Share via

DLP Endpoint Policy “Block with override” not enforcing restriction or prompting for justification on cloud uploads (Microsoft Purview)

Nitin Jain 0 Reputation points
2026-04-10T05:54:15.21+00:00

Hi everyone,

We’ve configured a DLP policy for Endpoint in Microsoft Purview with the following setup:

Rule location: Endpoint Condition: Labeled documents Activity (under “Service domain and browser activities”): Upload to restricted cloud service domains Action configured: Block with override Additional setting: “Require business justification” is enabled

Issue: When users attempt to upload a labeled document to an external/restricted cloud service, the upload is successfully completed without any restriction.

There is:

No block enforced No prompt for business justification No option to override

Environment details:

Browsers tested: Microsoft Edge and Google Chrome Microsoft Purview Extension is installed and enabled Behavior is consistent across both browsers

Expected behavior: The upload should either:

Be blocked with an option to override, or Prompt the user to provide business justification before allowing the upload

Actual behavior: The upload proceeds without any DLP enforcement or user prompt.

Ask: Has anyone experienced this behavior or knows if additional configuration is required (e.g., endpoint settings, supported domains, or extension policies) to ensure enforcement and justification prompts work correctly?

Any insights would be greatly appreciated.

Thanks

Microsoft Security | Microsoft Purview
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Smaran Thoomu 35,045 Reputation points Microsoft External Staff Moderator
    2026-04-10T07:05:44.26+00:00

    Hi @Nitin Jain
    Thanks for sharing the details - from what you’ve described, this usually comes down to how Endpoint DLP handles browser-based uploads.

    A couple of things to double-check:

    • Activity coverage: The “upload to restricted cloud service domains” condition only works for supported/sanctioned domains. If the target site isn’t recognized/supported, the policy won’t trigger even if it’s configured.
    • Device onboarding: Make sure the machines are properly onboarded to Defender and showing as healthy. If the device isn’t fully onboarded, Endpoint DLP won’t enforce.
    • Policy scope: Confirm the policy is applied to the correct user/device group and that it’s actually synced to the endpoint (sometimes worth forcing a sync or waiting a bit).
    • Label detection: Ensure the file is actually being detected as labeled at the endpoint level (you can validate via Activity Explorer).

    Also worth noting - for browser scenarios, enforcement can vary depending on how the upload happens (some web apps or upload methods aren’t fully covered yet).

    If everything above checks out and it’s still not triggering, it would help to know:

    • Which exact cloud service/domain you’re testing with
    • Whether you see any events in Activity Explorer at all

    That will help narrow down whether it’s a coverage gap vs. a config issue.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.