Microsoft setup guide: AC.L2-3.1.3

3.1.3: Control where CUI can move

Decide where CUI may go, then set Microsoft 365 sharing and AVD controls to match. Test a transfer that should work and each route that should be blocked.

Sources reviewed October 22, 2026. These instructions have not been tested in a Microsoft tenant.

Choose the instructions for your cloud. If you use AVD, also read the notes for AD DS-only, hybrid joined or Entra joined hosts, according to how your hosts are joined.

NIST SP 800-171 Revision 2

The requirement and official objectives

Control the flow of CUI in accordance with approved authorizations.
Official assessment objectives from NIST SP 800-171A, June 2018. Determine if:
ObjectiveOfficial text
3.1.3[a]information flow control policies are defined.
3.1.3[b]methods and enforcement mechanisms for controlling the flow of CUI are defined.
3.1.3[c]designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified.
3.1.3[d]authorizations for controlling the flow of CUI are defined.
3.1.3[e]approved authorizations for controlling the flow of CUI are enforced.

The steps below explain how to configure and check settings related to this requirement. The table above contains the official objective text. Following these steps does not establish a MET finding. Read the official assessment procedures.

Before you start

  • Confirm how the information is designated and who may receive it. If either is unclear, ask the person or organization that supplied it before approving a transfer.
  • Write down where information comes from, where it may go and who may move it. For each route, record who approved it, where that approval is kept, who is responsible and which setting enforces the rule. Include email, portals, Teams, SharePoint, OneDrive, sync, applications, printers, backups, support tools, host profiles and temporary storage.
  • Use a SharePoint administrator authorized to change tenant sharing and a site administrator authorized to change the site settings. For AVD, use an administrator allowed to configure the host pool. Changes to domain or device policies need the appropriate delegated permissions too.
  • Choose a test site or host pool, approved test users and a time when you can safely make changes. Save the current settings and name the person who can approve restoring them. Use only harmless test files.

If you need to identify CUI first, start with the identification guide. Before putting CUI in a cloud service, check that the service, your contract and the handling rules permit it.

Put the requirement into practice

Keep an approved record of where information may move. For each route, say what may be transferred, where it starts, who may receive it, which service carries it and who approved it. Include the routes people use every day, even when they are missing from the current diagram.

CUI can leave a protected environment through a browser upload, personal email, a support tool or a backup. RDP redirection controls can block particular transfers between the session and the local device. You also need to check the other ways information can leave from inside the session.

  1. Compare sharing settings for the organization and site

    In the SharePoint admin center for your tenant, open Policies > Sharing and review the organization settings. Then open the test site under Active sites and review its sharing settings. A site can allow less sharing than the organization allows. Check permitted guests, recipients and link types against the approved transfer record. Also check existing access and any connected Teams or Microsoft 365 groups.

  2. Check what users can share, beyond the default link

    The default link type sets the first option users see. Check whether they can choose a broader link and whether existing links or directly assigned permissions still grant access. With a test file, try access as a recipient who should be denied. Test email, sync and application transfers separately.

  3. Block clipboard transfers where the policy requires it

    Open Azure Virtual Desktop > Host pools > the test pool > RDP Properties > Device redirection. Set Clipboard redirection to Clipboard on local computer isn't available in remote session, then save. Check the policy on the session host too. Microsoft documents both Group Policy and Intune options, including enabling Do not allow Clipboard redirection. Follow the documented restart or reconnection steps before testing.

  4. Block access to local drives where required

    In the same pool, set Drive/storage redirection to Don't redirect any drives and save. On the host, the documented policy option is Do not allow drive redirection = Enabled. Check whether you manage the setting through the host pool, a host policy or both, then test which restrictions take effect. Drive and clipboard settings affect different transfers, so test text and files separately.

  5. Check the other ways information can leave

    Use the documentation for each permitted client to check printers, USB devices and other redirection features. Inside the session, check browser uploads, email, local sync, application exports, profile storage and administrator tools separately. For every prohibited route, identify a setting or other control that blocks it. Record a gap wherever you have no way to enforce the rule.

  6. Check what your DLP policy covers

    If you use Purview DLP, record which features you are licensed to use, which locations and users the policy covers and whether it enforces restrictions. Test the transfer in the service people actually use. A policy running in test mode does not show that a transfer is blocked, nor does a policy that leaves that location outside its coverage.

