[HELP] "Action required for browser protections" alert

The warning most likely appeared because the scoping changes forced Purview to rebuild and republish the browser-protection policy. Repeatedly clicking Resync will not make propagation immediate, and the banner can remain for up to 24 hours after the last policy change.

Stop making further changes for now and review each affected DLP policy. Confirm that it is enabled, the Devices location is active, and the same device group is not included and excluded through different scopes. Have a Purview Compliance Administrator perform one resync, then allow a full 24 hours from the last edit.

On one targeted device, confirm that it is still listed as onboarded and active in Purview, update Edge, and use an Edge for Business profile signed in with the organization account. Open edge://management to confirm that Edge is managed and edge://policy to reload browser policies. If the device is Intune-managed, also run a work-account sync from Settings > Accounts > Access work or school.

This alert is not a protection failure, and it is not an Intune assignment problem. It is the Microsoft Edge management service failing to update the artefacts it maintains on your behalf, and the reason Resync keeps returning the error is documented.

WHY RESYNC APPEARS TO DO NOTHING

Purview policies that target user interactions with unmanaged apps in Edge for Business trigger automation in the Edge management service. That automation creates and maintains six objects outside Purview: two Edge configuration policies, two Intune policies, and two security groups, one for included users and one for excluded users.

Every time you change scope in Purview, those groups and policies have to be updated. If the admin performing the change lacks the permission for one of those artefacts, the update fails and the banner returns.

The documentation states it directly: the resync action will not create or update the policies or groups if the admin does not have the required permissions. Clicking Sync now without them is a no-op, which matches exactly what you are seeing.

https://learn.microsoft.com/deployedge/microsoft-edge-dlp-purview-configuration 

THE PERMISSIONS ARE PER ARTEFACT, NOT A SINGLE ROLE

This is the part worth checking. Under "What's automatically created and updated" there is a table listing a different permission requirement for each object:

Edge configuration policies require Microsoft Edge administration.

Intune policies require Microsoft Intune administration and Microsoft Edge administration.

Security groups require Directory Reader and Microsoft Edge administration.

Edge Administrator on its own is not enough. The Entra built-in role grants microsoft.edge/allEntities/allProperties/allTasks and nothing in Intune, so an admin holding only that role will get the Edge configuration policies created and then fail on the Intune ones.

https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference#edge-administrator 

HOW TO IDENTIFY WHICH ONE FAILED

The failure is partial, so you can find the missing permission by checking the three locations and seeing what is absent or stale.

Microsoft 365 admin center, Settings, Microsoft Edge. You should find two read-only policies whose names begin with "Purview - ".

Intune admin center, Devices, Configuration. You should find two policies whose names begin with "Edge policy to block use of".

Microsoft 365 admin center, Active Teams and Groups, Security groups. You should find "Purview DLP browser protection - included users" and "Purview DLP browser protection - excluded users".

Whichever set is missing, or whose membership no longer matches your current Purview scope, tells you which permission the syncing admin is short of. Then have someone holding that permission run Sync now from the Resources tab on the Microsoft Purview DLP protections card.

A TRAP WHEN VERIFYING THE GROUPS

The included-users group will not display individual members if at least one Purview DLP policy targeting Edge for Business is scoped to All users and groups, and that holds even when Exclude from All is configured. An empty looking group is therefore not evidence that the sync failed. Check the Edge and Intune policies before concluding anything.

WORTH RULING OUT, GIVEN YOUR SCOPING WORK

The security groups and policies are shared across every Purview collection and DLP policy that targets unmanaged apps in Edge for Business. They are not created per policy. If you have more than one such policy in the tenant, a scope change on one of them updates the shared set, and the policy failing to apply may not be the one you were editing.

It is also worth confirming which of your policies actually target unmanaged apps in Edge for Business. A policy scoped only to the Devices location does not by itself drive this automation, so the trigger may be coming from elsewhere in the tenant.

FINALLY

Do not troubleshoot the auto-created objects themselves. They are read-only by design and are updated only by changing the Purview policy. Nothing needs fixing directly in Intune or in the Edge configuration policies.

https://learn.microsoft.com/purview/dlp-browser-dlp-learn 

If it persists beyond 1 day or policies truly aren’t applying, then investigate assignment conflicts/overlaps, any missing prerequisites/permissions or the hybrid GPO vs Intune conflicts.

The most common cause could be the policy assignment or scoping conflict. This happens when multiple Edge / browser protection policies are targeted to the same device or user with different scopes (for example, one policy including the device and another excluding it, or user‑based and device‑based assignments overlapping). It can also occur if devices were recently moved between groups, because Intune and Defender may temporarily disagree on which policies should apply until the next full sync cycle completes.

Other frequent causes include hybrid conflicts and prerequisites. If the device is hybrid‑joined, legacy GPOs may still control Edge settings and override Intune policies. Out‑of‑date Edge versions, missing Defender browser extension/enrollment, insufficient admin permissions  or delayed Intune check‑ins can also trigger the warning.

In short, the alert usually points to policy overlap, targeting ambiguity or sync lag not a true protection failure especially right after scoping changes.

If you find the answer useful, please do not forget to like and mark it as a solution🙂

Hello Devincit!
Thank you for reaching out. 
Please ensure that you have the right permissions- Quoting from the documentation-->"To use this feature, Admins must be assigned to a role that can create service principals, and have permissions assigned for Microsoft Intune administration"

Try the manual option as well that is described at the bottom of the documentation 
A manual sync option is available on the Edge settings overview page. Admins can sync by clicking the sync now action on the Microsoft Purview DLP protections card.