Block Upload to Whatsapp web Using Microsoft Purview DLP Policy

Question

Block Upload to Whatsapp web Using Microsoft Purview DLP Policy

Sheraz Mehmood 0

I want to Block upload to whatsapp web, for which i follow below steps:

I go to settings Data Loss Prevention->Endpoint DLP settings->Browser and domain restrictions to sensitive data->Service Domains (Block)->(*.web.whatsapp.com,web.whatsapp.com) & Sensitive service domain groups(group contain same domains)

After that i created DLP policy

Condition: File Type is: Detects when a file or document is one of the following types. Word processing Spreadsheet Presentation Archive Mail OR Document Size equals or greater than 10KB.

Action: Audit or restrict activities on Devices->Manage Protected files access from unallowed browsers and upload to restricted cloud service domains(Block)->choose different restriction for sensitive service domains(added group in block mode)

After sync completed i open whatsapp web on Edge browser and try to upload file of size 1MB, but policy didn't work and file got uploaded. i just wanted to know where i went wrong that policy didn't trigger.

SIVASANKAR YEDDULA 150 Reputation points Microsoft External Staff Moderator

2026-08-26T10:05:58.56+00:00
Hi @Sheraz Mehmood ,

Welcome to Microsoft Q&A platform and thanks for posting your question.

From your description, the WhatsApp domain has already been added as a blocked service domain and included in a Sensitive Service Domain Group. Therefore, the domain configuration itself appears to be correct.

However, one important point is that Endpoint DLP restrictions for "Upload to a restricted cloud service domain" are enforced only when the file matches the DLP rule conditions. In your current policy, the conditions are based on File Type and Document Size.

To help narrow down the issue, could you please confirm the following:

Is Endpoint DLP deployed and healthy on the test device

Is the device listed under protected devices and reporting successfully in Purview

Does the DLP policy show as successfully synced to the endpoint

Are you seeing any DLP events in Activity Explorer when the upload occurs

Does the same behavior occur with a file that contains a known Sensitive Information Type (for example, a test credit card number or other sensitive data)

If no DLP events are generated during the upload attempt, the issue may be related to policy matching or endpoint enforcement rather than the WhatsApp domain configuration itself.

Please also share:

The browser version used for testing.

Whether the issue occurs only with WhatsApp Web or with other restricted domains as well.

A screenshot of the DLP rule configuration.

This information will help determine whether the issue is related to rule matching, endpoint configuration, or domain restriction enforcement.
SIVASANKAR YEDDULA 150 Reputation points Microsoft External Staff Moderator

2026-08-27T11:41:44.11+00:00

Hi @Sheraz Mehmood ,

I hope the information provided has been helpful. If you have any further questions or need additional assistance, please let us know in the comments, and we will be glad to help. If this answer helps, please consider clicking Accept Answer so that other community members with similar questions can benefit as well.
Sheraz Mehmood 0 Reputation points

2026-08-28T20:43:09.9+00:00
Hi @SIVASANKAR YEDDULA

I hope you’re doing well, Thank you for your response

I have one concern regarding the policy and wanted to clarify its current behavior.

What I’ve observed is:

If a restricted file is located in a OneDrive folder and I try to upload it, the upload is blocked on the first attempt.

However, if the restricted file is located somewhere other than a OneDrive folder, the first upload attempt is successful.

When I try to upload the same restricted file for the second time, it gets blocked.

Could you please help me understand why the behavior is different for files located in OneDrive compared to files located elsewhere, and why the first upload is allowed in the latter case but the second attempt is blocked?
SIVASANKAR YEDDULA 150 Reputation points Microsoft External Staff Moderator

2026-08-31T10:29:10.1466667+00:00
Hi @Sheraz Mehmood ,

Thank you for your observations.

The behavior is expected because Microsoft Purview Endpoint DLP may already know and classify files stored in a OneDrive-synced folder, allowing the policy to block the upload immediately on the first attempt.

For files stored outside OneDrive, Endpoint DLP may need to classify the file during the first upload attempt. Once the file is evaluated, the result is cached, so the second upload attempt is blocked according to the policy.

In summary:

File in OneDrive folder → Already classified → Blocked on first upload.

File outside OneDrive folder → Classified during first upload → First upload may succeed.

Second upload attempt → Classification is cached → Blocked.

To confirm this behavior, please review the corresponding events in Activity Explorer and verify whether the file was evaluated by the DLP policy during the first upload attempt.
SIVASANKAR YEDDULA 150 Reputation points Microsoft External Staff Moderator

2026-09-01T01:53:40.4033333+00:00

Hi @Sheraz Mehmood ,

I hope the information provided has been helpful. If you have any further questions or need additional assistance, please let us know in the comments, and we will be glad to help. If this answer helps, please consider clicking Accept Answer so that other community members with similar questions can benefit as well.

1 answer

Your answer

SIVASANKAR YEDDULA 150 Reputation points Microsoft External Staff Moderator

2026-08-26T10:05:58.56+00:00

Hi @Sheraz Mehmood ,

Welcome to Microsoft Q&A platform and thanks for posting your question.

From your description, the WhatsApp domain has already been added as a blocked service domain and included in a Sensitive Service Domain Group. Therefore, the domain configuration itself appears to be correct.

However, one important point is that Endpoint DLP restrictions for "Upload to a restricted cloud service domain" are enforced only when the file matches the DLP rule conditions. In your current policy, the conditions are based on File Type and Document Size.

