Microsoft Purview On-Premises DLP vs. Windows Server Endpoint DLP: Architecture, Configuration, and Real-World Use Cases

Microsoft Purview | Data Loss Prevention | Information Protection Scanner | Windows Server | Data Security

Introduction

Many organizations still rely on on-premises file servers to store sensitive business information, including financial records, employee data, customer information, contracts, and intellectual property.

Microsoft Purview provides different technologies to protect this information, but two capabilities are frequently confused:

• Microsoft Purview DLP for On-premises repositories
• Microsoft Purview Endpoint DLP for Windows Server

Although both are part of Microsoft Purview Data Loss Prevention, they address different security requirements.

On-premises repositories DLP uses the Microsoft Purview Information Protection Scanner to discover sensitive files and enforce repository-level protective actions.

Windows Server Endpoint DLP uses device-based policies to monitor and restrict supported activities involving sensitive files on eligible Windows servers.

Understanding this distinction is essential when designing a Microsoft Purview architecture for hybrid environments.

In this article, we compare both technologies, explore their limitations, and demonstrate how they can be configured and combined in real-world deployment scenarios.

1. Understanding the Core Difference

Consider an organization with a Windows Server 2022 file server hosting the following shares:

\\FILESERVER01\Finance
\\FILESERVER01\HR
\\FILESERVER01\Legal
\\FILESERVER01\Customers

The organization wants to achieve two objectives.

Scenario A: Protect sensitive information stored on the file server

The security team wants to:

• Discover documents containing personal information.
• Identify sensitive files stored in inappropriate locations.
• Remove excessive NTFS permissions.
• Quarantine sensitive documents.
• Apply sensitivity labels to supported files.

Recommended solution: Microsoft Purview Information Protection Scanner with On-premises repositories DLP.

Scenario B: Prevent sensitive file activities on the server

The security team wants to monitor or restrict supported operations involving previously classified files, such as copying them to removable storage.

Recommended solution: Microsoft Purview Endpoint DLP for Windows Server, subject to the documented server limitations.

The difference is straightforward:

On-premises DLP protects files in repositories. Endpoint DLP controls supported activities performed on devices.

2. Feature Comparison

These technologies are complementary rather than interchangeable.

3. On-Premises Repositories DLP Architecture

Microsoft Purview On-premises repositories DLP relies on the Microsoft Purview Information Protection Scanner.

The scanner evaluates files in configured repositories and can enforce DLP policies when matching content is detected.

Architecture

Microsoft Purview
       |
       | Sensitivity labels
       | DLP policies
       v
Information Protection Scanner
       |
       | Content scan job
       v
On-premises repositories
       |
       +-- Finance
       +-- HR
       +-- Legal
       |
       v
Content inspection
       |
       +-- Sensitive Information Types
       +-- Sensitivity labels
       +-- File extensions
       +-- Office document properties
       |
       v
DLP enforcement
       |
       +-- Restrict access
       +-- Remove broad permissions
       +-- Inherit parent permissions
       +-- Quarantine files

Supported detection conditions

Microsoft documents four principal detection categories:

1. Sensitive Information Types
2. Sensitivity labels
3. File extensions
4. Custom document properties in Office files

The scanner can identify sensitive information using built-in or custom Sensitive Information Types.

For example, a policy can detect documents containing payment card information, national identifiers, or other configured sensitive data.

4. Four On-Premises DLP Enforcement Actions

Microsoft Purview supports four repository-level protective actions.

Action 1: Block access for everyone except authorized exceptions

The scanner modifies the file’s permissions to restrict access.

Microsoft documents exceptions for specific accounts, including the file owner, repository owner, administrator, and scanner account.

Example: A confidential payroll document is stored in a folder accessible to unauthorized employees.

The DLP policy identifies the document and applies restrictive permissions.

Action 2: Remove broad access permissions

The scanner can remove access entries associated with broad security principals, including:

• Everyone
• Authenticated Users
• Domain Users

Explicitly authorized users and groups can retain access according to the configured permissions.

Example: A financial document contains sensitive customer information and is accessible through the Domain Users group.

The scanner detects the content and removes the broad access entry.

Action 3: Inherit permissions from the parent folder

The scanner can force a file to inherit permissions from its parent folder.

By default, Microsoft applies this action only when the parent permissions are more restrictive than the file’s current permissions.

Example: A confidential document has incorrectly configured permissions.

The parent folder already restricts access to the Finance department.

The DLP policy can restore the more restrictive inherited permissions.

Action 4: Quarantine sensitive files

The scanner can remove a file from an inappropriate location.

