[HELP] "Action required for browser protections" alert

This alert is not a protection failure, and it is not an Intune assignment problem. It is the Microsoft Edge management service failing to update the artefacts it maintains on your behalf, and the reason Resync keeps returning the error is documented.

WHY RESYNC APPEARS TO DO NOTHING

Purview policies that target user interactions with unmanaged apps in Edge for Business trigger automation in the Edge management service. That automation creates and maintains six objects outside Purview: two Edge configuration policies, two Intune policies, and two security groups, one for included users and one for excluded users.

Every time you change scope in Purview, those groups and policies have to be updated. If the admin performing the change lacks the permission for one of those artefacts, the update fails and the banner returns.

The documentation states it directly: the resync action will not create or update the policies or groups if the admin does not have the required permissions. Clicking Sync now without them is a no-op, which matches exactly what you are seeing.

https://learn.microsoft.com/deployedge/microsoft-edge-dlp-purview-configuration 

THE PERMISSIONS ARE PER ARTEFACT, NOT A SINGLE ROLE

This is the part worth checking. Under "What's automatically created and updated" there is a table listing a different permission requirement for each object:

Edge configuration policies require Microsoft Edge administration.

Intune policies require Microsoft Intune administration and Microsoft Edge administration.

Security groups require Directory Reader and Microsoft Edge administration.

Edge Administrator on its own is not enough. The Entra built-in role grants microsoft.edge/allEntities/allProperties/allTasks and nothing in Intune, so an admin holding only that role will get the Edge configuration policies created and then fail on the Intune ones.

https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference#edge-administrator 

HOW TO IDENTIFY WHICH ONE FAILED

The failure is partial, so you can find the missing permission by checking the three locations and seeing what is absent or stale.

Microsoft 365 admin center, Settings, Microsoft Edge. You should find two read-only policies whose names begin with "Purview - ".

Intune admin center, Devices, Configuration. You should find two policies whose names begin with "Edge policy to block use of".

Microsoft 365 admin center, Active Teams and Groups, Security groups. You should find "Purview DLP browser protection - included users" and "Purview DLP browser protection - excluded users".

Whichever set is missing, or whose membership no longer matches your current Purview scope, tells you which permission the syncing admin is short of. Then have someone holding that permission run Sync now from the Resources tab on the Microsoft Purview DLP protections card.

A TRAP WHEN VERIFYING THE GROUPS

The included-users group will not display individual members if at least one Purview DLP policy targeting Edge for Business is scoped to All users and groups, and that holds even when Exclude from All is configured. An empty looking group is therefore not evidence that the sync failed. Check the Edge and Intune policies before concluding anything.

WORTH RULING OUT, GIVEN YOUR SCOPING WORK

The security groups and policies are shared across every Purview collection and DLP policy that targets unmanaged apps in Edge for Business. They are not created per policy. If you have more than one such policy in the tenant, a scope change on one of them updates the shared set, and the policy failing to apply may not be the one you were editing.

It is also worth confirming which of your policies actually target unmanaged apps in Edge for Business. A policy scoped only to the Devices location does not by itself drive this automation, so the trigger may be coming from elsewhere in the tenant.

FINALLY

Do not troubleshoot the auto-created objects themselves. They are read-only by design and are updated only by changing the Purview policy. Nothing needs fixing directly in Intune or in the Edge configuration policies.

https://learn.microsoft.com/purview/dlp-browser-dlp-learn