--- title: "Fix Purview DLP Paste to Browser Blocks on AI Sites" description: "Purview DLP paste blocks fall back to an allow rule. Fix the domain group, rule condition, and browser coverage, then prove it in Activity Explorer." canonical: "https://adamtheautomator.com/purview-dlp-paste-blocks-ai-sites/" --- # Fix Purview DLP Paste to Browser Blocks on AI Sites > Purview DLP paste blocks fall back to an allow rule. Fix the domain group, rule condition, and browser coverage, then prove it in Activity Explorer. Source: https://adamtheautomator.com/purview-dlp-paste-blocks-ai-sites/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Fix Purview DLP Paste to Browser Blocks on AI Sites](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b8163bfd8c19fffd29114/f9a5917f2b479095fe70fd66284d12c7457277d162ce2002d4247ecb24613ff2.webp) # Fix Purview DLP Paste to Browser Blocks on AI Sites [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)20 October 202610 min. read Categories: [Information Security](/category/infosec/) Tags:[Microsoft 365](/tag/microsoft-365/)[Security](/tag/security/)[Endpoint Management](/tag/endpoint-management/)[AI](/tag/ai/) Table of Contents * [Why the Block Rule Never Reaches PastedToBrowser](#why-the-block-rule-never-reaches-pastedtobrowser) * [What Enforcement = Allow Tells You](#what-enforcement--allow-tells-you) * [How Purview Inspects a Paste](#how-purview-inspects-a-paste) * [Why EDM and Trainable Classifiers Never Fire](#why-edm-and-trainable-classifiers-never-fire) * [Prerequisites: License, OS, and Device Scope](#prerequisites-license-os-and-device-scope) * [Step 1: Build the Sensitive Service Domain Group for AI Sites](#step-1-build-the-sensitive-service-domain-group-for-ai-sites) * [Syntax That Matches the Real URL](#syntax-that-matches-the-real-url) * [Step 2: Attach the Group to Paste to Supported Browsers](#step-2-attach-the-group-to-paste-to-supported-browsers) * [Only the SIT Condition Fires the Paste Action](#only-the-sit-condition-fires-the-paste-action) * [Leave the Global List on Block](#leave-the-global-list-on-block) * [Step 3: Prove the Match in Activity Explorer](#step-3-prove-the-match-in-activity-explorer) * [Where Coverage Stops: Extensions and Permissions](#where-coverage-stops-extensions-and-permissions) * [Windows: Two Browsers Carry a Dependency](#windows-two-browsers-carry-a-dependency) * [macOS: A Permission Instead of an Extension](#macos-a-permission-instead-of-an-extension) * [Test With Synthetic Data Before You Enforce](#test-with-synthetic-data-before-you-enforce) * [The Diagnostic Checklist](#the-diagnostic-checklist) * [What to Change Before the Next Paste](#what-to-change-before-the-next-paste) Do not sign off on a paste-block rollout until you have watched one blocked paste land in Activity Explorer with **Block** in the Enforcement column. A rule that never fires reads exactly like a rule that works when you scan the policy list, and the difference surfaces when someone [pastes a customer list into a public model](https://adamtheautomator.com/stop-shadow-ai-microsoft-purview/) on a Friday afternoon. The policy exists, the device is onboarded, the test document holds a valid Social Security number, and the paste still goes through. Activity Explorer records the event and credits a rule you never wrote. ## Why the Block Rule Never Reaches PastedToBrowser You will not see a block unless your rule reaches the `PastedToBrowser` activity that Microsoft Purview Endpoint Data Loss Prevention logs for a browser paste. Purview DLP sets tighter requirements on that activity than on the rest of your endpoint policy. Microsoft’s [troubleshooting article for Paste to supported browsers](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/purview/data-loss-prevention/diagnose-paste-to-supported-browser-issues) names two design points behind many failures, then states the first: “The Paste to browser activity requires rules that are configured to work with Sensitive service domain groups. The activity isn’t supported with the flat Service domains Endpoint DLP setting.” The flat Service domains list governs file uploads, so a domain added there never reached your paste rule. ### What Enforcement = Allow Tells You Activity Explorer exports from broken tenants carry one repeated line: Policy reads **Default Policy**, Rule reads **JIT Fallback Allow Rule**, Other matches reads **0**, and Enforcement reads **Allow**. One unresolved [Microsoft Tech Community thread](https://techcommunity.microsoft.com/discussions/azurepurview/dlp-policy---dspm-block-sensitive-info-from-ai-sites/4511198) shows that export