discover, classify, pilot, enforce. In that order, never reversed.

A typical estate goes from nothing to enforced policy in 6-10 weeks. Onboarding is fast, especially where Defender for Endpoint is already deployed. Understanding normal behaviour is what takes the time, and it is the step that makes enforcement survivable.
  1. 1

    Discover

    1-2 weeks

    Onboard devices, or confirm they are already onboarded through Defender, switch on device monitoring, and let audited activity flow into Activity Explorer. No policies yet. Output: a real picture of which egress paths your organization actually uses, which is almost never the set anyone predicted.

  2. 2

    Classify

    1-2 weeks

    Confirm the built-in Aadhaar and PAN types fire correctly on your real documents, build custom sensitive information types for GSTIN, account numbers and internal identifiers, and train classifiers on your document categories where patterns are not enough. Bad classification here means bad decisions everywhere downstream.

  3. 3

    Pilot in audit mode

    2-3 weeks

    Policies deployed to a pilot group in audit-only mode. We measure match volumes, hunt false positives, tune thresholds and exceptions, and draft the policy tips users will eventually see. The pilot proves the policy is accurate before a single person is blocked from doing their job.

  4. 4

    Enforce in stages

    2-3 weeks

    Each activity moves independently through warn with business justification, then block where the business agrees there is no legitimate use. Users are told before enforcement starts, not after. Warn mode is often the right permanent state for paths the business genuinely needs, because it records a decision without stopping work.

  5. 5

    Operate

    Continuous

    Alerts triaged, false positives routed to someone who can adjust the rule, exceptions given owners and review dates, monthly tuning, and quarterly reporting that turns Activity Explorer data into evidence for management, auditors and regulators. Managed clients get our 30 minutes response SLA.

Beyond blocking

What the reports show, and what Insider Risk Management adds on top.

Blocking is the visible half of Endpoint DLP. The quieter half is evidence: a continuous, queryable record of how sensitive data moves through your organization, and a behavioural layer that connects individual events into a risk story.

Activity Explorer

The operational view of everything Endpoint DLP sees, filterable by user, device, activity, sensitive info type and date.

  • Every monitored activity with file, user, device and app detail
  • Filter by sensitive info type: show me every Aadhaar-bearing file that moved
  • Egress-path breakdown: USB vs upload vs print vs clipboard
  • Policy-match trend lines that prove whether tuning is working
  • Export for audit evidence and management reporting

Insider Risk Management integration

Endpoint DLP events feed Insider Risk Management, which scores patterns of behaviour rather than single events.

  • Departing-employee playbooks triggered from HR resignation dates
  • Sequence detection: download, rename, archive, then exfiltrate
  • Cumulative exfiltration scoring across days, not per-event alerts
  • Pseudonymised investigation to protect employee privacy until escalation
  • Case workflow with forensic timeline for HR and legal

Evidence for regulators and auditors

The record Endpoint DLP builds is a materially stronger audit answer than a policy document.

  • Demonstrable technical controls over personal data movement for DPDP Act accountability
  • Data movement evidence to support CERT-In incident investigation and reporting
  • Control evidence mapped to RBI and SEBI cyber security expectations
  • Incident records with hashes, device serials and timestamps
  • Quarterly reporting we prepare as part of managed operations
Straight answers

What Indian organizations ask about Endpoint DLP.

Not noticeably on healthy hardware, because of how classification is timed. Files are scanned for sensitive content when they are created or modified, so by the time someone tries to copy or upload a file, the classification already exists and the policy decision is quick. There is no nightly full-disk scanning pattern. During the pilot we watch endpoint performance telemetry alongside policy matches, so if a specific workload shows friction we see it in data before users feel it.

Yes. Windows 10 and 11 are fully supported, and macOS is supported on the three latest released major versions. The activity coverage is close to identical, with a few edge differences, for example RDP-based controls apply to Windows only. Mixed fleets, common in Indian tech companies where developers run Macs and everyone else runs Windows, are managed from the same policy set in the same console.

Endpoint DLP does not support Linux. If you have Linux workstations handling sensitive data, engineering machines with production database access being the usual case, they need compensating controls: device control at the OS level, egress restrictions at the network layer, and tight scoping of what sensitive data can reach those machines at all. We map this honestly during discovery rather than pretending the coverage exists.

The realistic answer: casual and opportunistic leakage, which is the overwhelming majority of data loss, is blocked or recorded. A determined technical insider has options any endpoint control struggles with, photographing a screen being the obvious one. Two design choices narrow the gap: pairing DLP with Defender device control so removable storage is governed at the device level, and feeding events into Insider Risk Management so a pattern of probing attempts surfaces as a risk score even when each individual attempt was blocked or allowed.

Audit mode records the activity and its full detail in Activity Explorer without interfering with the user. Block mode stops the action, with an optional override where the user records a business justification that is logged for review. The discipline that makes deployments succeed is starting everything in audit, tuning until false positives are rare, then promoting activities to warn or block one at a time. Going straight to block on day one is the single most common cause of failed DLP projects.

Through built-in sensitive information types designed for Indian identifiers. Aadhaar detection validates the number format and its checksum rather than matching any 12-digit string, which is what separates a real Aadhaar number from a mobile number or invoice reference. PAN detection uses the structured 10-character alphanumeric format with supporting keyword evidence nearby. Confidence levels are tunable, and during the pilot we validate both against your real documents and adjust the evidence requirements until the false-positive rate is operationally acceptable.

