How do you enforce DLP for cloud apps like Office 365 or Google Workspace?

• A. Use cloud DLP connectors, scan data in cloud repositories, enforce policies on data in transit to/from cloud services, and apply encryption or blocking as needed.
• B. Install on-prem DLP agents on every workstation
• C. DLP cannot be enforced in cloud apps
• D. Just rely on user permission settings

Answer: (A)

Enforcing DLP for cloud apps relies on extending DLP controls into the cloud through cloud connectors that integrate with services like Office 365 and Google Workspace. These connectors let the DLP system scan data stored in cloud repositories (such as OneDrive, SharePoint, Google Drive) and apply policies to that data right where it resides. They also enforce policies on data in transit to and from cloud services, meaning actions taken during uploads, downloads, or sharing are checked by DLP and can be blocked or encrypted as needed. This combination provides ongoing protection for data regardless of where it sits or how it moves.

The best approach isn’t to depend solely on on‑prem agents or just user permissions. On‑prem DLP agents won’t reach into cloud repositories or intercept cloud traffic, so they can miss sensitive content stored in the cloud. Relying only on user permissions ignores the content itself and doesn’t prevent policy violations when data is shared or exfiltrated. By applying cloud connectors and monitoring data in cloud repositories plus data in transit, you have actionable enforcement with encryption or blocking as appropriate to stop leaks.