Microsoft Purview Browser DLP: Deploying Chrome and Firefox Extensions with Intune, Securing BYOD, and Protecting AI Data

A practical implementation and architecture guide for protecting sensitive enterprise data across managed devices, personal devices, and generative AI applications.

Introduction

Modern organizations no longer access corporate information exclusively from managed devices or Microsoft Edge.

Employees use Google Chrome, Mozilla Firefox, personal laptops, cloud applications, and increasingly, generative AI services such as ChatGPT and Google Gemini.

This creates a critical challenge for security teams:

How do you maintain consistent data protection when users access sensitive information through different browsers and devices?

Microsoft Purview provides several complementary capabilities to address this challenge.

These include:

• Microsoft Purview Endpoint Data Loss Prevention (DLP).
• Microsoft Purview browser extensions for Chrome and Firefox.
• Data Loss Prevention for Cloud Apps in Microsoft Edge for Business.
• Browser-based protection for supported AI applications.
• Microsoft Entra Conditional Access and related session controls.

However, these technologies do not provide identical protection.

Their capabilities depend on whether the device is managed, which browser is used, and whether the destination is a managed corporate application or an unmanaged AI service.

In this article, we will examine three distinct security architectures, deploy the Microsoft Purview Chrome extension using Microsoft Intune, and explore practical data protection scenarios.

1. Understanding the Three Microsoft Purview Browser Security Architectures

Before configuring browser DLP, organizations must understand the three primary deployment models.

Although these architectures share Microsoft Purview DLP capabilities, they use different enforcement mechanisms and prerequisites.

Architecture 1: Managed endpoints

For corporate-managed Windows devices, Endpoint DLP provides controls over sensitive activities such as file uploads, clipboard operations, printing, and transfers to removable media.

Microsoft Edge provides native browser integration.

Google Chrome and Mozilla Firefox require the Microsoft Purview extensions on Windows for supported Endpoint DLP browser activities.

Architecture 2: Unmanaged BYOD

For personal devices that are not enrolled in Intune, Microsoft Edge for Business can protect supported Microsoft Entra-connected corporate applications through the user’s managed work profile.

This provides browser-level protection without requiring device-wide Endpoint DLP onboarding.

Architecture 3: Managed devices accessing AI applications

Microsoft Purview also provides browser-based protection for interactions with supported unmanaged AI applications.

For this newer architecture, Microsoft requires supported Intune-managed Windows devices and Microsoft Edge for Business.

This capability is separate from traditional Endpoint DLP file-upload protection.

2. Why Microsoft Purview Browser Extensions Matter

Microsoft Purview Endpoint DLP can monitor and restrict supported sensitive data activities on onboarded devices.

However, browser integration varies by platform.

Browser compatibility

On Windows, the Chrome and Firefox extensions integrate supported browser activities with the Endpoint DLP enforcement architecture.

The extensions are not standalone DLP products. The Windows device must first be onboarded to Endpoint DLP.

For example, installing the Chrome extension on an unmanaged personal laptop does not automatically provide the same protection as a fully onboarded corporate Windows endpoint.

3. What Activities Can Be Protected?

Microsoft Purview Endpoint DLP provides several controls for sensitive data activities.

These include:

• Uploading sensitive files to restricted cloud service domains.
• Copying sensitive information to the clipboard.
• Printing sensitive content.
• Copying files to removable storage.
• Copying files to network shares.
• Pasting sensitive information into supported browser text fields.

Some activities are enforced at the endpoint level, while others require browser-specific integration.

Understanding browser-specific differences

Microsoft Edge supports additional website-level controls that are not identical to the capabilities provided through Chrome and Firefox extensions.

Examples include supported controls for printing website content, copying website data, and saving website content locally.

Chrome and Firefox extensions provide supported Endpoint DLP browser integration, including restricted file uploads and Paste to supported browsers.

Organizations should not assume that every browser exposes exactly the same enforcement options.

4. Prerequisites for Chrome Extension Deployment

Before deploying the Microsoft Purview Chrome extension, verify the following.

Licensing

The organization must have appropriate Microsoft Purview Endpoint DLP licensing.

Operating system

Microsoft documents Windows 10 x64 build 1809 or later as a baseline requirement for the Chrome extension.

The device must also meet the applicable Microsoft Defender Antivirus antimalware client requirements.