Yes, two ways. Trainable classifiers learn to recognise categories of document, loan files, KYC packets, clinical records, source code, resumes, from samples of your real content, so a document with no matchable number in it is still recognised for what it is. And sensitivity labels applied manually or automatically through the wider Purview deployment act as policy conditions, so anything labelled Confidential is protected on the endpoint regardless of its contents.

Endpoint DLP sits in the E5 licensing family: Microsoft 365 E5 and A5 include it, and organizations on E3 or Business Premium can reach it through the E5 Compliance or information protection add-on paths without moving the whole tenant to E5. The right answer depends on what you already own and what else from the compliance stack you will use. We start every engagement by reading your current licence position and telling you the shortest path, which is sometimes a licence you already have and never switched on.

For a typical estate, 6-10 weeks from start to enforced policy: 1-2 weeks of discovery with monitoring on and no rules, 1-2 weeks of classification work on Indian data types and custom patterns, 2-3 weeks of audit-mode pilot and tuning, then staged enforcement over 2-3 weeks. Where Defender for Endpoint is already deployed the first step shrinks to days, because the devices are already onboarded and only need monitoring enabled. What we do not compress is the audit-mode period; that is where the false positives get found.

The DPDP Act 2023 requires data fiduciaries to implement reasonable security safeguards to prevent personal data breaches, and to be able to account for how personal data is protected. Endpoint DLP is one of the most demonstrable safeguards available: it shows a regulator or auditor exactly which controls govern Aadhaar, PAN and customer records on endpoints, with evidence of enforcement. It is a strong technical control within a DPDP programme, not a compliance programme by itself; governance, notices, consent and retention still need their own work.

USB blocking stops one path and stops it bluntly. It does nothing about uploads to personal cloud services, paste into webmail, print, network shares or Bluetooth transfers, which is where leakage moves the moment USB is closed. And because it is content-blind, it blocks the legitimate USB uses your business has, which is why exceptions accumulate until the control is hollow. Content-aware DLP inverts this: the sensitive file is controlled on every path, and the harmless file is left alone.

It depends on what you are paying for and what is actually deployed. The pattern we see most often in Indian enterprises is a third-party DLP bought years ago, running in monitor-only mode on part of the fleet, with a renewal coming up. If your Microsoft licensing already includes Endpoint DLP, the honest comparison is a control you are paying for twice against one you already own, with no second agent to maintain and one policy engine shared across email, SharePoint, Teams and endpoints. We run the two side by side during a transition, migrate the policy logic deliberately, and retire the old agent only once the Purview policies have proven themselves in audit data.

Policies already synced to a Windows device continue to be enforced while it is offline; a laptop on a flight or at a site with no connectivity is still protected by the last policy it received. Policy updates published while the device was offline apply when it reconnects, and activity recorded offline uploads to Activity Explorer on reconnection. The protection does not depend on a live connection to the cloud at the moment of the copy.
Before you block anything

The pre-enforcement checklist that keeps a rollout out of the support queue.

Endpoint DLP is the security control users notice fastest. A rollout that blocks before anyone has seen what normal looks like produces a support queue, an exception list, and eventually a policy set stuck in audit mode forever. These checks prevent that.

Coverage

  • Which devices are already Defender-onboarded?
    They appear in Purview automatically, no new agent.
  • Are macOS devices in scope?
    The three latest major releases are supported.
  • Is device monitoring switched on?
    Onboarding alone is not enough.
  • Are virtual desktops in use?
    Redirected clipboards, printers and drives need checking.
  • Any Linux endpoints handling sensitive data?
    Not covered; they need a compensating control.

Data and scoping

  • Which sensitive info types matter most?
    Start with two or three, not thirty.
  • Do custom types exist for your identifiers?
    GSTIN, account numbers, CIF, employee IDs.
  • Are both users and devices in policy scope?
    Both must match for enforcement to apply.
  • Are shared and multi-user devices handled?
    A device can carry several users with different policies.
  • Do sensitivity labels feed policy conditions?
    Labels catch what patterns cannot.

User experience

  • Audit, warn, or block per activity?
    Each activity moves independently, not all at once.
  • Are policy tips written in plain language?
    The tip is the entire user experience of this product.
  • Who reviews business justifications?
    Overrides without review become a rubber stamp.
  • Who handles the first false positives?
    There will be some in week one. Plan for them.
  • Have users been told before enforcement?
    Silent blocking generates tickets, not compliance.
Related reading

The pages around this one.

Microsoft Purview

The suite hub: sensitivity labels, retention, eDiscovery, audit and the wider data governance platform Endpoint DLP belongs to.

Learn more

Microsoft 365 Security Audit

Find out where your tenant actually stands, including whether the DLP and compliance features you already license are switched on.

Learn more

Microsoft Security Services India

The full Microsoft security practice: Defender, Sentinel, Entra and the managed operations that keep it all running.

Learn more
References

Official documentation

Next step

Onboard a pilot group and see what your data is already doing.

Audited activity flows into Activity Explorer before any policy exists, so the first useful output costs nothing but time. Almost every organization finds an egress path in that first fortnight of data they had not thought about. Send us a note and we reply within 4 business hours.

Book a DLP design sessionExplore Microsoft Purview

Related Services

Explore more solutions that work great with this service

Microsoft Purview

Data governance and compliance solutions

Learn more

Email Encryption

Purview Message Encryption and sensitivity labels

Learn more

Microsoft Security Services

The Microsoft security stack, delivered by one partner

Learn more

Microsoft 365 Security Audit

Read-only tenant security assessment

Learn more