To help narrow down the issue, could you please confirm the following:

Is Endpoint DLP deployed and healthy on the test device

Is the device listed under protected devices and reporting successfully in Purview

Does the DLP policy show as successfully synced to the endpoint

Are you seeing any DLP events in Activity Explorer when the upload occurs

Does the same behavior occur with a file that contains a known Sensitive Information Type (for example, a test credit card number or other sensitive data)

If no DLP events are generated during the upload attempt, the issue may be related to policy matching or endpoint enforcement rather than the WhatsApp domain configuration itself.

Please also share:

The browser version used for testing.

Whether the issue occurs only with WhatsApp Web or with other restricted domains as well.

A screenshot of the DLP rule configuration.

This information will help determine whether the issue is related to rule matching, endpoint configuration, or domain restriction enforcement.
SIVASANKAR YEDDULA 150 Reputation points Microsoft External Staff Moderator

2026-08-27T11:41:44.11+00:00

Hi @Sheraz Mehmood ,

I hope the information provided has been helpful. If you have any further questions or need additional assistance, please let us know in the comments, and we will be glad to help. If this answer helps, please consider clicking Accept Answer so that other community members with similar questions can benefit as well.
Sheraz Mehmood 0 Reputation points

2026-08-28T20:43:09.9+00:00

Hi @SIVASANKAR YEDDULA

I hope you’re doing well, Thank you for your response

I have one concern regarding the policy and wanted to clarify its current behavior.

What I’ve observed is:

If a restricted file is located in a OneDrive folder and I try to upload it, the upload is blocked on the first attempt.

However, if the restricted file is located somewhere other than a OneDrive folder, the first upload attempt is successful.

When I try to upload the same restricted file for the second time, it gets blocked.

Could you please help me understand why the behavior is different for files located in OneDrive compared to files located elsewhere, and why the first upload is allowed in the latter case but the second attempt is blocked?
SIVASANKAR YEDDULA 150 Reputation points Microsoft External Staff Moderator

2026-08-31T10:29:10.1466667+00:00

Hi @Sheraz Mehmood ,

Thank you for your observations.

The behavior is expected because Microsoft Purview Endpoint DLP may already know and classify files stored in a OneDrive-synced folder, allowing the policy to block the upload immediately on the first attempt.

For files stored outside OneDrive, Endpoint DLP may need to classify the file during the first upload attempt. Once the file is evaluated, the result is cached, so the second upload attempt is blocked according to the policy.

In summary:

File in OneDrive folder → Already classified → Blocked on first upload.

File outside OneDrive folder → Classified during first upload → First upload may succeed.

Second upload attempt → Classification is cached → Blocked.

To confirm this behavior, please review the corresponding events in Activity Explorer and verify whether the file was evaluated by the DLP policy during the first upload attempt.
SIVASANKAR YEDDULA 150 Reputation points Microsoft External Staff Moderator

2026-09-01T01:53:40.4033333+00:00

Hi @Sheraz Mehmood ,

I hope the information provided has been helpful. If you have any further questions or need additional assistance, please let us know in the comments, and we will be glad to help. If this answer helps, please consider clicking Accept Answer so that other community members with similar questions can benefit as well.

Answer 1

The likely issue is the rule conditions. For upload blocking to a restricted cloud service domain, the documented pattern is to use a rule that detects sensitive content and then apply Audit or restrict activities on devices with Upload to a restricted cloud service domain or access from an unallowed browser. The documented steps use Content contains with a Sensitive info type, not File type or Document size as the trigger.

Check these areas:

Service domains configuration
- In Microsoft Purview portal > Data loss prevention > Settings > Data Loss Prevention > Endpoint settings > Browser and domain restrictions to sensitive data > Service domains:
- Set Service domains to Block.
- Add the WhatsApp Web domain under Add cloud service domain.
- Save the configuration.
Sensitive service domain group
- In the same area, create a Sensitive service domain group.
- Add the domain and select the correct Match type.
- URL matching supports multiple websites and wildcards for subdomains.
Policy scope
- Create or edit the DLP policy so it is scoped only to Devices.
- Set Admin units to Full directory.
Rule design
- On Define policy settings, use Create or customize advanced DLP rules.
- Under Conditions, add Content contains.
- Add a Sensitive info type.
- Under Actions, add Audit or restrict activities on devices.
- Under Service domain and browser activities, choose Upload to a restricted cloud service domain or access from an unallowed browser.
- Set it to Audit only, Block with override, or Block as needed.
- Use + Choose different restrictions for sensitive service domains and add the sensitive service domain group.
Browser support
- Domain restriction enforcement applies to uploads through Microsoft Edge, or Google Chrome / Mozilla Firefox only when the Microsoft Purview browser extension is installed.
- Since testing was done in Edge, that part aligns with supported behavior.
What to change in this case
- Replace the current rule logic based on File Type or Document Size with a rule based on Content contains and a Sensitive info type.
- Then retest the upload in Edge.
Expected behavior
- When the file matches the DLP rule and the upload target is a restricted service domain, the configured action should apply.
- If a browser is configured as unallowed, users are prompted to open the file through Microsoft Edge.

A practical test is to use a file that contains a known sensitive info type covered by the rule, then upload it to WhatsApp Web in Edge after policy sync completes.