Block restricted apps and unallowed Bluetooth apps from sensitive files with endpoint DLP

Description

Windows and macOS devices are onboarded to Microsoft Purview endpoint DLP. In the endpoint DLP settings, a Restricted apps list (for example personal cloud sync clients, unapproved browsers, file transfer tools) and an Unallowed Bluetooth apps list are defined. A DLP policy turned on for the Devices location applies to content that matches the sensitive information types of CB-M365-DATA-001 and sets these actions to Block:

• Access by restricted apps;
• Copy or move using unallowed Bluetooth app.

Rationale

Cloud DLP stops data shared from Microsoft 365, but once a file is synced or downloaded to a device it can leave through local channels. Restricted apps and Bluetooth are common paths for both careless and deliberate exfiltration, and endpoint DLP is the only Microsoft 365 control that sees them.

Impact

Devices must be onboarded (Intune or Defender for Endpoint onboarding). Users get a block notification when they open a sensitive file with a listed app. Maintain the restricted app list with the workstation team.

Applies when

Requires: Microsoft Purview E5 Compliance, Microsoft Intune

Audit

1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global Reader.
2. Browse to Settings > Data Loss Prevention > Endpoint DLP settings and check that Restricted apps and app groups and Unallowed Bluetooth apps contain entries.
3. Browse to Settings > Device onboarding > Devices and check that managed Windows and macOS devices are onboarded.
4. Browse to Solutions > Data Loss Prevention > Policies, open the policy that covers Devices, and check that it is On and that its rule sets Access by restricted apps and Copy or move using unallowed Bluetooth app to Block.
5. Alternative in Security & Compliance PowerShell: Get-DlpCompliancePolicy | Where-Object { $_.EndpointDlpLocation } | Format-List Name,Mode,EndpointDlpLocation and Get-DlpComplianceRule -Policy <policy> | Format-List Name,EndpointDlpRestrictions.
6. Fail if a list is empty, if no enforced policy covers devices, or if either action is set to audit only.

Remediation

1. Onboard devices to Microsoft Purview (through the Intune or Microsoft Defender for Endpoint onboarding package).
2. Sign in to the Microsoft Purview portal as at least a Compliance Administrator.
3. Browse to Settings > Data Loss Prevention > Endpoint DLP settings, fill Restricted apps and app groups and Unallowed Bluetooth apps.
4. Edit or create a DLP policy with the Devices location, all users and devices; in the rule, under Audit or restrict activities on devices, set Access by restricted apps and Copy or move using unallowed Bluetooth app to Block.
5. Run in simulation, review Activity explorer, then turn the policy on.

Rollback

Set the device actions back to Audit only, or set the policy to simulation.

References

• Learn about endpoint data loss prevention Microsoft, vendor-doc, accessed 2026-10-24
• Configure endpoint DLP settings Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DATA-001 Enforce a DLP policy for sensitive data in Exchange, SharePoint and OneDrive

People and lifecycle