Microsoft Defender, Printed File

This detection monitors when a subject prints a file from a device protected by Microsoft Defender for Endpoint. By generating an alert on file print events, investigators gain early visibility into potential data loss vectors and can correlate the activity with the originating device, the initiating account, and the context of the printed content.

This detection is dependent on the respective device running Microsoft Defender for Endpoint.

In the Microsoft Defender portal at https://security.microsoft.com, navigate to Email & collaboration > Policies & rules > Alert policy. To go directly to the Alert policy page, use https://security.microsoft.com/alertpoliciesv2.

Click + New Alert Policy in the top-left corner. Assign a clear name to the alert policy and select an appropriate Severity and Category. On the next page, under Activity is, search for and select “Printed file”. Configure the remaining settings as required.

When a device that has Microsoft Defender for Endpoint deployed prints a file, an alert will be generated.