from a tenant where upload blocking worked and paste blocking did not. Microsoft’s documentation does not describe the JIT fallback label, so read it as a symptom marker: no rule matched this activity and the agent fell through to a default that allows it. Upload enforcement working from the same group proves the pipeline and the group entries are fine, which leaves the rule condition and the paste action. ## How Purview Inspects a Paste The clipboard is what gets classified. Microsoft describes the evaluation this way: “The Paste to supported browsers activity evaluates the content in the clipboard at the moment it’s pasted into a supported browser. The activity evaluates the pasted content independently of the source file’s classification, and applies an action, such as Audit, Block with override, or Block, based on the destination website.” Relabeling the source workbook changes nothing, and neither does copying from an unlabeled Notepad window, because the clipboard text is what gets classified. If the raw text in the clipboard matches a sensitive information type (SIT), the paste matches. ### Why EDM and Trainable Classifiers Never Fire Classification runs locally, which is where the second trap sits. Microsoft states it without hedging: “Sensitive information types (SITs) that depend on advanced classification, Exact Data Match (EDM), named entities, trainable classifiers, and credential classifiers don’t trigger on a paste action even when they’re configured correctly.” A rule built only on an [exact data match](https://learn.microsoft.com/en-us/purview/sit-learn-about-exact-data-match-based-sits) schema, a [trainable classifier](https://learn.microsoft.com/en-us/purview/trainable-classifiers-get-started-with), a named entity SIT, or a credential SIT cannot fire here. The permitted building blocks are pattern-based: regular expressions, keywords, functions, credit card numbers, Social Security numbers, and custom keyword dictionaries. Microsoft states the consequence: “If your rule relies on EDM or a trainable classifier, the paste action isn’t blocked. This behavior is by design.” The diagram below shows what the endpoint agent evaluates at paste time, and where the advanced classifiers drop out of the pipeline. ![Paste evaluation path](https://adamtheautomator.com/wp-content/uploads/publisher/be2a5a2217318e74550da9e400675556452fa705960932bec881ce2b07f52243.jpg) ## Prerequisites: License, OS, and Device Scope You have five gates to clear, and a miss in any one makes every later check pointless. | Gate | What Microsoft requires | | --- | --- | | License | Microsoft 365 E5 or A5, E5 Compliance, or E5 Information Protection and Governance | | Operating system | [Windows 10 1809 or later, Windows 11, or one of the three latest macOS releases](https://learn.microsoft.com/en-us/purview/endpoint-dlp-learn-about) | | Onboarding | Defender for Endpoint and Endpoint DLP, with healthy sync status in the Purview portal | | Browser | A browser supported for that operating system | | Scope | The signed-in user or device inside the policy’s **Devices** location | The license row deserves a blunt warning for Microsoft 365 E3 tenants. You can build the rule, scope it, watch the policy show as applied, and never see a paste event, because endpoint paste inspection is licensed through a plan you do not own. Microsoft’s [security and compliance licensing guidance](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance) lists endpoint protection as its own service plan, “Microsoft Data Loss Prevention Endpoint Data Loss Protection (DLP),” separate from the DLP plan covering Exchange, SharePoint, and OneDrive. On E3, the path is the Microsoft 365 E5 Compliance add-on named in that prerequisites row. Device scope fails just as quietly. A rule scoped to a group that excludes your test laptop produces no event and no error, so confirm membership against the [Endpoint DLP onboarding states](https://learn.microsoft.com/en-us/purview/endpoint-dlp-getting-started) first. ## Step 1: Build the Sensitive Service Domain Group for AI Sites The group editor sits in the Purview portal under **Settings** > **Data Loss Prevention** > **Endpoint settings** > **Browser and domain restrictions to sensitive data** > **Sensitive service domain groups**. Give the group a name that describes its job. Microsoft also ships a built-in **Generative AI Websites** group covering the major public AI sites, so check for it before you build one. Microsoft repeats the flat-list warning on the [endpoint settings reference](https://learn.microsoft.com/en-us/purview/dlp-configure-endpoint-settings): “The