I have a DLP rule set up that requests justification on transfer of sensitive information to Removable Media. The issue I'm seeing, is that the user justification prompt appears, but even if at this point the use cancels the transfer, the file has already been transferred to the removable media.
Any advice appreciated.
Worked it out - you have to use "Block" in conjunction with "Request justification" in your Removavble Media DLP Policy.
I think the wording is a bit confusing but it does work.