Microsoft Purview Browser DLP: The Complete Guide to Chrome, Firefox, Intune, BYOD, DSPM, and AI Security

How to protect sensitive corporate information across managed endpoints, personal devices, cloud applications, and generative AI using Microsoft Purview and Microsoft Edge for Business.

Introduction

Enterprise data security is undergoing a fundamental transformation.

Organizations no longer operate exclusively within corporate networks or managed endpoints. Employees access sensitive information from corporate laptops, personal devices, multiple browsers, cloud applications, and increasingly, generative AI platforms.

Consider the following scenarios:

• An employee uploads a confidential financial report to ChatGPT using Google Chrome.
• A user copies sensitive customer information into an AI prompt.
• An employee downloads confidential SharePoint documents to a personal laptop.
• A contractor accesses corporate applications from an unmanaged device.
• A user attempts to bypass browser restrictions by switching from Microsoft Edge to Firefox.
• A security team discovers employees using AI applications that have never been formally approved.

Each scenario creates a different data security challenge.

Microsoft Purview addresses these risks through several complementary technologies:

• Microsoft Purview Endpoint Data Loss Prevention (DLP).
• Microsoft Purview browser extensions for Chrome and Firefox.
• DLP for Cloud Apps in Microsoft Edge for Business.
• Microsoft Purview Data Security Posture Management (DSPM).
• Microsoft Entra Conditional Access.
• Microsoft Defender for Cloud Apps.

However, these technologies are not interchangeable.

The appropriate protection architecture depends on device management status, browser choice, application type, and the sensitive data activities that need to be controlled.

In this article, we will examine the architecture, implementation, licensing, monitoring, and validation of these capabilities using practical enterprise scenarios.

1. Understanding the Three Browser DLP Architectures

Microsoft Purview provides three complementary browser data protection models.

Architecture 1 — Endpoint DLP with browser integration

Designed for supported Windows and macOS devices onboarded to Microsoft Purview Endpoint DLP.

This architecture protects supported device and browser activities, including sensitive file uploads, printing, clipboard operations, and transfers to removable storage.

Microsoft Edge provides native browser integration. Chrome and Firefox require Microsoft Purview extensions on Windows for supported browser activities.

Architecture 2 — Edge for Business DLP for managed cloud applications

Designed to protect interactions with supported Microsoft Entra-connected corporate applications.

This architecture can operate on eligible managed and unmanaged devices without requiring Endpoint DLP onboarding.

Policies are enforced directly in Microsoft Edge for Business.

Architecture 3 — Edge for Business DLP for unmanaged AI applications

Designed to protect sensitive information shared with supported unmanaged cloud applications, including generative AI services.

This architecture requires Intune-managed Windows devices and the appropriate Edge for Business browser DLP configuration.

Architecture comparison

These architectures can complement one another, but their policy scope, enforcement mechanisms, and prerequisites differ.

2. Why Microsoft Purview Browser Extensions Are Still Important

Microsoft Edge integrates natively with Microsoft Purview Endpoint DLP.

On Windows, Google Chrome and Mozilla Firefox require Microsoft Purview browser extensions for supported Endpoint DLP browser activities.

The extensions allow supported browser interactions to participate in Endpoint DLP enforcement.

Browser support

The Chrome and Firefox extensions belong to the traditional Endpoint DLP architecture.

They are not required for Edge for Business browser-native DLP.

Important: Installing a Chrome or Firefox extension does not independently onboard a device to Endpoint DLP.

3. Understanding Supported Endpoint DLP Activities

Microsoft Purview Endpoint DLP supports monitoring and restricting sensitive data activities, including:

• Uploading sensitive files to restricted cloud services.
• Copying sensitive information to the clipboard.
• Printing sensitive content.
• Copying sensitive files to USB storage.
• Copying sensitive files to network shares.
• Pasting sensitive information into supported browser fields.

However, browser-specific controls are not identical across Microsoft Edge, Chrome, and Firefox.

Browser-specific activity comparison

Chrome and Firefox can still participate in other supported Endpoint DLP file activities.

The distinction is between general Endpoint DLP controls and browser-specific website controls.

4. Deploying the Microsoft Purview Chrome Extension with Intune

Microsoft Intune provides a centralized method for deploying the Chrome extension to corporate-managed Windows devices.

