Share via

Learn about Data Loss Prevention for Cloud Apps in Edge for Business

In preview, Microsoft Purview Data Loss Prevention (DLP) monitoring and protection are built right into the Microsoft Edge for Business browser. You don’t need to onboard the device into Microsoft Purview. This integration helps you stop users from sharing sensitive information to and from cloud apps using Edge.

Licensing requirements

To use this feature, you need one of these licenses:

  • Microsoft 365 E5/A5/G5, Microsoft 365 Business Premium
  • Office 365 E5/A5/G5
  • Microsoft 365 E5/A5/G5/F5 Compliance and F5 Security & Compliance

Important

Licensing and billing details for preview features may change.

Permissions

The account you use to create and deploy policies must be a member of one of these role groups:

  • Compliance administrator
  • Compliance data administrator
  • Information Protection
  • Information Protection Admin
  • Security administrator

Managed Devices

You can protect Windows 10/11 devices that are managed by Intune. Users must sign in with their work or school account.

On these devices, Edge connects directly with Microsoft Purview and Edge services to get policy updates and apply protections. Edge configuration policies block users from using protected apps in noncompliant browsers. If users try to access an unmanaged app in a noncompliant browser, they’ll be blocked and prompted to use Microsoft Edge.

In preview, browser DLP can Help prevent sharing via Microsoft Edge for Business to unmanaged AI apps from managed devices.

Unmanaged devices

Unmanaged devices aren’t connected to Intune or joined to your organization using Entra. Users don’t sign into the device with their work or school account. Instead, they sign into their Edge work profile to access organization managed apps.

Browser DLP policies only apply to the work profile in Edge. These policies don’t apply when users use a Personal or InPrivate profile.

In preview, these protections can Help Prevent Users from Sharing Sensitive Info with Cloud Apps in Edge for Business.

Supported cloud apps

Entra Connected (Managed) Apps

Entra connected (managed) apps are business apps set up for Entra Single Sign-On (SSO). Policies apply when users access them with their work or school account.

Unmanaged cloud Apps

These apps aren’t managed by your organization. Users access them without signing in with their Microsoft work or school account. Supported unmanaged cloud apps include:

  • OpenAI ChatGPT
  • Google Gemini
  • DeepSeek
  • Microsoft Copilot

Important

Unmanaged cloud app features only apply to the consumer version of Microsoft 365 Copilot. Learn more about Microsoft 365 Copilot Enterprise protections.

Supported Browsers

DLP policies for cloud apps in the browser work directly in Microsoft Edge for Business.

Edge for Business

These features are available in the two latest stable versions of Edge, starting with version 138. For more information on the supported versions of Edge, see Microsoft Edge Releases.

Tip

Get started with Microsoft Security Copilot to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Security Copilot in Microsoft Purview.

Activities you can monitor and take action on

You can audit and manage these activities on sensitive items in the browser:

Activity Device Type App Type Supported Policy Actions
Upload text Managed Unmanaged allow, block, both actions audited
Upload file Managed, Unmanaged Managed allow, block, both actions audited
Download file Managed, Unmanaged Managed allow, block, both actions audited
Cut/copy data Managed, Unmanaged Managed allow, block, both actions audited
Paste data Managed, Unmanaged Managed allow, block, both actions audited
Print data Managed, Unmanaged Managed allow, block, both actions audited

Policies for Managed App Interactions

DLP policies targeting managed apps in the browser apply on desktop devices running Microsoft Edge in Windows 10/11 and macOS.

Edge disables developer tools automatically when policies apply to managed apps (in both audit and block modes).

To activate protections in Edge for managed apps:

For full implementation details, see Help Prevent Users from Sharing Sensitive Info with Cloud Apps in Edge for Business.

Important

If a user is scoped in Purview DLP policies for managed cloud apps in Edge and Microsoft Defender session policies or Purview Endpoint DLP policies, protections might not apply in Edge from the Purview browser policy. Remove or exclude users from the other policies to allow the Purview policy for managed cloud apps in Edge to apply.

When you add users to policies for the first time, the policy might not be applied right away if they’re already signed in to the app. The policy applies after their token expires and they sign in again. You can change the sign in frequency using conditional access session controls to shorten the wait time.

There are some known limitations in Conditional Access app control that can impact Purview policies targeting managed apps in the browser. For more information, see known limitations in Conditional Access app control

Policies for Unmanaged App Interactions

DLP policies targeting unmanaged apps in the browse apply can monitor and protect sensitive data shared from managed desktop devices in Edge on Windows 10/11.

To activate protections in Edge:

For full setup details, see Help prevent sharing via Microsoft Edge for Business to unmanaged AI apps from managed devices.

Default Policies for AI Apps from Microsoft Data Security Posture Management for AI

Microsoft Purview Data Security Posture Management for AI (DSPM for AI) offers recommended policies to monitor and block generative AI apps. Use one-click policies in DSPM for AI to apply them.

Accessing Data from Managed App Interactions

You can view policy data and alerts in Defender XDR investigations.

Accessing Data from Unmanaged App Interactions

You can view activities and audit log entries in activity explorer, audit logs, and Defender XDR investigations. In activity explorer, filter by enforcement plane set to browser. Data specific to AI apps is also visible in DSPM for AI.

See also