Microsoft Purview not Blocking when I copy sensitive data to clipboard from browser

Question

Microsoft Purview not Blocking when I copy sensitive data to clipboard from browser

Vernon Polius 0

Hi,

I am currently in the process of setting up Purview to detect and block copying of Sensitive data and confidential labeled documents in Microsoft Word. Currently the policy works and blocks successfully when I open the documents in the Word Desktop app. When I open the document in the browser version of Word however this does not work. I thought the purview extension in Edge would allow me to do this. I am looking for guidance on how to use purview to block copying of sensitive data or words when the document is opened in the browser version of Word.

0 comments

2 answers

Your answer

Answer 1

Hi Vernon Polius,
The behavior you are experiencing is expected due to how Microsoft Purview DLP enforces protection in Desktop apps vs Web apps.

When the document is opened in Microsoft Word Desktop, the enforcement occurs through Endpoint DLP integrated with the Office client, which allows actions such as Copy to clipboard to be blocked and logged in Activity Explorer.

However, when the same document is opened in Word Online (Word for the Web), the content is rendered through SharePoint/OneDrive in the browser, and clipboard actions depend on browser-based enforcement instead of Office client enforcement. Because of this architectural difference, clipboard blocking may not trigger in Word Online even if the Endpoint DLP policy is configured correctly, and Activity Explorer may not record the event.

Since you confirmed that:

Devices are successfully onboarded to Endpoint DLP

The DLP rule includes “Copy to clipboard = Block”

The policy is scoped to the users and devices

Clipboard blocking works correctly in Word Desktop

This indicates that the policy configuration is correct, and the difference is due to how DLP enforcement works in browser-based Office applications.

For browser scenarios, Microsoft recommends using Microsoft Edge with additional browser protections such as Edge for Business cloud sharing restrictions and protected clipboard policies, which provide deeper integration with Microsoft Purview.
The configuration appears correct, and the difference occurs because Word Desktop uses Office client enforcement while Word Online relies on browser-based enforcement. Implementing Edge browser protection policies together with Endpoint DLP is the recommended approach to provide stronger protection for browser-based Office applications.

Reference Links:
Endpoint Data Loss Prevention overview
Configure Endpoint DLP settings
Prevent cloud sharing from Microsoft Edge for Business

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Please do not forget to "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.

SAI JAGADEESH KUDIPUDI 3,640 Reputation points Microsoft External Staff Moderator

2026-03-24T18:44:35.8533333+00:00

Hi **Vernon Polius,
**I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Answer 2

Jerome Suggs 5

Based on how Purview enforcement typically works, this difference between Desktop Word and Word Online is usually related to where enforcement is happening.

Desktop Word uses the Office client + endpoint DLP integration, so blocking clipboard actions works there.

Word Online relies on service-side DLP (SharePoint/OneDrive) and endpoint/browser integration. The Edge extension alone doesn’t automatically enforce clipboard blocking unless Endpoint DLP and browser-based protections are fully configured.

I would check:

Whether the device is onboarded to Endpoint DLP

Whether the DLP policy targets endpoint devices (not just Exchange/SharePoint)

Whether browser protection settings are enabled

Whether the sensitivity label includes protection vs just classification

If desktop works but browser does not, it usually indicates enforcement is happening at the Office client layer but not the endpoint/browser layer.

You may find this helpful: https://learn.microsoft.com/microsoft-365/compliance/endpoint-dlp

Vernon Polius 0 Reputation points

2026-02-23T14:58:49.5166667+00:00

Hi Jason,

My devices have been onboarded to Purview as well as Microsoft Defender for Enterprise. Currently I have 2 DLP policies, one is set to target those endpoints and 5 specific users accounts and the other DLP policy is set to target the OneDrive accounts of those 5 users as well as 1 sharepoint site.

The endpoint policy has a rule that is looking for content that contains the sensitivity label or contains the Sensitive Info Type (SIT) that I have setup. The SIT contains a list of keywords.

With regards to the browser protection, I have Edge for Business browser protection enabled as seen in the image below:
Jerome Suggs 5 Reputation points

2026-02-23T16:44:56.0233333+00:00

Thanks for the additional detail — that helps clarify the setup.