Endpoint DLP onboarding

The device must be successfully onboarded to Microsoft Purview Endpoint DLP.

Browser requirements

Google Chrome must be installed and capable of receiving enterprise browser configuration policies.

Administrative permissions

Administrators need appropriate permissions in Microsoft Intune and Microsoft Purview.

Use least-privilege roles wherever possible.

5. Deploy the Microsoft Purview Chrome Extension Using Intune

Microsoft provides an official extension identifier and update URL for centralized deployment.

Step 1: Open Microsoft Intune

Navigate to:

Open the Windows device configuration area.

Step 2: Create a configuration profile

Create a configuration profile for Windows 10 and later using the Settings catalog and the applicable Chrome enterprise settings.

Microsoft’s documented workflow includes selecting the Google Chrome extensions configuration.

Step 3: Configure force-installed extensions

Locate:

Google → Google Chrome → Extensions → Configure the list of force-installed apps and extensions

Enable the setting.

Enter the following official Microsoft Purview Chrome extension configuration:

echcggldkblhodogklpincgchnpgcdco;https://clients2.google.com/service/update2/crx

The first part is the extension identifier.

The second part specifies the Chrome extension update service.

Step 4: Assign the policy

Assign the configuration profile to a controlled pilot group.

Example:

MUGGH-Purview-DLP-Pilot

Avoid targeting all Windows devices before validating the deployment.

Step 5: Synchronize devices

Initiate device synchronization through Microsoft Intune.

Allow time for the configuration to apply.

Step 6: Verify extension installation

On the Windows device, open Chrome and navigate to:

chrome://extensions

Confirm that the Microsoft Purview extension is installed and enabled.

Then open:

chrome://policy

Verify that the relevant enterprise extension installation policy is applied.

Step 7: Validate DLP enforcement

Use a test file containing synthetic sensitive information.

Attempt a supported file-upload activity against a destination covered by the DLP policy.

Confirm the expected enforcement action and review the event in Microsoft Purview.

Important: Successful extension installation does not prove that Endpoint DLP policies are functioning. Always perform a functional test.

6. Deploying the Firefox Extension

Microsoft also provides a Purview extension for Mozilla Firefox on Windows.

The deployment process follows the same general principles:

1. Onboard the device to Endpoint DLP.
2. Obtain the official Firefox extension.
3. Configure the appropriate Firefox enterprise extension policy.
4. Deploy the configuration through Intune or Group Policy.
5. Verify extension installation.
6. Test supported Endpoint DLP activities.

Firefox uses its own enterprise extension management settings.

Administrators should not reuse Chrome-specific extension identifiers or policy configurations for Firefox.

Refer to the official Firefox extension documentation for the supported deployment method.

7. Protecting Sensitive Data Shared with AI Applications

Generative AI introduces additional risks because employees may upload confidential files or submit sensitive information in prompts.

Consider two scenarios.

Scenario A: Uploading a confidential file

An employee opens an AI website in Chrome and attempts to upload a confidential Excel workbook.

On an onboarded Windows device, Endpoint DLP can evaluate the file against configured policies.

If the destination matches a restricted service domain and the file matches the relevant policy conditions, the upload can be audited or restricted.

The Chrome extension enables the supported browser integration.

Scenario B: Pasting sensitive information into an AI prompt

An employee copies sensitive customer information and attempts to paste it into a browser text field.

Microsoft Purview provides a separate activity called Paste to supported browsers.

This activity evaluates the clipboard content when the paste occurs.

It is important to distinguish this from file-upload protection.

8. Configuring Paste to Supported Browsers

Paste to supported browsers is designed to detect sensitive content pasted into supported browser fields.

It evaluates the clipboard content independently of the original file’s classification.

Supported classification

Microsoft documents support for standard sensitive information type patterns.

Examples include:

• Credit card numbers.
• Social Security numbers.
• Custom sensitive information types using supported patterns.
• Keyword dictionaries.

However, the activity does not support every Purview classification technology.

For example, Exact Data Match and trainable classifiers are not supported for this paste evaluation.

Administrators should not assume that a file’s sensitivity label will automatically trigger paste protection.

