New Support Request – Microsoft Paint & Snipping Tool Not Working After Purview DLP Policy Deployment

Hello Surendra,

Thank you for posting your question on Microsoft Windows Forum!

Based on the information you provided, this appears to be an enterprise support incident rather than a community troubleshooting scenario.

A few things stand out:

• More than 300 users are affected.
• The issue started shortly after implementing a Microsoft Purview DLP policy.
• Intune, AppLocker, WDAC, ASR, Security Baselines, and Endpoint Security policies have already been reviewed and ruled out.
• The issue affects built-in Windows applications (Paint and Snipping Tool).
• You have already engaged both Intune and Purview support teams.

Given the troubleshooting already completed, I would avoid repeating device-side diagnostics. The available evidence suggests the next step is to determine whether the observed behavior is:

1. An expected limitation of the deployed Purview DLP policy.
2. A known product issue.
3. A regression that requires investigation by the appropriate Microsoft engineering team.

Recommended Next Steps

1. Temporarily validate policy correlation

If not already tested, assign an exclusion to a small pilot group and verify whether:

• Paint functionality returns.
• Snipping Tool functionality returns.

This helps confirm whether the behavior is directly tied to the Purview DLP policy enforcement.

2. Review Endpoint DLP Activity Explorer

In Microsoft Purview, review:

Purview Portal

→ Data Loss Prevention

→ Activity Explorer

Look for events occurring when users launch or attempt to use Paint or Snipping Tool.

3. Collect DLP diagnostics

Review:

Event Viewer

→ Applications and Services Logs

→ Microsoft

→ Windows

→ DataProtection

and

Microsoft-Windows-EDP-Audit-Regular

Microsoft-Windows-EDP-Audit-TCB

for events generated when reproducing the issue.

4. Escalate through the existing support channels

Since multiple Microsoft support teams have already reviewed the environment and the impact exceeds 300 users, I would recommend requesting escalation through the existing Microsoft support case and providing:

• Purview DLP policy configuration.
• Activity Explorer results.
• Reproduction steps.
• Timeline showing when the issue began.

My Assessment

Based on what you've already ruled out, the evidence currently points more toward a Purview DLP policy interaction or product behavior than an Intune configuration issue. Since this affects built-in Windows applications after policy deployment, this is likely to require investigation by the product team rather than additional community troubleshooting.

For additional information, please review:

• Microsoft Purview Data Loss Prevention documentation
• Microsoft Purview Activity Explorer

I hope this answer has brought you useful information. If so, please click on "Accept Answer" and consider upvoting it. Doing so helps other community members identify useful solutions to similar issues