Service domains list setting only applies to file uploads to websites. Actions like pasting into a browser don’t follow the Service Domain list.” | Destination | Entry that covers it | What the wrong entry misses | | --- | --- | --- | | ChatGPT | `*.chatgpt.com` | `www.chatgpt.com` covers that host alone and misses the bare domain | | Legacy ChatGPT host | `chat.openai.com` | Add it if anyone still lands there; `*.chatgpt.com` will not match the legacy host | | Claude | `*.claude.ai` | `claude.ai` covers subsites but not `www.claude.ai` | | Gemini | `gemini.google.com` | `*.google.com` also captures Gmail and Drive | | Microsoft 365 Copilot | `copilot.microsoft.com`, `copilot.com`, `m365.cloud.microsoft` | `*.microsoft.com` is too broad; list the exact hosts and confirm the landing host in Activity Explorer’s Target domain field | ### Syntax That Matches the Real URL * No protocol. `https://chatgpt.com` will not match; enter `chatgpt.com`. * A bare domain covers that site and its subsites, not its subdomains. `contoso.com` matches `/allsubsites1` and misses `www.contoso.com`. * `*.` is legal only at the start and covers the domain plus every subdomain. * A trailing `/` narrows the entry to that site alone, dropping every subsite. Confirm the destination instead of assuming it. Activity Explorer records a **Target domain** per paste event, and that value shows the host the browser actually reported. Microsoft’s [DLP endpoint settings limits](https://learn.microsoft.com/en-us/purview/dlp-configure-endpoint-settings) put 50 domains on the flat list, 100 websites per sensitive service domain group, and 150 groups per tenant, for “a maximum of 15,000 websites that the policy actions can be assigned to.” The document states the 100-website cap and nothing about what the portal does at entry 101, so count the entries in your group rather than expect a warning. ## Step 2: Attach the Group to Paste to Supported Browsers You change nothing until a rule references your group, and that missing reference is the half of the configuration admins skip. The [paste-restriction scenario](https://learn.microsoft.com/en-us/purview/endpoint-dlp-create-policy-restrict-paste-in-browsers) walks the build: 1. Scope the policy to **Devices** only, leaving [Exchange, SharePoint, OneDrive, and Teams](https://adamtheautomator.com/microsoft-purview-dlp-policies/) out of it. 2. Set the condition to **Content contains** > **Sensitive information types** and pick the pattern-based SITs you validated. 3. Under **Actions** > **Audit or restrict activities on devices**, enable **Paste to supported browsers**. 4. Choose **Choose different restrictions for sensitive service domains**, add the group, and set its action to **Block** or **Block with override**. ### Only the SIT Condition Fires the Paste Action A rule can look right in the summary and still never fire, because the action binds to one condition shape. Microsoft ties it to the SIT condition and says so: “Paste to browser is supported only when the rule uses this condition. If the rule uses a different condition, the Paste to browser action doesn’t trigger.” Sensitivity label, sharing, and document property conditions all sit outside that shape. If your rule keys off a label, clone it and rebuild the condition as a SIT match. The diagram below shows where the paste action gets its destination list, and where the flat Service domains list fails to connect. ![Destination wiring](https://adamtheautomator.com/wp-content/uploads/publisher/555737319b34cc60e7ef21afc5dd5a69c43240f10ceec9e091b0109e2458a836.jpg) ### Leave the Global List on Block The Service domains setting has its own Allow/Block dropdown, and it interacts with rule enforcement in ways that read as flakiness. Microsoft says leave it alone: “Even when enforcement is driven through Sensitive service domain groups, leave the global Service domains action in Endpoint settings > Browser and domain restrictions to sensitive data set to Block. Setting it to Allow can cause the policy to behave erratically.” * * * _**Warning: Setting the global Service domains action to Allow because “we only want to block paste” opens uploads to every site your rules do not name, and changes nothing about paste.