Configuration workflow

1. Open Microsoft Purview.
2. Navigate to Data Loss Prevention settings.
3. Open Endpoint DLP settings.
4. Locate Browser and domain restrictions to sensitive data.
5. Create a Sensitive service domain group.
6. Add the relevant test website destinations.
7. Create a DLP policy targeting Devices.
8. Configure a supported sensitive information type condition.
9. Select Audit or restrict activities on devices.
10. Choose Paste to supported browsers.
11. Configure Audit, Block with override, or Block.
12. Test the policy before enabling broad enforcement.

Important distinction

Sensitive service domain groups are used for Paste to supported browsers.

The general Service domains setting is used for different Endpoint DLP scenarios, including sensitive file-upload restrictions.

These settings are not interchangeable.

9. Protecting Corporate Data on BYOD Devices

Bring Your Own Device (BYOD) introduces a different security challenge.

Employees may access corporate applications from personal Windows or macOS devices that are not enrolled in Microsoft Intune.

Organizations may want to protect business information without taking full administrative control of the employee’s device.

Managed versus unmanaged devices

How Edge for Business protects BYOD

Microsoft Edge for Business provides browser-level DLP capabilities for supported Microsoft Entra-connected managed applications.

On an unmanaged personal device, the employee signs in to an Edge for Business work profile.

The organization can apply supported browser DLP policies to interactions with corporate applications.

Depending on the application and policy configuration, these controls may include:

• File downloads.
• File uploads.
• Copying information.
• Pasting information.
• Printing.

The protection is associated with the managed work profile and supported applications.

It does not provide universal protection across the user’s personal browser profiles or the entire operating system.

Practical BYOD example

An employee accesses a corporate SharePoint application from a personal laptop.

The organization wants to permit access to business information but restrict sensitive data transfers.

Using supported Edge for Business browser DLP, Conditional Access, and the required application integration, the organization can enforce appropriate browser-level restrictions.

The device does not need to be fully enrolled in Intune for this managed-app browser protection scenario.

10. Protecting Unmanaged AI Applications with Edge for Business

Microsoft provides a newer browser DLP architecture for protecting sensitive information shared with supported unmanaged AI applications.

Examples in Microsoft’s supported application catalog include consumer ChatGPT, Google Gemini, DeepSeek, Perplexity AI, and other services.

Architecture requirements

For unmanaged AI application protection, Microsoft documents the following key requirements:

• Intune-managed Windows 10 or Windows 11 devices.
• Supported Microsoft Edge for Business.
• Required administrative permissions.
• Applicable Microsoft Purview policies.
• Appropriate billing configuration.

Microsoft documents support beginning with Edge for Business version 144, within the supported stable-version window.

Supported activities

For unmanaged applications on managed devices, Microsoft documents browser DLP protection for:

• Text uploads.
• File uploads.

These capabilities are distinct from the managed-app controls available on unmanaged BYOD devices.

Enforcement considerations

Microsoft also documents important limitations.

Some AI applications may use encoded content or dynamically generated endpoints, which can affect enforcement.

For inline evaluation, Microsoft documents limits of:

• Up to 4 MB for text uploads.
• Up to 3 MB for file uploads.

These limits should be considered when designing and validating protection.

Browser restrictions

When configured to block applicable unmanaged-app interactions, the protection architecture may prevent users from accessing those applications through unprotected browsers.

This helps reduce browser-based bypass opportunities.

However, administrators should test the resulting user experience and verify policy activation.

11. Licensing Considerations

The three architectures have different licensing requirements.

Organizations should confirm licensing eligibility, feature availability, and billing configuration before deployment.

Pay-as-you-go protection for unmanaged AI apps should not be assumed to be included automatically with existing Microsoft 365 E5 licenses.

12. Conditional Access and Browser Data Protection

Microsoft Entra Conditional Access complements Microsoft Purview by controlling access to corporate applications.

Conditional Access can evaluate signals such as:

• User identity.
• Authentication requirements.
• Device state.
• Application context.
• Access conditions.

For supported managed applications, Conditional Access and associated in-browser protection configurations can help establish the required security context for browser DLP.

Understanding the security layers

These technologies complement one another but are not interchangeable.

13. Recommended Enterprise Deployment Architecture

A practical deployment can be organized into three security models.

Model A: Corporate-managed Windows devices

Deploy:

• Microsoft Intune.
• Endpoint DLP onboarding.
• Microsoft Edge native DLP integration.
• Chrome and Firefox extensions where required.
• Sensitivity labels and sensitive information types.
• Endpoint DLP policies.
• Activity Explorer monitoring.

