Defender Browser/Domain blocks

[AhmedSHMK]

Hello,

We have an issue with Defender for Endpoint, with most users, When we add browsers/domains in DLP settings "Browser and domain restrictions to sensitive data" usually an unallowed browser would not open in a blocked browser by default and would redirect to edge. 

For some users, This does not work, We have checked the affected devices and they have configuration status, policy sync status of successful, user status is Valid user.

On the device itself the tasks/services are running and have been restarted already.

Setting e.g.

[#2]

Hi there,
Please check in your admin center for the message -> MC793918 (17/05/2024)
Microsoft separated the MDE agent from Purview DLP.
MpDlpService.exe” for Microsoft Purview DLP and “MsMpEng.exe” exclusively for Microsoft Defender for Endpoint.
That might be the cause of your issue.

Also, ensure that you deployed the purview browser extension for that browsers.

[#3]

@andrerocha1450 

Thanks for your reply, I am aware about the update but as mentioned I can see both services.

Browser extension is certainly installed

[#4]

@AhmedSHMK

did you also enabled a dlp policy with this?

[#5]

@andrerocha1450 

I create a policy with a rule detecting a label applied to content, And taking the below actions:

Apply restrictions(All Applied):

Restrict app activities:(All Applied)

===================

There is a second rule in the policy that takes the below action:

==================

None of the rules have stop processing more policies/rules enabled.

==================

I noticed however that policy sync/configuration status for the device is not configured. Windows version matches the pre-requisite though not sure why.

[#6]

try and do the following:
login to compliance.microsoft.com
Select "Settings" from the menu on the left
Select "Device onboarding"
Find and select any out of sync device

if that doesn't work, try forcing a sync from security.microsoft.com portal
Select "Devices" -> Find the Device in your device inventory -> Click on the 3 dots and select policy sync

[#7]

@andrerocha1450 Please note there is no longer an option to sync the device from security or compliance.

[#8]

@AhmedSHMK, 

I managed to reproduce the block in a test environment and observed the below:

Action: access any website in the sensitive domains list from a browser with purview extension installed.

Message: "this site contains sensitive information, so for security and compliance your organization requires you to use Microsoft Edge if you access it."

Action: Extension Redirects website to Edge window.

However there isn't any clear documentation of how to achieve the above (add to sens. sites? ) Keep in mind the policies must be configured with a condition but none of the conditions match "block access via browsers other than edge, etc...." 

It is also not clear why in some occasions this does not work, Does it take some time, Any certain URL format? etc....