**_ * * * ## Step 3: Prove the Match in Activity Explorer Run the rule in [simulation mode](https://learn.microsoft.com/en-us/purview/dlp-simulation-mode-get-started) before enforcing anything, then read **Solutions** > **Data Loss Prevention** > **Activity explorer**. Simulation logs matches without interrupting users, which is the only safe way to learn whether your SIT thresholds produce a block or no enforcement at all. | Field | Working event | Broken event | | --- | --- | --- | | Activity | PastedToBrowser | PastedToBrowser | | Policy and rule | Your policy and rule names | Default Policy, JIT Fallback Allow Rule | | Enforcement | Block or Block with override | Allow | | Target domain | The host in your group | The same host | | Sensitive info type | Your SIT, confidence above threshold | Empty, Other matches at 0 | A matching target domain with Enforcement on Allow means the destination was recognized and the content never matched, which points at Step 2. A wrong target domain points back at Step 1. Give the agent time before drawing conclusions. Microsoft’s [paste troubleshooting guide](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/purview/data-loss-prevention/diagnose-paste-to-supported-browser-issues) states that a newly created or edited policy “can take up to approximately 60 minutes to sync to onboarded devices,” and that changes to user or group membership “can take approximately 24 hours to come into policy scope.” An offline laptop picks up the policy only after it reconnects. ## Where Coverage Stops: Extensions and Permissions You get paste interception only when the browser reports its own context, and that dependency differs by platform. | Browser | Windows | macOS | | --- | --- | --- | | Microsoft Edge | Native | Native | | Google Chrome | [Purview extension](https://learn.microsoft.com/en-us/purview/dlp-chrome-get-started) required | Native | | Mozilla Firefox | [Purview extension](https://learn.microsoft.com/en-us/purview/dlp-firefox-extension-get-started) required | Native | | Safari | Not applicable | Native | ### Windows: Two Browsers Carry a Dependency Chrome and Firefox report context through the Microsoft Purview browser extension, deployed through Intune or Group Policy, with the Chrome force-install entry pairing extension ID `echcggldkblhodogklpincgchnpgcdco` to `https://clients2.google.com/service/update2/crx`. A profile that blocks extensions, a policy that never reached the machine, and an extension installed but disabled all produce one result: no event, no tip, no error. Browsers outside the matrix fall to the **Unallowed browsers** setting, which blocks sensitive content from Brave, Opera, and anything else that cannot report context. ### macOS: A Permission Instead of an Extension macOS needs no extension, which makes it easier to deploy and harder to diagnose, because the failure lives in a privacy setting. Before macOS 27, Endpoint DLP read browser context through **Accessibility**; in macOS 27 and later, the [permission model changed](https://learn.microsoft.com/en-us/purview/endpoint-dlp-macos-27-changes): Endpoint DLP now “uses **Device Control and Data Access** permission to support browser visibility, activity monitoring, and policy enforcement,” found under **Settings** > **Privacy & Security**, on client version 101.26072 or later. The failure runs opposite to Windows. With the permission off, the agent loses URL context for Safari, Chrome, and Firefox and falls back to **Restricted protection mode for paste to browser**, which defaults to Enforce, so your block and warn actions apply with no destination to match against. Users get blocked on sites you never listed, and no policy edit explains it. Browser-level DLP also “can stop working after an operating system update if the system extension breaks, even when the Microsoft Purview portal still shows the device as healthy.” ## Test With Synthetic Data Before You Enforce A block rule you have not tested with disposable content has no evidence behind it. Build a throwaway document holding a Social Security number that passes Purview’s format checks and a card number that passes the Luhn check, the checksum every payment card number satisfies. `4111 1111 1111 1111`, the published Visa test number, passes Luhn, but Microsoft’s [credit card SIT](https://learn.microsoft.com/en-us/purview/sit-defn-credit-card-number) doesn’t flag reserved test numbers; generate a Luhn-valid number from an unreserved BIN and confirm it in **Test**. Validate the sample first. Open **Solutions** > **Data Loss Prevention** > **Classifiers** > [**Sensitive info types**](https://learn.microsoft.com/en-us/purview/sensitive-information-type-learn-about), select your SIT, and run **Test** to see occurrence count and confidence against your exact text. A sample below the confidence threshold produces no event, exactly like a broken rule. 1. Copy the sample from the throwaway document on an in-scope device. 