Where cloud DLP ends and endpoint begins
Exchange/SharePoint/Teams DLP watches content moving through Microsoft 365 services. But sensitive data leaves through the device: onto a USB stick, into a personal cloud upload, via the clipboard into a browser, out of a printer. Endpoint DLP puts the policy engine on the endpoint (built into Windows and macOS, no separate agent for onboarded devices) to see and control those egress channels.
The channels it controls
| Channel | Actions available |
|---|---|
| Removable USB / storage | Audit, warn, block copy of labelled/matched content |
| Clipboard to unmanaged app or browser | Audit, warn, block paste |
| Audit, warn, block | |
| Cloud/web upload (browser, restricted service domains) | Audit, warn, block — tightest via the Edge/managed-browser integration |
| Network share / Bluetooth / remote desktop copy | Audit, warn, block |
| Restricted apps & app groups | Deny sensitive-content access to named apps (e.g. consumer sync clients) |
Actions follow the same audit → warn (override) → block ladder as cloud DLP, and match on the same classification (SITs, labels, classifiers).
Onboarding is the prerequisite (and the gap)
A device is in scope only once onboarded — via Intune, Defender for Endpoint, Group Policy or a local script. Two failure modes follow directly:
- Unonboarded / unmanaged devices are invisible. BYOD, contractor laptops and personal machines are exactly where a determined leak routes, and endpoint DLP never sees them. This is the coverage boundary to state plainly, not paper over.
- Browser dependence. The strongest web-upload control leans on the managed browser path; egress through a non-integrated browser is weaker. "We block uploads" is only true for the covered browser.
There is also a real interaction with over-blocking: clamp the endpoint too hard and users reach for the phone camera or a personal device — the leak you can no longer see. Endpoint DLP tightens the managed channel and, by doing so, raises the value of watching the unmanaged one (DSPM/insider risk).
What to watch (proofs)
- Onboarding coverage: the count of onboarded devices vs the managed-device fleet (Purview device onboarding / Defender inventory) — the denominator that bounds every endpoint claim.
- Policy reach:
Get-DlpCompliancePolicyshowing the Endpoint location enabled andGet-DlpComplianceRuleshowing the device conditions/actions — proof the channels are actually governed, not just the cloud ones. - Egress activity: endpoint DLP events in Activity Explorer / audit
(
Search-UnifiedAuditLogfor endpoint DLP operations) — what was warned vs blocked on USB, clipboard, print, upload. - The route-around signal: personal-cloud / unmanaged-browser egress rising as endpoint policy tightens — the cost of over-blocking, measured against the gap.