Microsoft Purview | Data Loss Prevention – Block external domain or user access for SharePoint and OneDrive

Updated July 14, 2026: We have updated the timeline. Thank you for your patience.  What and Why: Microsoft Purview Data Loss Prevention (DLP) is adding the ability to block access to sensitive SharePoint Online and OneDrive for Business files based on an external user’s domain or specific email address (SMTP). This enhancement provides more granular, enterprise-ready control over external access and helps reduce the risk of unintended data exposure when collaborating outside your organization. This message is associated with Microsoft 365 Roadmap ID 557191. Rollout Schedule: Public Preview: We will begin rolling out in late May 2026 and expect to complete by early June 2026. General Availability (Worldwide): We will begin rolling out in mid-July 2026 (previously early July) and expect to complete by end of July 2026 (previously mid-July). Impact on Your Organization: Who is affected: Microsoft 365 administrators who manage Microsoft Purview DLP policies and external users accessing SharePoint Online or OneDrive for Business content protected by DLP. Platforms/Services: Microsoft Purview SharePoint Online OneDrive for Business What will happen: Admins can configure DLP rules to block access for specific external domains or individual external email addresses. External users who are blocked will:See an access denied message Be unable to open or download the file Admins can optionally configure allow lists for trusted external domains or users. If a domain or user appears in both allow and block lists, block takes precedence. This capability is not enabled by default; it applies only when configured in a DLP policy. Configuration steps: Go to the Microsoft Purview portal. Navigate to Data Loss Prevention → Policies. Create a new policy or edit an existing policy. Ensure the policy scope includes SharePoint Online, OneDrive for Business, or both. In the policy rule, after configuring conditions, go to the Actions section. Select Restrict access or encrypt content. Choose Block access to specific domains or users. Configure one or more of the following:Domains to block (Is), for example partner.com Specific external users (Is), for example [email protected] Optionally configure allow lists using Is NOT for domains or users. Save the rule. Action Required / Recommendations: Review existing DLP policies to identify scenarios where external access requires more granular control. Identify sensitive or regulated data shared with external users that may need domain- or user-based restrictions. Plan communications for internal users, helpdesk staff, and external partners who may experience new access restrictions. Update internal documentation related to DLP and external sharing as appropriate. Learn more: Data Loss Prevention policy reference | Microsoft Learn Compliance considerations: Area Explanation Processing and access to existing customer data DLP enforcement can block external users from opening or downloading existing SharePoint Online and OneDrive for Business files based on domain or email address. Data Loss Prevention (DLP) policies or enforcement This change introduces new rule actions and conditions within Microsoft Purview DLP for controlling external access. Admin controls The feature is fully controlled by admins through Microsoft Purview DLP policies.