Based on what you’ve described, it sounds like your Endpoint DLP policy is correctly targeting the devices and users, and that Edge for Business browser protection is enabled.

One important distinction though: Edge for Business browser protection is separate from Endpoint DLP’s browser integration enforcement.

For clipboard blocking in Word Online specifically, enforcement relies on Endpoint DLP monitoring browser activity (the Edge process) and applying the configured rule action there — it’s not controlled solely by the Edge for Business toggle.

A few things I would confirm:

Under Endpoint DLP settings, is browser monitoring enabled?

In the DLP rule itself, is “Block with override” or “Block” explicitly configured for clipboard activity on endpoints?

Are the affected devices showing as healthy and onboarded under Endpoint DLP device status?

Are the users accessing Word Online from managed devices only?

Desktop Word uses Office client integration for enforcement, while Word Online relies on Endpoint DLP browser interception — so differences in behavior can occur even if policies look identical.

If those settings are already confirmed, we may need to look more closely at how the rule conditions are evaluating in the browser context specifically.
Vernon Polius 0 Reputation points

2026-02-23T17:19:51.1433333+00:00

Under Endpoint DLP settings I do not see an option to enable Browser monitoring. The below image is all the options I am seeing under Endpoint DLP settings

The affected devices are showing as healthy under Onboarded devices.

The affected users are using managed devices.
Jerome Suggs 5 Reputation points

2026-02-23T20:55:17.5866667+00:00

At this point, I would focus on the rule configuration itself.

In the Endpoint DLP policy rule, can you confirm:

Under Activities on devices, is “Copy to clipboard” explicitly set to Block (or Block with override)?

Is the rule scoped to apply to device activities (not just SharePoint/OneDrive locations)?

Is the rule configured for “All supported activities” or only specific ones?

Desktop Word enforcement works through Office client integration, but Word Online relies on Endpoint DLP evaluating device activities within the browser process. If the rule isn’t configured to block clipboard activity at the device layer, browser behavior can differ even if the overall policy appears correct.

If you can share how the rule’s device activity section is configured, that should help determine whether this is a rule scope issue rather than an onboarding issue.
Vernon Polius 0 Reputation points

2026-02-23T21:01:06.93+00:00

Yes I have copy to clipboard set to block as seen below:

Also I have my Device policy separate from my OneDrive/Sharepoint Policy. But I do have the Device policy scoped to the 5 accounts, and 3 devices I want to monitor:
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Jerome Suggs 5 Reputation points

2026-02-24T15:27:23.0466667+00:00

Looks like my comment got deleted. So I've made some adjustments, based on the screenshots, the device policy and clipboard block settings look correct.

At this point, I would try to isolate the enforcement context a bit further.

A few quick tests that may help narrow this down:

If you download the same file locally and open it in Word Desktop, does clipboard blocking trigger consistently?

Is the sensitivity label applied manually, or is it only being detected via the SIT rule at runtime?

Does clipboard blocking occur when copying from a labeled file in SharePoint preview (not Word Online)?

Are you testing in Edge (Chromium) while signed in with the targeted user account?

Word Desktop and Word Online rely on different enforcement paths (Office client integration vs browser-based endpoint evaluation), so isolating where the behavior differs should help determine whether this is rule scope or evaluation timing.

If you can share the results of those tests, that will help narrow the cause further.
Vernon Polius 0 Reputation points

2026-02-24T15:44:08.1133333+00:00

For the browser based stuff I have been testing in Edge for Business while signed into one of the targeted user accounts.

I have tested with the file downloaded locally and opened in Word Desktop and it does clipboard blocking consistently.

With regards to the sensitivity label, I had set it manually. But I have also been testing with 2 documents, one with a sensitivity label set, and another without a label set (This one just has data that contains words from the keyword list set in the SIT)

I also notice that when I open the file from word online it opens with this URL which appears to be Sharepoint and clipboard blocking does not work:
Jerome Suggs 5 Reputation points

2026-02-24T18:48:38.7266667+00:00
Since:

Clipboard blocking works consistently in Word Desktop

The file is manually labeled and also tested with SIT conditions

The device is healthy and policy is scoped correctly

Testing is being done in Edge for Business with the targeted user

This suggests the configuration is correct.

