How to monitor ALL "Paste to Supported Browser", not just sensitive.

Hi @Bryan G

 Monitor all paste actions into supported browsers using Data Loss Prevention (DLP) policies, rather than focusing only on traditional sensitive data types. This can be a bit tricky, since DLP is primarily designed to detect and protect sensitive content.

Here’s the approach you can use to monitor all paste actions:

Policy Creation

When creating a DLP policy, you’ll need to configure it broadly. Since DLP policies typically rely on content matching (like sensitive info types), you should create a custom Sensitive Information Type (SIT) that can detect any content.

• Create a Custom SIT that uses a simple regular expression pattern like .{1,} to match any pasted text.

Set the confidence level to Low and the minimum match count to 1.

https://learn.microsoft.com/en-us/purview/sit-create-a-custom-sensitive-information-type

Use of the "Content Contains" Criteria

Rather than specifying known sensitive types, use your new catch-all Custom SIT for the "Content contains" condition. This will allow you to trigger events for any paste action that includes even a small amount of content.

• Without matching content, DLP policies won't trigger DLP cannot detect paste activity alone without a content match.

Actions for the Policy

• Set the action to Audit to start capturing data without blocking paste actions initially.
• This will allow you to gather logs of all paste activities without interrupting user experience.

Later, you can correlate paste events with earlier "copy to clipboard" events, and track whether data from MIP-labeled documents was pasted into browsers.

https://learn.microsoft.com/en-us/purview/dlp-create-deploy-policy?tabs=purview

Endpoint DLP Configuration

Because "Paste to supported browser" is an Endpoint DLP monitored activity, ensure:

• Devices are properly onboarded to Endpoint DLP.
• The Microsoft Purview Extension is deployed for browsers

https://learn.microsoft.com/en-us/purview/endpoint-dlp-learn-about
Once deployed:

• Test first with a small pilot group of users or devices.
• Review events in Activity Explorer to ensure you are capturing the expected paste activities.
• Be prepared for higher event volume, since matching all paste actions can generate a lot of logs.
• Adjust and tune policies if needed to reduce noise

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.