Prerequisites

Before deployment, verify:

• Appropriate Microsoft Purview Endpoint DLP licensing.
• Supported Windows operating system.
• Successful Endpoint DLP onboarding.
• Google Chrome installed.
• Supported Microsoft Defender Antivirus antimalware client.
• Appropriate Intune administrative permissions.

Microsoft documents Windows 10 x64 build 1809 or later and antimalware client version 4.18.2202.x or later as baseline extension requirements.

Step 1 — Open Microsoft Intune

Sign in to:

https://intune.microsoft.com

Navigate to the Windows device configuration profiles area.

Create a configuration profile using the Settings catalog.

Step 2 — Configure the Chrome extension

Locate:

Google → Google Chrome → Extensions

Select:

Configure the list of force-installed apps and extensions

Enable the setting and enter:

echcggldkblhodogklpincgchnpgcdco;https://clients2.google.com/service/update2/crx

This is the Microsoft Purview Chrome extension identifier and update service URL documented by Microsoft.

Step 3 — Assign the configuration

Assign the policy to a controlled pilot group.

Example:

MUGGH-Purview-DLP-Pilot

Step 4 — Verify installation

On a targeted device, open Chrome:

chrome://extensions

Confirm that the Microsoft Purview extension is installed and enabled.

Next, open:

chrome://policy

Verify that the enterprise extension installation policy has been applied.

Step 5 — Validate enforcement

Use a synthetic sensitive test document.

Attempt a file upload to a destination covered by the DLP policy.

Verify the expected enforcement action and review the activity in Microsoft Purview.

Successful extension installation does not necessarily mean that DLP enforcement is working.

Always perform functional testing.

5. Deploying the Microsoft Purview Firefox Extension

Mozilla Firefox supports Microsoft Purview Endpoint DLP integration on Windows through the corresponding extension.

The general deployment workflow is:

1. Verify Endpoint DLP onboarding.
2. Obtain the official Firefox extension.
3. Configure the supported Firefox enterprise extension installation policy.
4. Deploy using the appropriate management mechanism.
5. Verify extension installation.
6. Test supported Endpoint DLP activities.

Firefox uses a different enterprise extension management architecture from Chrome.

Administrators should follow the Firefox-specific Microsoft documentation rather than reusing Chrome configuration values.

6. Protecting Sensitive Data Shared with AI Applications Using Endpoint DLP

Generative AI introduces additional data leakage risks.

Employees may upload confidential documents, paste customer information into prompts, or share sensitive business data with unapproved applications.

Scenario A — Sensitive file upload

An employee opens an AI website in Chrome and attempts to upload a confidential Excel workbook.

Endpoint DLP evaluates the file against the applicable policy.

If the destination matches a restricted service domain and the file satisfies the policy conditions, the activity can be audited or restricted.

On Windows, the Chrome extension provides the supported browser integration.

Scenario B — Sensitive information pasted into an AI prompt

An employee copies customer information from an internal application and pastes it into a browser text field.

Microsoft Purview provides a separate activity called Paste to supported browsers.

This capability evaluates supported clipboard content when it is pasted.

It is different from file-upload protection.

7. Configuring Paste to Supported Browsers

Paste to supported browsers evaluates sensitive information pasted into supported browser fields.

The evaluation occurs independently of the source file’s classification.

For example, a user may copy sensitive information from a document without a sensitivity label.

If the clipboard content matches a supported sensitive information type, the paste activity can still be restricted.

Classification requirements

This activity supports standard sensitive information type patterns.

However, it does not support every advanced classification technology.

Exact Data Match and trainable classifiers are not supported for this activity.

Administrators should not assume that a sensitivity label on the source file automatically triggers paste protection.

Configuration workflow

1. Open https://purview.microsoft.com.
2. Navigate to Data Loss Prevention settings.
3. Open Endpoint DLP settings.
4. Locate Browser and domain restrictions to sensitive data.
5. Create a Sensitive service domain group.
6. Add the relevant test destinations.
7. Create a DLP policy targeting Devices.
8. Configure supported sensitive information type conditions.
9. Select Audit or restrict activities on devices.
10. Choose Paste to supported browsers.
11. Configure Audit, Block with override, or Block.
12. Validate the policy using synthetic sensitive information.

Example group:

MUGGH-Restricted-AI-Domains

Example policy:

MUGGH-DLP-AI-Prompt-Protection

Important configuration distinction

Service domains are used for supported sensitive file-upload restrictions.

