.pfile) for most other types not explicitly excluded. Endpoint DLP instead monitors activity
(copy, print, upload, USB…) on files stored on onboarded Windows/macOS devices. An extension can be supported by one,
both, or neither. Lists are transcribed from Microsoft Learn and can change — always confirm against the source.
Generic encryption (Information Protection)
Any file type not natively supported and not excluded gets generic encryption when a label with
encryption is applied: the file is wrapped and renamed to .p<type> (e.g. report.vsd →
report.pvsd), authentication is enforced, but usage rights aren't. Because it's a catch-all, those
extensions aren't individually enumerated here.
Endpoint DLP — tracking after an extension change (MIME type)
DLP tracks some types by MIME type, so activity is still captured if the extension is renamed.
.doc .docx .xls .xlsx .ppt .pptx .pdf are tracked when renamed to any extension;
.txt .msg .rtf .c .cpp .h .cs .java .tsv are tracked only when renamed to another supported extension.
Images & scanned PDFs require OCR
.jpg .png .tif .tiff .bmp .jpeg and image-only (scanned) .pdf are monitored/audited
by Endpoint DLP only when
Optical Character Recognition (OCR)
is enabled. (The endpoint OCR list comes from the OCR reference — the Endpoint DLP "monitored files" page omits PDF.)