A cloud based data loss prevention (DLP) system (“cloud DLP system”) implements offline scanning of content stored in a cloud-based service belonging to an enterprise in accordance with the enterprise's policy and control. The cloud DLP system provides alerts or remediation in response to detection of non-compliance cloud content. In some embodiments, the cloud DLP system is provided with the access credential of the enterprise to access the cloud-based service. In other embodiments, the enterprise's login credential remains within the enterprise data network and an on-premises client obtains an access token for the cloud DLP system.