Help prevent sharing of sensitive items with unauthorized cloud apps and services

This scenario demonstrates how to restrict unintentional sharing of sensitive information to unapproved cloud applications and services using Microsoft Purview DLP. By defining sensitive service domains and enforcing controls through supported browsers, organizations can monitor and guide how sensitive data is uploaded or accessed.

When a policy is configured for the Devices location, unsupported browsers are prevented from accessing sensitive content, and users are redirected to Microsoft Edge, where DLP controls can block or restrict actions based on policy conditions. This browser-aware enforcement helps reduce the risk of data exfiltration while maintaining a consistent and guided user experience.

To implement this approach, you define restricted destinations (domains, services, or IPs), specify unsupported browsers, and configure DLP rules that detect sensitive content and apply controls such as Upload to cloud services and Access from unallowed browser.

This configuration enables organizations to audit user behavior, refine policies, and progressively enforce stricter controls as needed, while minimizing disruption to legitimate business activities.

Prerequisites and assumptions

This article uses the process you learned in Design a data loss prevention policy to show you how to create a Microsoft Purview Data Loss Prevention (DLP) policy. Work through these scenarios in your test environment to familiarize yourself with the policy creation UI.

How you deploy a policy is as important policy design. This article shows you how to use the deployment options so that the policy achieves your intent while avoiding costly business disruptions.

This scenario uses the Confidential sensitivity label, so it requires you to create and publish sensitivity labels. To learn more, see:

• Learn about sensitivity labels
• Get started with sensitivity labels
• Create and configure sensitivity labels and their policies

This procedure uses a hypothetical distribution group Human Resources and a distribution group for the security team at Contoso.com.

This procedure uses alerts, see: Get started with the data loss prevention alerts

Policy intent statement and mapping

We, Contoso, want to prevent users from unintentionally sharing sensitive information to unapproved cloud applications and services from endpoint devices. At the same time, we want to ensure users can continue to access and work with non-sensitive data without unnecessary restrictions. To achieve this, we will define a set of restricted cloud service domains and enforce controls when sensitive information is detected in user activity. When users attempt to upload sensitive content to these unapproved services—or access such content through unsupported browsers—we will audit the activity and guide users toward supported, compliant workflows (such as using Microsoft Edge). This approach allows us to gradually enforce controls by first auditing user behavior, understanding risk patterns, and refining the policy before moving to stricter enforcement if needed.

Steps to create policy

1. Sign in to the Microsoft Purview portal > Data loss prevention > Settings (gear icon in the upper left hand corner) > Data Loss Prevention > Endpoint DLP settings > Browser and domain restrictions to sensitive data > Sensitive service domain groups.

2. Select Create sensitive service domain group.

3. Name the group.

4. Enter the Sensitive service domain for the group. You can add multiple websites to a group and use wildcards to cover subdomains. For example, www.contoso.com for just the top level website, or: *.contoso.com for corp.contoso.com, hr.contoso.com, fin.contoso.com.

5. Select the Match type you want. You can select from URL, IP address, IP address range.

6. Select Save.

7. In the left navigation pane, select Data loss prevention > Policies.

8. Data stored in connected sources.

9. Create and scope a policy that is applied only to the Devices location. For more information on how to create a policy, see Create and Deploy data loss prevention policies. Be sure to scope the Admin units to Full directory.

10. On the Define policy settings page, select Create or customize advanced DLP rules and choose Next.

11. Create a rule, as follows:

    1. Under Conditions, select + Add condition and select Content contains from the drop-down menu.
    2. Give the group a name.
    3. Choose Add and then select Sensitive info types.
    4. Select a Sensitive info type from the flyout pane, then choose Add.
    5. Add the action Audit or restrict activities on devices.
    6. Under Service domain and browser activities, choose Upload to a restricted cloud service domain or access from an unallowed browser and set the action to Audit only.
    7. Select + Choose different restrictions for sensitive service domains and then choose Add group.
    8. On the Choose sensitive service domain groups flyout, select the sensitive service domain group(s) you want, choose Add and then choose Save.
    9. Under File activities for all apps, select the user activities you want to monitor or restrict and the actions for DLP to take in response to those activities.
    10. Finish creating the rule and choose Save and then Next.
    11. On the confirmation page, choose Done.
    12. On the Policy mode page, choose Turn it on right away. Choose Next and then Submit.