2. Paste into the AI site’s prompt box in Edge first, since Edge needs no extension on either platform, and note the block toast or override prompt. 3. Confirm the event in Activity Explorer carries your policy, rule, target domain, and SIT above threshold. 4. Repeat in Chrome and Firefox on Windows, then Chrome and Safari on macOS. 5. Upload the same file to the same site as a control. * * * _**Key Insight: Paste and upload read different lists. A successful upload block on chatgpt.com proves the device, the extension, and the group entry all work. It says nothing about whether the paste rule matches, which is why the control belongs in the same test session.**_ * * * ## The Diagnostic Checklist Work this in order. Each check eliminates a class of cause. 1. **License.** Confirm E5, A5, E5 Compliance, or E5 Information Protection and Governance. 2. **Scope.** Confirm **Devices** is selected, the test user or device is inside it, and the device shows healthy onboarding and policy sync. 3. **Action.** Confirm **Paste to supported browsers** is enabled with Block, Block with override, or Audit. 4. **Condition.** Confirm **Content contains** > **Sensitive information types**. 5. **Classifier.** Confirm the SIT is pattern-based. EDM, named entities, trainable classifiers, and credential classifiers never fire on paste. 6. **Sample.** Test the SIT against your exact text and check occurrence count and confidence. 7. **Domain group.** Confirm the destination is in a sensitive service domain group and that the rule’s paste action references it. 8. **Syntax.** Confirm no protocol in the entry, `*.` only at the start, and a match against the **Target domain** in Activity Explorer. 9. **Global action.** Confirm the Service domains dropdown reads **Block**. 10. **Browser.** Confirm the browser is supported for the OS and, on Windows, that the Purview extension is installed, enabled, and current. Then wait out the roughly 60-minute policy sync and the 24-hour group membership window. 11. **Trace.** If the event still falls back to the allow rule, pull the Endpoint DLP trace with Always-on diagnostics (the Endpoint DLP feature that stores endpoint events on the device for later collection), or run `MDEClientAnalyzer.cmd -t` from an elevated prompt. Microsoft publishes a [client analyzer guide](https://learn.microsoft.com/en-us/defender-endpoint/overview-client-analyzer) for that path. ## What to Change Before the Next Paste Move the destination out of the flat Service domains list and into a sensitive service domain group, then reference that group in the paste action. Rebuild any rule whose condition is not a SIT match, replace EDM and trainable-classifier dependencies with a keyword dictionary or a pattern SIT, and leave the global Service domains action on Block. Auditors read the Activity Explorer event. A policy showing Block in the portal and Allow in [Activity Explorer](https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer) is the gap auditors find, and you want that conversation to be about tuning thresholds rather than explaining why the control never ran. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fpurview-dlp-paste-blocks-ai-sites%2F&text=Fix%20Purview%20DLP%20Paste%20to%20Browser%20Blocks%20on%20AI%20Sites)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fpurview-dlp-paste-blocks-ai-sites%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fpurview-dlp-paste-blocks-ai-sites%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b812193d4cc7a6d4be13d/1daf00385836df44b470b450d81ec18105c2ccff55f54f2fd2f72592fca6e34c.png) ### [Stop Impersonation: Verify Identity at Onboarding](/identity-verification-onboarding/) Prevent impersonation by verifying identity during onboarding. Why identity proofing must happen before provisioning access to new hires. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b811abe48f654e457f7e2/690ce33be28df06aba492262db9a7509c7621c624fe455abff00c8b5b3edb0b4.webp) ### [Stop Copilot Audit Gaps: Retain Chats with Purview](/retain-copilot-chats-purview-audit/) Retain Copilot prompts and responses for an audit. Scope a Purview policy to Microsoft Copilot experiences, then prove the chats in eDiscovery. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b8179a90ac78068758b8e/a73d28e0d4b237b4d869f4d1e51a24f3720c1bc819ff3ef01894ea81641429d2.jpg) ### [Stop Copilot Summarizing Confidential Files with Purview DLP](/exclude-confidential-files-copilot-dlp/) Build a Purview DLP policy that stops Microsoft 365 Copilot processing labeled files, then probe the citations and prompt uploads that still leak. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)