Michael Van Horenbeeck
MVP (verified)@mvanhorenbeeck
Michael Van Horenbeeck has not added anything about themself yet.
on Microsoft Purview: Endpoint Data Loss Prevention - Protect sensitive data over FTP and SFTP with Endpoint DLP · 7 days ago
Not sure if MS shared the underpinnings of how this works exactly, but if it looks like any of the other capabilities, my educated guess would be that it looks at network traffic specifically. Under the hood, the MDE-engine is used. If it works similar to blocking activities over SMB/RDP, it would probably look at the network (protocol) layer, rather than just a process name. Would also make a lot more sense to do it that way.