Get started with Microsoft Purview Chrome Extension
Use these procedures to roll out the Microsoft Purview Chrome Extension.
Tip
If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview compliance portal trials hub. Learn details about signing up and trial terms.
Note
Microsoft Purview Extension is only applicable to Windows devices. The extension is not necessary for the enforcement of data loss prevention on macOS devices.
Before you begin
To use Microsoft Purview Chrome Extension, the device must be onboarded into endpoint DLP. Review these articles if you are new to DLP or endpoint DLP
- Learn about Microsoft Purview Chrome Extension
- Learn about Microsoft Purview Data Loss Prevention
- Create and Deploy data loss prevention policies
- Learn about endpoint data loss prevention
- Get started with Endpoint data loss prevention
- Onboarding tools and methods for Windows 10/11 devices
- Configure device proxy and internet connection settings for Information Protection
- Using Endpoint data loss prevention
SKU/subscriptions licensing
Before you get started, you should confirm your Microsoft 365 subscription and any add-ons. To access and use Endpoint DLP functionality, you must have one of these subscriptions or add-ons.
- Microsoft 365 E5
- Microsoft 365 A5 (EDU)
- Microsoft 365 E5 compliance
- Microsoft 365 A5 compliance
- Microsoft 365 E5 information protection and governance
- Microsoft 365 A5 information protection and governance
For detailed licensing guidance, see Microsoft 365 licensing guidance for security & compliance.
- Your org must be licensed for Endpoint DLP
- Your devices must be running Windows 10 x64 build 1809 or later.
- The device must have Antimalware Client Version is 4.18.2202.x or later. Check your current version by opening Windows Security app, select the Settings icon, and then select About.
Permissions
Data from Endpoint DLP can be viewed in Activity explorer. There are seven roles that grant permission to activity explorer, the account you use for accessing the data must be a member of any one of them.
- Global admin
- Compliance admin
- Security admin
- Compliance data admin
- Global reader
- Security reader
- Reports reader
Roles and Role Groups
There are roles and role groups that you can use to fine tune your access controls.
Here's a list of applicable roles. To learn more about them, see Permissions in the Microsoft Purview compliance portal.
- Information Protection Admin
- Information Protection Analyst
- Information Protection Investigator
- Information Protection Reader
Here's a list of applicable role groups. To learn more about them, see Permissions in the Microsoft Purview compliance portal.
- Information Protection
- Information Protection Admins
- Information Protection Analysts
- Information Protection Investigators
- Information Protection Readers
Overall installation workflow
Deploying the extension is a multi-phase process. You can choose to install on one machine at a time, or use Microsoft Intune or Group Policy for organization-wide deployments.
- Prepare your devices.
- Basic Setup Single Machine Selfhost
- Deploy using Microsoft Intune
- Deploy using Group Policy
- Test the extension
- Use the Alerts Management Dashboard to viewing Chrome DLP alerts
- Viewing Chrome DLP data in activity explorer
Prepare infrastructure
If you are rolling out the extension to all your monitored Windows 10/11 devices, you should remove Google Chrome from the unallowed app and unallowed browser lists. For more information, see Unallowed browsers. If you are only rolling it out to a few devices, you can leave Chrome on the unallowed browser or unallowed app lists. The extension will bypass the restrictions of both lists for those computers where it is installed.
Prepare your devices
- Use the procedures in these topics to onboard your devices:
Basic Setup Single Machine Selfhost
This is the recommended method.
Navigate to Microsoft Purview Extension - Chrome Web Store (google.com).
Install the extension using the instructions on the Chrome Web Store page.
Deploy using Microsoft Intune
Use this setup method for organization-wide deployments.
Microsoft Intune Force Install Steps
Using the settings catalog, follow these steps to manage Chrome extensions:
Sign in to the Microsoft Intune admin center.
Navigate to Configuration Profiles.
Select Create Profile.
Select Windows 10 and later as the platform.
Select Settings catalog as the profile type.
Select Custom as the template name.
Select Create.
Enter a name and optional description on the Basics tab and select Next.
Select Add settings on the Configuration settings tab.
Select Administrative Templates > Google > Google Chrome > Extensions.
Select Configure the list of force-installed apps and extensions.
Change the toggle to Enabled.
Enter the following value for the extensions and app IDs and update URL:
echcggldkblhodogklpincgchnpgcdco;https://clients2.google.com/service/update2/crx
.Select Next.
Add or edit scope tags on the Scope tags tab as needed and select Next.
Add the required deployment users, devices, and groups on the Assignments tab and select Next.
Add applicability rules on the Applicability Rules tab as required and select Next.
Select Create.
Deploy using Group Policy
If you don't want to use Microsoft Intune, you can use group policies to deploy the extension across your organization.
Adding the Chrome Extension to the ForceInstall List
In the Group Policy Management Editor, navigate to your OU.
Expand the following path Computer/User configuration > Policies > Administrative templates > Classic administrative templates > Google > Google Chrome > Extensions. This path may vary depending on your configuration.
Select Configure the list of force-installed extensions.
Right click and select Edit.
Select Enabled.
Select Show.
Under Value, add the following entry:
echcggldkblhodogklpincgchnpgcdco;https://clients2.google.com/service/update2/crx
Select OK and then Apply.
Test the Extension
Upload to cloud service, or access by unallowed browsers Cloud Egress
- Create or get a sensitive item and, try to upload a file to one of your organization’s restricted service domains. The sensitive data must match one of our built-in Sensitive Info Types, or one of your organization’s sensitive information types. You should get a DLP toast notification on the device you are testing from that shows that this action is not allowed when the file is open.
Testing other DLP scenarios in Chrome
Now that you’ve removed Chrome from the disallowed browsers/apps list, you can test the scenarios below to confirm the behavior meets your organization’s requirements:
- Copy data from a sensitive item to another document using the Clipboard
- To test, open a file that is protected against copy to clipboard actions in the Chrome browser and attempt to copy data from the file.
- Expected Result: A DLP toast notification showing that this action is not allowed when the file is open.
- Print a document
- To test, open a file that is protected against print actions in the Chrome browser and attempt to print the file.
- Expected Result: A DLP toast notification showing that this action is not allowed when the file is open.
- Copy to USB Removeable Media
- To test, try to save the file to a removeable media storage.
- Expected Result: A DLP toast notification showing that this action is not allowed when the file is open.
- Copy to Network Share
- To test, try to save the file to a network share.
- Expected Result: A DLP toast notification showing that this action is not allowed when the file is open.
Use the Alerts Management Dashboard to viewing Chrome DLP alerts
Open the Data loss prevention page in the Microsoft Purview compliance portal and select Alerts.
Refer to the procedures in How to configure and view alerts for your DLP policies to view alerts for your Endpoint DLP policies.
Viewing Chrome DLP data in activity explorer
Open the Data classification page for your domain in the Microsoft Purview compliance portal and choose Activity explorer.
Refer to the procedures in Get started with Activity explorer to access and filter all the data for your Endpoint devices.
Known Issues and Limitations
- Incognito mode is not supported and must be disabled.
Next steps
Now that you have onboarded devices and can view the activity data in Activity explorer, you are ready to move on to your next step where you create DLP policies that protect your sensitive items.
See also
- Learn about Endpoint data loss prevention
- Using Endpoint data loss prevention
- Learn about data loss prevention
- Create and Deploy data loss prevention policies
- Get started with Activity explorer
- Microsoft Defender for Endpoint
- Onboarding tools and methods for Windows 10 machines
- Microsoft 365 subscription
- Azure AD joined devices
- Download the new Microsoft Edge based on Chromium
Feedback
Submit and view feedback for