Sensitive service domain groups are used for Paste to supported browsers.

These settings are not interchangeable.

8. Introducing DLP for Cloud Apps in Edge for Business

Microsoft Edge for Business provides browser-native DLP capabilities.

Microsoft Purview policies can be applied directly in the browser without requiring Endpoint DLP device onboarding.

The browser communicates with Microsoft Purview and Edge services to receive and enforce applicable policies.

This architecture supports two application categories:

1. Supported Microsoft Entra-connected managed applications.
2. Supported unmanaged cloud applications, including generative AI tools.

The device requirements and supported activities differ between these categories.

9. Edge for Business DLP for Managed Cloud Applications

Managed cloud applications are supported enterprise applications configured with Microsoft Entra single sign-on.

Microsoft Purview browser DLP can protect supported interactions with these applications in Edge for Business.

Device support

Managed-app browser DLP supports eligible Windows and macOS desktop devices.

It can operate on managed and unmanaged devices.

Users access protected applications through their Edge for Business work profile.

Supported activities

Actual enforcement depends on the supported application, browser, policy configuration, and activity.

Required integrations

Microsoft documents configuration involving:

• Microsoft Entra Conditional Access.
• Conditional Access App Control.
• Supported application onboarding.
• Conditional Access custom session controls.
• Edge for Business in-browser protection.
• Microsoft Purview DLP policies.

Creating a Purview policy alone is not sufficient to configure the complete managed-app protection architecture.

10. Protecting Corporate Data on Unmanaged BYOD Devices

BYOD is one of the most important use cases for Edge for Business browser DLP.

Organizations may allow employees and contractors to use personal devices while maintaining appropriate controls over corporate information.

Example scenario

An employee uses a personal Windows laptop that is not enrolled in Intune.

The employee opens Edge for Business, signs in using a corporate work profile, and accesses a supported Microsoft Entra-connected business application.

With the appropriate configuration, Microsoft Purview browser DLP can enforce supported restrictions on corporate data interactions.

These may include controls for uploads, downloads, copying, pasting, and printing.

What BYOD browser DLP does not provide

Browser DLP is not equivalent to device-wide Endpoint DLP.

It does not automatically protect every local file, every browser, every application, or every USB transfer on the personal device.

For unmanaged devices, the protection applies through the supported Edge for Business work-profile context.

Personal browsing is not universally governed by the corporate managed-app browser DLP policy.

Recommended BYOD architecture

• Microsoft Edge for Business.
• Corporate work profiles.
• Microsoft Entra Conditional Access.
• Conditional Access App Control.
• Edge in-browser protection.
• Microsoft Purview browser DLP policies for managed applications.

This provides a way to protect supported corporate browser activities without requiring full device enrollment.

11. Protecting Unmanaged AI Applications with Edge for Business

Microsoft also provides browser-native DLP for supported unmanaged cloud applications.

These include generative AI services such as ChatGPT, Gemini, DeepSeek, and other applications in Microsoft’s supported catalog.

Device requirements

Microsoft documents the following prerequisites:

• Windows 10 or Windows 11.
• Device managed by Microsoft Intune.
• Supported Microsoft Edge for Business.
• Appropriate Purview policy configuration.
• Required licensing and billing.

The capabilities require one of the two latest stable Edge for Business versions, starting with version 144.

Browser profile coverage

For unmanaged applications on eligible managed Windows devices, policies apply across:

• Edge work profiles.
• Edge personal profiles.
• Edge InPrivate profiles.

This differs from managed-app protection, which operates in the supported work-profile context.

Supported activities

A text submission to an AI service may be evaluated as a text-upload interaction.

This differs from the traditional Endpoint DLP Paste to supported browsers activity.

Inline evaluation limits

Microsoft documents the following limits:

• Text uploads: up to 4 MB.
• File uploads: up to 3 MB.

Some AI applications use encoded content or dynamically generated endpoints, which may affect enforcement.

Organizations should validate the specific AI applications used by employees.

12. Automatic Activation of Edge Browser DLP Policies

Microsoft provides automatic activation for supported unmanaged-app browser DLP policies.

When the first relevant Purview DLP or collection policy is saved, Microsoft Edge management services create supporting configurations.

