Purview network DLP in Entra Global Secure Access

Introduction

Microsoft Purview has been rolling out, since late September 2026, the general availability of Network Data Security, the integration that extends DLP (Data Loss Prevention) to the network layer through Microsoft Entra Global Secure Access. Until now, the DLP policies covered on this blog operated at the application layer : Teams, Outlook, the clipboard, printing, cloud storage, or AI sites in the browser. This new layer operates one level lower, directly on the device’s network traffic, without depending on an integration specific to each application.

What’s different from application-layer DLP

The DLP policies already covered on this blog each rely on an integration point specific to the targeted application : a browser extension, a Teams connector, a print driver. Network Data Security works differently : Global Secure Access directly inspects the HTTP and HTTPS network traffic sent from the device, then forwards the relevant elements to Purview for classification and policy evaluation, with no additional installation on the device beyond the Global Secure Access client already deployed.

This network layer notably protects :

• Generative AI applications : Interactions through a browser, app, or add-in with services like ChatGPT, Gemini, or Claude
• Unmanaged cloud storage : Files transferred to providers like Dropbox, Box, or Google Drive
• Cloud email : Emails and attachments shared through providers like Gmail
• Forms and social media : Online form submissions and posts on services like Facebook or X

Four activities are supported : text sent, file uploaded, text received, and file downloaded from a cloud or AI application. The classifiers used are the same ones already configured in other Purview policies, which avoids redefining sensitive information types for this new layer.

Required licenses

Integration with Microsoft Entra Global Secure Access requires one of the following combinations :

• Microsoft 365 E7 : Per-user license, sufficient on its own
• Purview E5 and Entra Internet Access : Two per-user licenses, required together

A third path exists for organizations using a SASE solution or a non-Microsoft secure browser instead of Global Secure Access : it requires Purview E5 and enabling Purview’s pay-as-you-go billing model, billed per network request. This usage-based billing isn’t required for the Global Secure Access integration itself.

What Purview administrators should evaluate

Setup happens in two stages : the integration between Purview and the network solution is configured from the Security Store of Purview DLP, and the collection or protection policy is then configured like any other Purview policy. Once the integration is in place, allow up to 24 hours before policies propagate to the network solution and the first data appears, then up to 30 additional minutes for a given request to show up in audit logs and the activity explorer.

Data generated by this new layer appears in the activity explorer by filtering on the network enforcement plane (enforcement plane), which makes it possible to distinguish it from events generated by other DLP layers already in place. For organizations already running application-layer DLP policies, particularly those targeting unmanaged AI applications, this new network layer stacks on top of them without replacing them : it’s still worth assessing coverage overlap between the two before enabling both in parallel on the same scenarios.

Conclusion

Network Data Security doesn’t replace the application-layer DLP policies already covered on this blog, it adds a layer of visibility and control that no longer depends on a per-application integration. For organizations already licensed for Microsoft 365 E7 or Purview E5 with Entra Internet Access, evaluating this network layer deserves particular priority on traffic to unmanaged generative AI applications, a frequent blind spot of purely application-layer DLP policies.

Sources

Microsoft Learn - Microsoft Purview Network Data Security

Microsoft Learn - Entra network content filtering

Did you enjoy this post ? If you have any questions, comments or suggestions, please feel free to send me a message from the contact form.

Don’t forget to follow us and share this post.