When enforced, the original file is replaced with a .txt placeholder and a copy of the original is placed in a configured quarantine folder.

Example: A document containing customer payment information is discovered in a shared repository accessible to a broad internal audience.

The policy quarantines the document for authorized review.

Best practice: Always validate permissions and quarantine actions in a pilot environment before enabling production enforcement.

5. Practical Use Case: Protecting an HR File Server

Consider a company with 5,000 employees.

Its HR department stores 200,000 documents in:

\\FILESERVER01\HR

The documents include employment contracts, salary statements, identity records, and payroll exports.

Some documents have excessive NTFS permissions.

Recommended implementation

Deploy the Microsoft Purview Information Protection Scanner and configure On-premises repositories DLP.

Expected behavior

The scanner evaluates the repository and identifies files matching the configured DLP conditions.

When enforcement is enabled, the scanner applies the selected protective action to matching files.

Security administrators can review results in Activity Explorer and scanner reports.

Important operational consideration

On-premises DLP is scanner-based.

It should not be treated as a real-time file-system interception mechanism.

Files are evaluated during scan cycles, and subsequent scans normally process new or modified files unless a full rescan is initiated.

6. Windows Server Endpoint DLP Architecture

Windows Server Endpoint DLP uses a different deployment model.

The server must be onboarded to Microsoft Defender for Endpoint, and Endpoint DLP must be enabled for Windows servers.

Architecture

Microsoft Defender for Endpoint
             |
             | Server onboarding
             v
Windows Server 2022
             |
             | Endpoint DLP enabled
             v
Microsoft Purview DLP
             |
             | Devices policy
             v
Supported file activities
             |
             +-- USB copy
             +-- Network share copy
             +-- Other supported operations
             |
             v
Audit / Restrict / Block

Supported operating systems

Microsoft documents Endpoint DLP support for Windows Server 2019 and later on eligible x64 installations.

This includes Windows Server 2019, 2022, and 2025.

Windows Server limitations

Why classification limitations matter

Microsoft documents that the supported Windows Server updates disable the classification feature.

This means Endpoint DLP does not newly classify files on the server in that configuration.

However, files classified before those updates can remain protected when the required Defender version is installed.

Architecture recommendation: Use the Information Protection Scanner for repository discovery and classification rather than assuming Windows Server Endpoint DLP can classify all existing files.

7. Practical Use Case: Blocking USB Transfers on Windows Server

A financial organization uses Windows Server 2022 to process confidential documents.

The security team wants to prevent supported USB transfers of previously classified confidential files.

Example DLP policy

Configuration steps

Step 1: Onboard Windows Server

Open the Microsoft Defender portal:

https://security.microsoft.com

Navigate to:

Settings → Endpoints → Device management → Onboarding

Select the appropriate Windows Server operating system.

Download and deploy the supported onboarding package.

Step 2: Enable Windows Server Endpoint DLP

Open:

Navigate to the Endpoint DLP settings and enable Endpoint DLP for Windows Servers.

Step 3: Create a DLP policy

Create a custom DLP policy targeting the Devices location.

Configure the supported activity and restriction.

Step 4: Configure policy scope

Ensure that both the device and the user are included in the policy scope.

Step 5: Test enforcement

Use a previously classified test file whose protection is supported by the server configuration.

Review the results in Activity Explorer.

Important: Onboarding the server to Defender does not automatically activate Endpoint DLP.

8. Network Shares: Which DLP Technology Applies?

This scenario is especially important in hybrid environments.

Consider:

Windows 11 Laptop
        |
        | Opens document
        v
\\FILESERVER01\Finance
        |
        v
Windows Server 2022

An employee opens a confidential file stored on the server.

The employee then attempts to copy the document to a USB drive connected to their Windows 11 laptop.

On-premises repositories DLP

The scanner can evaluate the stored document and apply supported repository-level actions.

Windows Server Endpoint DLP

Server Endpoint DLP controls supported activities occurring on the server.

It should not be assumed to monitor every operation performed on a separate client computer.

Windows 11 Endpoint DLP

Endpoint DLP on the laptop can enforce supported device activities, including relevant operations involving files accessed through network shares.

Microsoft documents network share coverage settings for Endpoint DLP.

When enabled, applicable device-scoped DLP policies can cover network shares and mapped drives connected to the device.

Recommended architecture

Combine repository protection with Endpoint DLP on the devices where users interact with sensitive files.

Use Windows Server Endpoint DLP only where server-side activity restrictions are also required.