These may include:

• Microsoft Entra security groups.
• Microsoft Edge configuration policies.
• Microsoft Intune policies.
• Browser bypass prevention settings.

Activation workflow

Step 1 — Define the policy in Purview

Create a DLP policy targeting supported unmanaged applications.

Specify the users, groups, conditions, and enforcement actions.

Step 2 — Create supporting security groups

Microsoft automatically creates supporting groups for policy targeting and exclusions.

Step 3 — Configure Edge

The Edge management service creates the necessary browser configuration policies.

Step 4 — Configure Intune

Supporting Intune policies are created to help prevent bypass through unprotected browsers.

Step 5 — Synchronize policy changes

Updates to the relevant Purview policy are synchronized with the supporting configuration.

Important operational consideration

If automatic activation fails, the policy is not enforced until the issue is resolved.

Administrators should review activation status and verify that the required configuration has been deployed successfully.

13. Preventing Browser Bypass

Browser bypass prevention is especially important for unmanaged AI applications.

Consider an employee attempting to upload sensitive information to ChatGPT.

The organization has configured a blocking policy in Edge for Business.

Without additional controls, the employee might try another browser.

For applicable blocking policies, Microsoft can automatically configure restrictions that prevent access to protected unmanaged applications through unprotected browsers.

This helps direct users to the protected Edge for Business environment.

The exact behavior depends on the supported configuration and successful policy activation.

It should be validated during pilot deployment.

14. Microsoft Purview DSPM: Discovering AI Risks and Driving Browser DLP Protection

Browser DLP focuses on evaluating and enforcing specific data activities.

However, organizations also need to understand which AI applications employees use, what sensitive information may be exposed, and where protection gaps exist.

This is where Microsoft Purview Data Security Posture Management (DSPM) becomes important.

From DSPM for AI to unified DSPM

Microsoft has introduced a newer unified DSPM experience.

The previous experience is now documented as DSPM for AI (classic).

The unified experience brings together discovery, data risk assessments, remediation recommendations, and reporting.

This allows organizations to approach AI data security as part of a broader data security posture management strategy.

What DSPM provides

DSPM helps organizations:

• Discover supported AI applications and agents.
• Investigate AI-related data activities.
• Identify sensitive data exposure risks.
• Assess data security posture.
• Review recommended remediation actions.
• Monitor relevant AI protection policies.
• Analyze supported Microsoft 365 Copilot activities.

DSPM is not itself a replacement for Endpoint DLP or Edge browser DLP.

It provides the visibility, risk context, and recommendations that help security teams select and prioritize controls.

Understanding the new DSPM navigation

Microsoft documents the following mapping from DSPM for AI (classic) to the newer DSPM experience.

These locations help administrators find the relevant AI security capabilities within the unified DSPM experience.

Practical scenario: Discovering Shadow AI

Consider an organization where employees regularly use generative AI services.

The security team does not know which applications are being used or whether sensitive corporate information is being shared.

A practical DSPM-driven workflow would be:

Step 1 — Discover AI usage

Use DSPM to review supported AI applications, agents, and related activity.

Identify which applications are being used and where visibility is available.

Step 2 — Assess sensitive data exposure

Review available data risk assessments and AI activity insights.

Determine whether sensitive information is involved in supported AI interactions.

Step 3 — Prioritize applications

Identify unmanaged AI services that present the greatest data security concerns.

Consider business use, sensitive data exposure, and existing controls.

Step 4 — Deploy appropriate protection

Use the available remediation recommendations and supported policy workflows to configure relevant controls.

Depending on the scenario, these may include:

• Endpoint DLP.
• Paste to supported browsers.
• Edge for Business browser DLP.
• Policies protecting sensitive information shared with unmanaged AI applications.

Step 5 — Monitor enforcement

Review the relevant DLP activities, alerts, and DSPM reports.

Confirm whether the policies are reducing the identified risks.

Recommended AI data security architecture

The following model separates visibility from enforcement.

This approach allows organizations to use DSPM insights to guide DLP policy design.

DSPM and AI policy recommendations

Microsoft documents recommended policies for monitoring and restricting sensitive information shared with supported unmanaged AI applications.

Where available, administrators can use guided or simplified policy creation workflows.

However, policy recommendations should still be reviewed against the organization’s licensing, device readiness, supported applications, and business requirements.

