Endpoint DLP in Chrome and Firefox: deploying the Microsoft Purview extension with Intune

Microsoft Edge enforces endpoint DLP out of the box. Chrome and Firefox don't: until the Microsoft Purview extension is installed, the best you can do is list them as unallowed browsers and push users to Edge. In this post I'll deploy the extension to both browsers with Intune (and Group Policy), close the Incognito gap, adjust the unallowed browsers list, and prove enforcement works.

Prerequisites#

• Windows devices onboarded to endpoint DLP and healthy; see fixing endpoint DLP device status. Your organization must be licensed for endpoint DLP.
• Windows 10 x64 build 1809 or later, with anti-malware client 4.18.2202.x or later.
• The extensions are for Windows. Microsoft notes that macOS devices don't need the Chrome extension for DLP enforcement.
• Microsoft lists "command access for the user" as a prerequisite for the Chrome extension. If you lock down command-line access for standard users, test on those devices first.
• A DLP policy with the Devices location and endpoint settings for service domains and browsers; see endpoint DLP settings.

With the extension, Chrome can audit, block with override or block when a user uploads a sensitive file to a restricted service domain, prints it, copies from it to the clipboard, or saves it to removable storage or a network share. Edge still supports the most browser activities in sensitive service domain groups, such as printing a site or saving it locally; Chrome and Firefox with the extension cover uploads and pasting.

Step-by-step#

1. Decide what happens to the unallowed browsers list#

For a full rollout, remove Chrome and Firefox from the unallowed browsers and unallowed apps lists. During a pilot you can leave them listed: on devices where the extension is installed it bypasses both lists, while other devices keep sending users to Edge.

2. Force-install the Chrome extension with Intune#

1. In the Microsoft Intune admin center create a configuration profile: platform Windows 10 and later, profile type Settings catalog.
2. Choose Add settings › Google › Google Chrome › Extensions, select Configure the list of force-installed apps and extensions and set it to Enabled.
3. Enter this value (extension ID and update URL):

echcggldkblhodogklpincgchnpgcdco;https://clients2.google.com/service/update2/crx

In the same profile, add Chrome's Incognito mode availability setting (IncognitoModeAvailability) and choose Incognito mode disabled. Google states that admins can't force extensions into Incognito, so data-protection extensions must be backed by turning Incognito off. If you use Chrome's native messaging blocklist, Microsoft says you must also allow the extension in a native messaging allowlist. Assign the profile to a device or user group.

With Group Policy, the same value goes into Configure the list of force-installed extensions under Administrative templates › Google › Google Chrome › Extensions (the exact path depends on your templates).

3. Force-install the Firefox extension with Intune#

Firefox needs its ADMX ingested first. Download the latest Firefox ADMX from the Firefox GitHub repository, as Microsoft's guide describes, then create a Templates › Custom profile with this OMA-URI setting (data type String, value = the full contents of firefox.admx):

./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Firefox/Policy/FirefoxAdmx

Then create a second custom profile with this OMA-URI and String value:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettings

<enabled/><data id="ExtensionSettings" value='{"microsoft.defender.browser_extension.native_message_host@microsoft.com": {"installation_mode": "force_installed", "install_url": "https://github.com/microsoft/purview/raw/main/endpointDLP/browser_extension/prod-1.1.0.212.xpi", "updates_disabled": false}}'/>

Keep updates_disabled set to false so the extension updates itself, and check Microsoft's Firefox page for the current install URL before you deploy. With Group Policy, add the same URL to Extensions to install under the Firefox Extensions templates. Microsoft lists Incognito (private browsing) as unsupported for the Firefox extension and says it must be disabled, so turn it off through Firefox's enterprise policies too.

4. Check the policy actions#

Make sure the device rule restricts Upload to a restricted cloud service domain or access from an unallowed browser and the other activities you care about. The service domains list only applies to Edge and to Chrome or Firefox with the extension installed.

Verify#

After users restart the browser:

• Chrome: chrome://extensions lists the Microsoft Purview extension as installed by policy, and chrome://policy (select Reload policies) shows the force-install list and IncognitoModeAvailability with status OK. After the Manifest V3 upgrade, Microsoft expects version 3.0.0.239 or higher.
• Firefox: about:policies shows ExtensionSettings as active, and about:addons lists the extension.
• Enforcement: follow Microsoft's tests. Upload a file containing a matching sensitive info type to a restricted service domain and expect a DLP toast. Then try copying from a protected file to the clipboard, printing it, and saving it to USB and to a network share from the browser.
• Evidence: events appear in Activity explorer (Information protection › Explorers › Activity explorer in the Purview portal), and alerts under Data loss prevention › Alerts.

Tips and troubleshooting#

• A second upload is blocked even to an allowed site. The DLP engine caches files for about 15 minutes after an upload attempt, so a file blocked on one domain can stay blocked on others during that window. Microsoft recommends Edge for uploads in quick succession.
• Extension present, nothing enforced: check the device's configuration and policy sync status, the anti-malware client version, and that the user and device are both in the policy scope.
• Users bounced to Edge: the device lacks the extension while Chrome or Firefox is still on the unallowed browsers list. Check the Intune profile assignment and report.
• Force-install not applied: chrome://policy shows errors or no value. Check for conflicting Group Policy settings and that the device received the profile.
• Insider risk management also needs the Chrome extension to collect browser signals, so one deployment serves both.
• Macs are covered without the Chrome extension; see endpoint DLP on macOS.

References#

• Get started with the Microsoft Purview extension for Chrome (Microsoft Learn)
• Get started with the Microsoft Purview extension for Firefox (Microsoft Learn)
• Learn about the Microsoft Purview extension for Chrome (Microsoft Learn)
• IncognitoModeAvailability (Chrome Enterprise)