9. How to Configure On-Premises Repositories DLP

Step 1: Prepare prerequisites

Verify:

• Eligible Microsoft Purview licensing
• Required administrative permissions
• Supported scanner installation
• Scanner service account
• SQL Server prerequisites
• Repository permissions
• Network connectivity
• At least one published sensitivity label and label policy

Microsoft specifies that users who contribute to or consume content in scanned locations require appropriate licensing, not just the scanner account.

Step 2: Install the Information Protection Scanner

Install the Microsoft Purview Information Protection client and scanner.

Configure the scanner service and authentication.

Ensure that the scanner has the permissions needed to inspect and, when required, modify repository content.

Step 3: Configure a content scan job

Example:

Step 4: Create a DLP policy

In Microsoft Purview:

Data Loss Prevention → Policies → Create policy

Select the On-premises repositories location.

Configure detection conditions and a supported enforcement action.

Step 5: Run a simulation

Start a scan and review matching content.

Check the Activity Explorer results and scanner reports.

Step 6: Enable enforcement

Microsoft requires enforcement to be enabled in two places:

• The DLP policy
• The scanner content scan job

Both must be configured appropriately before protective actions are applied.

Step 7: Run a full rescan when necessary

By default, the scanner performs incremental scans.

If detection rules or enforcement settings change, existing files may need to be evaluated again.

Use the portal’s Rescan all files option or:

Start-Scan -Reset

This initiates a full rescan.

10. How to Configure Windows Server Endpoint DLP

Step 1: Verify server compatibility

Confirm that the server:

• Runs a supported Windows Server version.
• Uses a supported installation type.
• Is not a domain controller.
• Has the required Defender components and updates.

Step 2: Onboard to Defender for Endpoint

Use the supported onboarding process in the Microsoft Defender portal.

Step 3: Enable Endpoint DLP

Activate Endpoint DLP for Windows Servers in Microsoft Purview settings.

Step 4: Create a device-based DLP policy

Select Devices as the DLP location.

Configure a supported condition and activity restriction.

Step 5: Validate user and device scope

Both must be in scope for the policy to apply.

Step 6: Test and monitor

Validate the policy using supported file activities and previously classified files.

Review Activity Explorer and endpoint diagnostics.

11. Troubleshooting Comparison

Scanner reporting

Microsoft documents detailed scanner reports under:

%localappdata%\Microsoft\MSIP\Scanner\Reports

These reports can include:

• DLP mode
• DLP status
• DLP rule name
• DLP actions
• File owner
• Current NTFS permissions
• Applied NTFS permissions

These fields are useful for investigating policy behavior and unexpected permission changes.

12. Recommended Enterprise Architecture

Consider an organization with:

• 10 Windows file servers
• 1 million documents
• 2,000 Windows 11 laptops
• Multiple departments handling confidential information

A layered Microsoft Purview architecture could include three protection levels.

Layer 1: On-premises repository protection

Use the Information Protection Scanner to discover, classify, label, and protect sensitive repository content.

Use On-premises repositories DLP to correct excessive access permissions and quarantine sensitive files where appropriate.

Layer 2: Endpoint protection

Deploy Endpoint DLP on supported Windows workstations to control sensitive file activities.

Evaluate Windows Server Endpoint DLP separately for supported server-side operations.

Layer 3: Microsoft 365 data protection

Deploy DLP policies for supported Microsoft 365 workloads, including Exchange Online, SharePoint Online, OneDrive, and Teams.

Suggested deployment roadmap

13. Which Solution Should You Choose?

Conclusion

Microsoft Purview On-premises repositories DLP and Windows Server Endpoint DLP address different data security challenges.

On-premises repositories DLP focuses on discovering and protecting sensitive information stored in file shares and supported SharePoint Server repositories.

Windows Server Endpoint DLP focuses on controlling supported file activities on eligible Windows servers, with important platform and classification limitations.

For most hybrid organizations, the strongest approach is not choosing one technology over the other.

It is combining repository-level protection, endpoint activity controls, sensitivity labels, and Microsoft 365 DLP according to the actual business risks.

The key architecture question is:

Are you trying to protect where sensitive information is stored, or control what users do with that information?

The answer determines the appropriate Microsoft Purview capability.

Official Microsoft Documentation

1. Learn about DLP for On-premises repositories
2. Get started with DLP for On-premises repositories
3. Use DLP with On-premises repositories
4. Learn about Endpoint DLP
5. Configure Endpoint DLP settings
6. Get started with the Information Protection Scanner
7. Running the Information Protection Scanner