DSPM identifies and prioritizes risks. DLP provides the applicable enforcement.

15. Understanding Licensing Requirements

Licensing depends on the protection architecture.

Organizations should verify subscription eligibility, billing requirements, and supported features before deployment.

Do not assume that all browser DLP or DSPM capabilities are included automatically with Microsoft 365 E5.

16. Monitoring and Investigating Browser DLP Activities

After deployment, security teams need visibility into policy matches, user activity, and sensitive data exposure.

Microsoft provides several complementary investigation capabilities.

Microsoft Purview Activity Explorer

Activity Explorer helps administrators review supported DLP activities and enforcement events.

For browser-native DLP, relevant events can be filtered using the browser enforcement plane.

Microsoft Purview DLP alerts

DLP alerts provide visibility into policy violations that meet the configured alert conditions.

Microsoft Defender XDR

Supported browser DLP events can also be investigated through Microsoft Defender XDR.

Microsoft Purview DSPM

DSPM provides a broader view of data security risks, including supported AI activities and associated recommendations.

Recommended investigation workflow

1. Review the detected activity.
2. Identify the sensitive information involved.
3. Confirm the destination application.
4. Review the policy and enforcement action.
5. Determine whether the activity represents a legitimate business requirement.
6. Investigate potential data exposure.
7. Adjust policies and exceptions where appropriate.
8. Monitor recurring violations.

Not every DLP event requires incident response escalation.

Security teams should prioritize events according to data sensitivity, destination, user context, and business impact.

17. Policy Conflicts and Deployment Considerations

Microsoft documents several important limitations.

Managed-app policy conflicts

Managed-app browser DLP may not apply as expected when users are simultaneously targeted by certain Defender session policies or Endpoint DLP policies.

Review policy scope and exclusions carefully.

B2B guest users

Microsoft documents limitations involving B2B guest users for browser and network data security policies.

Do not assume that guest access receives the same protection as internal users.

Existing application sessions

Managed-app browser DLP policies may not apply immediately to active sessions.

Users may need to reauthenticate after existing tokens expire.

Policy synchronization

Browser-native DLP uses a different activation and delivery mechanism from traditional Endpoint DLP.

Review the relevant browser policy activation status rather than relying exclusively on Endpoint DLP synchronization indicators.

AI application limitations

Encoded content, dynamic endpoints, and inline evaluation limits can affect unmanaged AI application enforcement.

Always test the actual applications used in the organization.

18. Recommended Enterprise Deployment Strategy

I recommend organizing implementation into four workstreams.

Workstream A — Endpoint DLP and browser extensions

Objective: Protect sensitive information on onboarded corporate devices.

Implementation activities:

1. Assess Endpoint DLP readiness.
2. Verify device onboarding.
3. Review sensitive information types and sensitivity labels.
4. Deploy Chrome and Firefox extensions where required.
5. Configure restricted service domains.
6. Configure Paste to supported browsers.
7. Pilot audit and blocking policies.
8. Review Activity Explorer.

Workstream B — Edge for Business DLP for BYOD

Objective: Protect supported corporate application interactions on unmanaged devices.

Implementation activities:

1. Identify supported Microsoft Entra-connected applications.
2. Define the BYOD access model.
3. Configure Conditional Access and required integrations.
4. Enable Edge in-browser protection.
5. Create managed-app browser DLP policies.
6. Test supported activities.
7. Validate work-profile enforcement.
8. Review conflicts and exclusions.

Workstream C — Edge for Business DLP for AI applications

Objective: Protect sensitive information shared with supported unmanaged AI services.

Implementation activities:

1. Identify supported AI applications.
2. Verify Intune-managed Windows devices.
3. Validate Edge version requirements.
4. Confirm licensing and billing.
5. Create unmanaged-app browser DLP policies.
6. Verify automatic activation.
7. Test text and file uploads.
8. Validate browser bypass prevention.
9. Review DLP events.

Workstream D — DSPM and AI security posture

Objective: Discover AI risks, prioritize protection, and measure security posture.

Implementation activities:

1. Review AI application and agent discovery.
2. Analyze supported AI activities.
3. Assess sensitive data exposure.
4. Review data risk assessments.
5. Prioritize remediation recommendations.
6. Deploy appropriate DLP controls.
7. Monitor policy effectiveness.
8. Review DSPM reports and security trends.