Commercial: Microsoft 365 and Azure

Identify the Microsoft 365 Commercial tenant and test site. For AVD in Azure Commercial, use portal.azure.com and confirm the tenant, subscription and host pool. Before testing, check that the approved transfer record permits these services to handle the information.

  1. Try the sharing rule on the test site

    Apply the approved sharing restriction to the commercial test site. Check existing permissions, then test with an approved recipient and a recipient who should be denied. Confirm that the account is in the expected tenant and the test file stays in the approved location.

  2. Test transfers to the local device and from inside the session

    Apply the documented redirection settings to the commercial test pool. Test transfers in both directions with each permitted client. Then test another prohibited route that users could actually take, such as uploading to an unapproved destination. Check whether the separate control for that route blocks it.

Government: GCC High and Azure Government

Use the GCC High tenant and, for AVD in Azure Government, portal.azure.us. Record the government tenant, subscription, region and host pool. Keep the transfer record and evidence in approved locations.

GCC and GCC High use different arrangements. GCC identity pairs with Azure Commercial, while GCC High identity pairs with Azure Government. If you use GCC, check its service description and support for each feature. Neither set of instructions here applies to every GCC setup.

  1. Check the recipient and supported sharing options

    Read the GCC High service description before planning to share outside your organization. Check whether the guest account, protected file or application connection is supported in GCC High; a commercial example may work differently. Confirm both that the recipient is approved and that the service supports the connection. If it does not, choose another approved and supported way to collaborate before moving CUI.

  2. Test the restrictions in the government deployment

    Check the redirection settings in the Government host pool and the policies that took effect on its session hosts. Test each supported client you permit. Check that profiles, backups, management tools and any DLP connection use approved services and connections supported in your cloud. If a needed feature is unavailable, record the gap and review another supported way to block the transfer.

Check how your session hosts are joined

Check which account the user signs in with, how the host is joined and which local device and client they use. Then choose the matching instructions below. Confirm that your cloud supports the features you plan to use.

AD DS-only session hosts

For domain joined hosts, record the domain, the organizational unit (OU) containing the hosts, the profile location and the domain groups involved. Apply Group Policy to the intended test hosts and check which settings took effect on them. A policy linked to another OU does not show that this pool is restricted.

Check whether each host is AD DS-only or also hybrid joined. That affects how users authenticate. In either case, configure and test the restrictions on where CUI may move.

Microsoft Entra hybrid joined session hosts

Hybrid joined hosts still depend on the domain and also have an Entra identity. If you configure redirection through both domain policy and device management, check which policies apply to the host and what takes effect. Editing a setting in a portal does not by itself tell you the result.

Run the tests on the host serving the user session. Check clipboard transfers, local drives and browser uploads there. A synchronized user account or an Entra device record does not show that these transfers are restricted.

Microsoft Entra joined session hosts

For Entra joined hosts, identify the tenant and how you manage the hosts. Use the host-pool settings and supported host policies. A domain GPO does not automatically apply to an Entra-only host. Before relying on an Intune policy, confirm that the host is enrolled and the policy is assigned to it.

Check how users authenticate to profiles and file services separately. An Entra joined VM may still reach resources backed by AD DS. Include those transfers in the approved record and the tests.

Fictional example. No tenant test performed.

An approved customer portal and an unapproved local copy

A fictional supplier approves four AVD users to retrieve project files from a customer portal into an approved workspace. Its written policy prohibits copying the files to a local laptop or personal email.

The team plans to restrict clipboard transfers and local drives. It then notices that users can still open personal webmail in the session browser. That route needs a separate control. The team plans to test that the approved portal transfer works and that each prohibited transfer is blocked. This example does not report test results.

Check the settings with sample data

Create a file or record with made-up contents and label it Sample data. Not CUI. Before testing, agree with the system owner on what should be allowed and what should be denied. The table describes the results to look for. These tests have not been run in a Microsoft tenant.

