What does Endpoint DLP cover and when do we need it?

Endpoint DLP extends Purview policy enforcement to managed Windows 10/11 devices, covering actions that cloud-level DLP cannot see: copying sensitive files to USB storage, printing regulated documents, uploading restricted content to personal cloud storage, pasting sensitive data into unauthorized applications, and screen capture of protected content. It requires Microsoft 365 E5or the Microsoft Purview Suite add-on, and devices must be onboarded to Microsoft Defender for Endpoint. If your risk profile includes regulated data on Windows devices — financial records, PHI, legal documents — Endpoint DLP is the control that actually closes that gap.