19. Practical Validation Checklist

Before production rollout, validate each architecture separately.

Endpoint DLP

• Devices are onboarded successfully.
• Chrome and Firefox extensions are installed where required.
• Sensitive file-upload restrictions work.
• Paste to supported browsers is tested.
• Relevant events appear in Activity Explorer.

Managed-app browser DLP

• Supported applications are configured.
• Conditional Access integration is operational.
• Edge work profiles are used.
• Supported browser activities are evaluated.
• BYOD restrictions behave as expected.

Unmanaged AI browser DLP

• Devices meet Intune and Windows requirements.
• Edge for Business is supported and updated.
• Billing is configured.
• Automatic activation completes.
• Text and file uploads are tested.
• Browser bypass prevention is validated.

DSPM

• AI discovery data is available.
• Relevant AI activities are visible.
• Data risks are assessed.
• Remediation recommendations are reviewed.
• Applicable DLP policies are deployed.
• Monitoring and reporting are operational.

Use synthetic sensitive information throughout testing.

20. Common Implementation Mistakes

Mistake 1 — Assuming browser extensions replace Endpoint DLP onboarding.

Chrome and Firefox extensions require the supported Endpoint DLP architecture on Windows.

Mistake 2 — Assuming Edge browser DLP requires Endpoint DLP onboarding.

Browser-native DLP in Edge for Business can operate without Endpoint DLP onboarding in supported scenarios.

Mistake 3 — Treating managed and unmanaged cloud applications identically.

These application categories have different device requirements and supported activities.

Mistake 4 — Assuming unmanaged BYOD devices receive universal AI protection.

Managed-app browser DLP on BYOD is not equivalent to unmanaged AI application protection on Intune-managed Windows devices.

Mistake 5 — Confusing Paste to supported browsers with AI text-upload inspection.

These are different activities and enforcement mechanisms.

Mistake 6 — Assuming DSPM automatically blocks sensitive data.

DSPM provides discovery, assessment, and remediation guidance. Applicable DLP policies provide enforcement.

Mistake 7 — Ignoring automatic activation failures.

Unmanaged-app browser DLP policies are not enforced until the required supporting configurations activate successfully.

Mistake 8 — Assuming all browsers have identical capabilities.

Browser-specific Endpoint DLP controls vary, and Edge browser-native DLP uses a separate architecture.

Mistake 9 — Enabling blocking without testing.

Always validate user experience, policy scope, exceptions, and monitoring before broad deployment.

21. Conclusion

Microsoft Purview browser data protection has evolved beyond traditional Endpoint DLP and browser extensions.

Organizations now have several complementary enforcement architectures.

Microsoft Purview Endpoint DLP protects supported sensitive data activities on onboarded devices, with Chrome and Firefox extensions providing browser integration on Windows.

Microsoft Edge for Business DLP protects supported corporate application interactions directly in the browser, including on eligible unmanaged BYOD devices.

For unmanaged AI applications, Edge for Business provides additional browser-native DLP capabilities on Intune-managed Windows devices, with automatic policy activation and browser bypass prevention.

Microsoft Purview DSPM adds another essential layer by helping organizations discover AI usage, identify sensitive data exposure, assess risks, and prioritize appropriate protection.

Together, these capabilities support a broader data security strategy:

Discover sensitive data risks. Understand AI usage. Apply the appropriate DLP controls. Monitor enforcement. Continuously improve security posture.

The future of enterprise data security is not simply protecting files on managed endpoints.

It is protecting sensitive information wherever supported business and AI interactions occur.

Official Microsoft Documentation

The following Microsoft Learn resources provide additional implementation guidance and technical details.

1. Learn about DLP for Cloud Apps in Microsoft Edge for Business
2. Prevent sensitive data sharing with unmanaged AI apps
3. Automatic activation of Microsoft Purview DLP policies in Edge
4. Deploy the Microsoft Purview Chrome extension
5. Learn about the Microsoft Purview Chrome extension
6. Learn about the Microsoft Purview Firefox extension
7. Configure Endpoint DLP settings
8. Restrict sensitive information pasted into browsers
9. Microsoft Purview Endpoint DLP
10. Map DSPM for AI (classic) tasks to the new DSPM experience
11. Microsoft Purview considerations for AI
12. Protect data in third-party AI applications
13. Microsoft Entra Conditional Access overview