Model B: Unmanaged BYOD devices

Deploy:

• Microsoft Edge for Business.
• Managed work profiles.
• Supported browser DLP for managed cloud applications.
• Microsoft Entra Conditional Access.
• Required application and session integrations.

This model protects supported corporate browser interactions without providing device-wide Endpoint DLP.

Model C: Managed devices accessing AI applications

Deploy:

• Intune-managed Windows devices.
• Supported Edge for Business version.
• Browser DLP policies for unmanaged AI applications.
• Appropriate pay-as-you-go billing.
• AI activity monitoring and investigation.
• Endpoint DLP where additional device-level controls are required.

The exact architecture should be selected based on the organization’s device management model, application landscape, and data security requirements.

14. Testing and Validation

Before production deployment, validate each architecture independently.

Endpoint DLP extension validation

• Confirm Windows Endpoint DLP onboarding.
• Verify Chrome or Firefox extension installation.
• Test sensitive file uploads.
• Test supported clipboard paste restrictions.
• Review Activity Explorer.
• Verify configured alerts.

BYOD browser DLP validation

• Confirm the device is unmanaged.
• Sign in to Edge for Business using a work profile.
• Access a supported managed application.
• Test configured browser restrictions.
• Verify Conditional Access behavior.
• Confirm the expected separation between work and personal profiles.

AI browser DLP validation

• Confirm device enrollment in Intune.
• Verify the supported Edge for Business version.
• Confirm policy activation.
• Test supported AI application interactions.
• Review browser DLP events.
• Verify enforcement behavior in unprotected browsers.

Use synthetic sensitive information during testing.

15. Common Implementation Mistakes

Mistake 1: Assuming browser extensions work without Endpoint DLP

Chrome and Firefox extensions require the supported Endpoint DLP architecture.

Mistake 2: Treating BYOD like a corporate-managed device

Browser-only protection on unmanaged devices does not provide device-wide DLP.

Mistake 3: Assuming all browser DLP controls are identical

Endpoint DLP, managed-app browser DLP, and unmanaged AI app browser DLP support different activities.

Mistake 4: Using sensitivity labels for paste classification

Paste to supported browsers evaluates supported sensitive information types rather than relying directly on source-file sensitivity labels.

Mistake 5: Ignoring AI application limitations

Encoded content, dynamic endpoints, and inline evaluation limits may affect AI browser DLP enforcement.

Mistake 6: Deploying blocking policies without testing

Always validate policies with a controlled pilot before broad enforcement.

Mistake 7: Assuming licensing is identical

Traditional Endpoint DLP, managed-app browser DLP, and unmanaged AI app browser DLP have different licensing requirements.

16. Conclusion

Microsoft Purview provides several complementary approaches to protecting sensitive information across browsers and devices.

For onboarded Windows devices, Microsoft Edge provides native Endpoint DLP browser integration, while Google Chrome and Mozilla Firefox require the appropriate Microsoft Purview extensions.

For unmanaged personal devices, Microsoft Edge for Business can provide browser-level protection for supported corporate applications without full Intune enrollment.

For supported unmanaged AI applications, Microsoft provides additional browser DLP capabilities on eligible Intune-managed Windows devices.

The most important architectural principle is understanding that these are three distinct protection models.

Organizations should begin by identifying:

1. Whether the device is managed or unmanaged.
2. Which browsers employees use.
3. Which applications contain or receive sensitive information.
4. Which activities must be audited or blocked.
5. Which licensing and technical prerequisites apply.

A successful deployment combines device readiness, browser integration, data classification, policy design, pilot testing, and continuous monitoring.

Protecting enterprise data requires the right enforcement architecture—not simply installing a browser extension.

Official Microsoft Documentation

1. Get started with the Microsoft Purview extension for Chrome
2. Learn about the Microsoft Purview extension for Chrome
3. Learn about the Microsoft Purview extension for Firefox
4. Configure Endpoint DLP settings
5. Restrict sensitive content pasted into browsers
6. Troubleshoot Paste to supported browsers
7. Data Loss Prevention for Cloud Apps in Edge for Business
8. Microsoft Purview Endpoint DLP scenarios
9. Microsoft Entra Conditional Access