Repeat the checks that apply to each cloud, host join type and client you use.
What to tryWhat should happen
Have an approved user open a harmless file labeled "Sample data. Not CUI." in the approved workspace.The user can open the file through the approved route with the intended permissions.
Have an unapproved user or external recipient try to open the same file. Include an existing link if one is available.Access is denied wherever the approved policy prohibits it.
Try copying test text from the remote session to the local device, then from the local device to the remote session.Both directions are blocked for this restricted test. Repeat with each permitted client.
Look for local drives in File Explorer inside the session, then try transferring a test file.The user cannot use redirected local drives. Test copying files through the clipboard separately.
Try printing or another redirection feature that is available but prohibited in this environment.The control for that feature blocks the transfer. Check it directly even if the drive test passed.
From inside the session, try a prohibited browser upload, email transfer or application export with sample data.The separate control for that route blocks the transfer. A passed clipboard test does not show whether this route is blocked.

Write down what happened, when you tested, the type of account, client, host, policy version and where the evidence is kept. A passed test shows the result only for the connection and settings you tested. Keep failed checks and connections you have not tested on the action list.

Records to keep and work to assign

  • Keep the approved transfer policy and diagram. Show where information starts and ends, who may receive it, who approved each route, who is responsible and any exceptions.
  • Save the tenant, site, host-pool and session-host settings. Record where each policy is assigned, whether it took effect and which version was tested.
  • Keep records of provider responsibilities. If you rely on a control supplied by the provider, identify the service or feature that supplies it.
  • Record each test result with the client version, host and account IDs and date and time. Reference evidence kept in a secure location.

Fictional workbook entry

For 3.1.3[e], choose Evidence to check and enter FLOW-PILOT-01 as the reference. Assign the IT owner to test prohibited transfers with each permitted client and check the personal-webmail route separately. One blocked transfer does not verify every route.

Use the free Level 2 readiness worksheet to record what is missing for each objective, who will address it and what happens next. Keep the evidence itself in an approved location with restricted access. Put a reference to that location in the workbook.

Download the Excel worksheet ↓

When a check fails or access breaks

  1. If a prohibited transfer succeeds

    Confirm which site, client, account and session host the test used. Check which policies were assigned and whether their settings conflict. Follow any documented restart or reconnection steps, then test that route again. Keep the gap open until you have seen the restriction work.

  2. If an approved transfer fails

    Compare the attempted transfer with the written approval. Before widening access, check that the service supports sharing with that recipient from your cloud. If you need to reverse the change, follow the agreed recovery process and restore the saved test settings.

  3. If a temporary exception is needed

    Record who approved it, why it is needed, the permitted route, its limits, when it expires and how you will test it again. If the exception allows local downloads or another new transfer, review whether that changes which systems belong in the assessment. Keep the exception separate from tests that passed.

Costs, licenses and existing tools

  • You may already have the host-pool settings or supported Group Policy tools needed for these redirection restrictions. You can also use Intune where supported, but it has its own license and setup requirements. You do not have to buy Intune solely to use these settings.
  • Basic sharing controls do not include every DLP or device protection feature. Purview support depends on the license, location and service involved. Confirm the exact control you need before buying an upgrade.
  • AVD user access rights do not pay for Azure compute, profile storage, networking or other applications. Having Office does not show that you are licensed for all of them.

Check your subscription against the documentation for Conditional Access licensing and AVD access licensing and costs. Confirm what your government plan includes separately; a product name or commercial bundle does not establish those rights.

What else you need to review

32 CFR 170.19 includes a VDI client condition in which the client does not process, store or transmit CUI beyond keyboard, video and mouse. Installing AVD or disabling the clipboard does not by itself show that the condition is met. Review what every relevant asset does and where information moves before deciding what belongs in scope.

Use that review to decide which systems belong in your assessment. Downloads, sync, printing, support tools and other ways of handling information can change the answer. You also need to review access permissions, remote access, MFA, encryption and audit requirements separately.

Read the VDI scope condition in 32 CFR 170.19.

Sources and review date

Sources reviewed October 22, 2026. These guides use the Level 2 baseline of NIST SP 800-171 Revision 2 and the June 2018 assessment procedures. Reviewing documentation does not verify the settings in your system.

This series follows the structure of Microsoft's 2024 preview reference guide. It suggests which Microsoft products can help with each requirement. Use those suggestions as a starting point; they do not prove current compliance. The steps here refer to the linked product documentation.

For a correction or general question, email cmmc@purposefulsecurity.com and describe it in general terms. Do not send CUI, contracts, credentials, network diagrams, security evidence or completed worksheets.