Create policy to manage printer access using authorization groups

This scenario demonstrates how to use authorization groups in Microsoft Purview DLP to enforce a default block on sensitive data actions while allowing controlled exceptions. In this example, printing of documents classified as legal content is restricted across all devices, except for a defined set of approved legal department printers.

By combining device-level print restrictions with a printer allowlist, this approach enables organizations to protect sensitive information while still supporting legitimate business workflows. It also illustrates how authorization groups can be reused for other scenarios, such as removable storage devices or network shares.

This scenario is for an unrestricted admin creating a full directory policy.

These scenarios require that you already have devices onboarded and reporting into Activity explorer. If you haven't onboarded devices yet, see Get started with Endpoint data loss prevention.

Authorization groups are mostly used as allowlists. You assigned policy actions to the group that are different than the global policy actions. In this scenario, we go through defining a printer group and then configuring a policy with block actions for all print activities except for the printers in the group. These procedures are essentially the same for Removeable storage device groups, and Network share groups.

In this scenario, we define a group of printers that the legal department uses for printing contracts. Printing contracts to any other printers is blocked.

Prerequisites and assumptions

This article uses the process you learned in Design a data loss prevention policy to show you how to create a Microsoft Purview Data Loss Prevention (DLP) policy. Work through these scenarios in your test environment to familiarize yourself with the policy creation UI.

How you deploy a policy is as important policy design. This article shows you how to use the deployment options so that the policy achieves your intent while avoiding costly business disruptions.

This scenario uses the Confidential sensitivity label, so it requires you to create and publish sensitivity labels. To learn more, see:

• Learn about sensitivity labels
• Get started with sensitivity labels
• Create and configure sensitivity labels and their policies

This procedure uses a hypothetical distribution group Human Resources and a distribution group for the security team at Contoso.com.

This procedure uses alerts, see: Get started with the data loss prevention alerts

Policy intent statement and mapping

We, Contoso, want to prevent users from printing sensitive legal content to unauthorized printers while still allowing approved business workflows for the legal department. In this scenario, documents that match the Legal Affairs trainable classifier should be protected from being printed broadly across the organization, but users in Legal must be able to print those documents to a defined set of approved printers.

To achieve this, we will create a policy that applies print restrictions on devices for content classified as legal in nature. Printing will be blocked by default, but an authorization group of approved printers will be configured as an exception and allowed. This enables a strong default-protect posture while supporting legitimate business needs through a controlled allowlist model.

Steps to create policy

Create and use printer groups

1. Sign in to the Microsoft Purview portal > Data loss prevention > Settings (gear in the upper left hand corner) > Data Loss Prevention > Endpoint settings > Printer groups.

2. Select Create printer group and enter a Group a name. In this scenario, we use Legal printers.

3. Select Add printer and provide a name. You can define printers by:

   1. Friendly printer name
   2. USB product ID
   3. USB vendor ID
   4. IP range
   5. Print to file
   6. Universal print deployed on a printer
   7. Corporate printer
   8. Print to local

4. Select Close.

Configure policy printing actions

1. Sign in to the Microsoft Purview portal.

2. Navigate to Data loss prevention > Policies.

3. Select Create policy.

4. Data stored in connected sources.

5. Select the Custom from the Categories then Custom policy template from Regulations.

6. Give your new policy a Name and Description.

7. Accept the default Full directory under Admin units.

8. Scope the location to only the Devices location.

9. Create a rule with the following values:

   1. Add a Condition: Content contains = Trainable classifiers, Legal Affairs
   2. Actions = Audit or restrict activities on devices
   3. Then pick File activities on all apps
   4. The select Apply restrictions to specific activity
   5. Select Print = Block

10. Select Choose different print restrictions

11. Under Printer group restrictions, select Add group and select Legal printers.

12. Set Action = Allow.

    Tip

    The Allow action wil record and audit event to the audit log, but not generate an alert or notification.

13. Select Save and then Next.

14. Accept the default Run the policy in simulation mode value and choose Show policy tips while in simulaiton mode. Choose Next.

15. Review your settings and choose Submit.

16. The new DLP policy appears in the policy list.