At this point, the remaining variable appears to be enforcement behavior specifically within Word Online (SharePoint-rendered content).

Word Desktop uses Office client integration for DLP enforcement. Word Online relies entirely on browser-based endpoint interception while rendering content from SharePoint.

Given that clipboard blocking is not triggering when the document is opened via the SharePoint URL, this may indicate a difference in enforcement behavior between the desktop client and Word for the Web.

To further isolate:

Does clipboard blocking occur when copying from other supported browser-based Office apps?

Are you seeing any Endpoint DLP alerts generated when copying from Word Online in Activity Explorer? If no event is generated at all, that would suggest the activity is not being evaluated at the endpoint layer.

If no alerts are generated and all configuration appears correct, this may require confirmation of expected enforcement behavior for Word Online specifically.
Vernon Polius 0 Reputation points

2026-02-24T19:18:01.9166667+00:00

I have tried sending myself an email with the label document attached as well as test data with the data containing the Keywords from the SIT and opening the email in the outlook web in the browser and clipboard blocking does not happen there either. It also does not block when I try in the Outlook desktop App.

Clipboard blocking does work when I try to copy for an excel file in the Excel Desktop App whether it is labeled or just has the words from the keywords list in it. But it does not work in the cloud version of Excel.

Also looking in the activity explorer I see no records of the copying to clipboard actions taken in the browser. Only records of the ones in the Word Desktop App
Jerome Suggs 5 Reputation points

2026-02-24T20:18:06.5633333+00:00
One additional layer that hasn’t been covered yet is browser-side protection specific to Microsoft Edge.

There are two separate enforcement mechanisms:

Purview Endpoint DLP, which works at the OS level and logs events in Activity Explorer → This appears to be working for desktop Office (Word/Excel), but not for browser-based copy.

Edge Protected Clipboard, a browser-specific feature configured via the Edge Management Service portal → This feature influences how clipboard and screen capture are controlled in Edge, including for web-based apps.

The Purview browser extension helps with policy tips but does not enforce clipboard blocking on its own.

Since purview End-to-End DLP isn’t generating events for web clipboard activity, you may need to confirm whether Edge’s Protected Clipboard and associated screen capture protections are enabled, as documented here:

Prevent cloud sharing from Microsoft Edge https://learn.microsoft.com/en-us/purview/dlp-create-policy-prevent-cloud-sharing-from-edge-biz#steps-to-create-the-policy

Additionally, you can validate:

Whether Edge Protected Clipboard is enabled in your Edge Management Service settings

Whether Screen Capture Protection is enabled alongside it

Whether policies are scoped to include browser content and trusted/untrusted destinations

If those browser protections are not configured, the behavior you’re seeing (desktop blocks work, browser does not) is consistent with known enforcement path differences between Endpoint DLP and browser-based controls.
Vernon Polius 0 Reputation points

2026-02-24T20:31:02.9733333+00:00

I will check those Edge settings that you have listed. I am curious though, will this also apply to Chrome and Firefox? So far I have only been testing with Edge but at some point I will need to test with Chrome and Firefox.
Jerome Suggs 5 Reputation points

2026-02-25T22:06:50.13+00:00

Good question.

Edge Protected Clipboard and screen capture protection are Microsoft Edge-specific policies and do not apply to Chrome or Firefox. Those settings are enforced through Edge management policies and are not honored by other browsers.

Purview Endpoint DLP itself operates at the device level and can still monitor and block certain activities regardless of browser, particularly when working with locally accessed files. However, enforcement coverage can differ depending on whether content is accessed through desktop applications or browser-rendered services like Word Online or Outlook Web.

Microsoft Edge has the deepest integration with Microsoft Purview and Endpoint DLP protections. Chrome and Firefox may not enforce clipboard restrictions in the same way, especially for browser-rendered Office content.

Once you confirm Edge Protected Clipboard behavior, it would be useful to compare results across browsers to understand how enforcement behaves in your specific environment.