What’s a realistic way to stop company files leaving the network?

Start with the rules, not a pile of firewall blocks. Work out which files are actually sensitive, who needs access, and what sharing is allowed. Write that down in a data-handling policy, then make sure managers and employees understand it. Technical controls can help enforce clear rules, but they can’t make the risk disappear. Someone can still photograph a screen, for example.

Once you have that foundation, review permissions and logging, protect endpoint drives with encryption, and decide which external sharing services are approved. Be clear with your boss that preventing every possible form of copying is not a realistic promise.

For your setup, check what your Microsoft 365 licenses actually include before buying anything. Microsoft’s data loss prevention and sensitivity-labeling features may help with supported content and sharing scenarios, but availability depends on the subscription. They won’t automatically cover every file on a local server or every way a user can copy data.

A sensible first pass is to review external sharing settings, limit access to sensitive folders, and enable audit logging where available. Test any blocking policy with a small group first. A broad rule that blocks attachments or file sharing can disrupt ordinary work, so include exceptions and an approval path.

Think in layers. Block removable storage if it is not needed, keep company devices managed and encrypted, restrict unapproved sync and file-sharing apps, and use outbound controls where you can identify sensitive data. Log access and exports, and make sure someone reviews alerts. A firewall by itself is not a complete data-loss control, especially when files can leave through normal email or web services.

There’s no magic open-source tool that reliably prevents all employee exfiltration across these paths. DLP products can add useful monitoring and enforcement, but they need tuning, licensing, and someone to maintain them. Ask for a defined budget and scope rather than trying to solve an unlimited problem with a free tool.

If the requirement is that the original files must not be downloaded to user devices, consider a controlled remote-work environment. Users access applications and data inside a managed desktop or server environment, while clipboard, drive mapping, printing, and file transfer are restricted as needed.

That’s a substantial architecture and support commitment, and it still cannot stop every capture method. It may fit a small set of highly sensitive projects better than applying it to everyone. First map the workflow and confirm whether the business can tolerate those limits.