Microsoft Purview DLP to Cover All Websites via Entra GSA Internet Access

• All websites
• All websites except specific cloud apps

Microsoft's stated goal is to cover cloud apps and websites that are not in the Microsoft Defender for Cloud Apps catalog. Right now, those destinations can't be selected in a Purview network DLP policy, so they aren't covered.

This is a planned feature. It is not available yet.

The roadmap facts​

Microsoft's roadmap says its release dates are estimates and that all information is subject to change. Items can also be removed from the roadmap if a feature ships, is cancelled or is postponed. The November and December dates are targets, not promises. Customers in government or sovereign clouds should note that only the Worldwide multi-tenant cloud is listed.

Why the catalog is the limit today​

Purview network data security currently decides what a DLP policy can target in two ways. According to Microsoft Learn, data sources can be:

• Unmanaged cloud apps from the Defender for Cloud Apps catalog, which Microsoft says lists more than 35,000 discoverable apps.
• Adaptive app scopes, which are app categories such as generative AI, cloud storage, collaboration, social networks and webmail.

35,000 apps is a lot, but the internet is much bigger. Smaller AI tools, regional file-sharing sites, newly launched services and any website without a catalog entry can't be selected. That leaves a gap: data can leave through destinations nobody has catalogued.

The new options address that gap. All websites makes the policy's destination scope cover every site. All websites except specific cloud apps does the same but leaves out apps the administrator names. Typical exclusions might be sanctioned SaaS tools that already have their own controls, or apps where inline inspection causes problems.

An exclusion takes an app out of the policy. It does not mean the app is protected some other way. If you exclude something, make sure another control covers it, or accept that it is uncovered.

The integration was only just finished​

The broader feature has only recently left preview. In its September 2026 "What's new" page, Microsoft announced that general availability: Integrate Microsoft Entra Global Secure Access with Purview to protect text, files, and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management. According to Microsoft, it helps prevent sensitive data from being shared with untrusted cloud applications through browsers, apps, APIs, and add-ins, including generative AI platforms, social media, and collaborative platforms.

Many organizations are still on their first GSA-plus-Purview pilot, so this roadmap item will apply to fairly new deployments. Microsoft is widening the scope soon after the feature reached general availability.

How the pieces fit together​

The new scope options sit inside a two-part system. A Purview policy on its own does nothing to network traffic.

On the Entra side, a GSA content policy rule uses the Scan with Purview action. That action enables network data security by combining Microsoft Purview's data loss prevention (DLP) with identity-centric Global Secure Access policies. It inspects files and text for sensitive information and helps prevent data loss by blocking its sharing based on your Purview DLP policies.

On the Purview side, if you selected the Scan with Purview action in your content policy, you must configure a corresponding data loss prevention (DLP) policy in Microsoft Purview. The DLP policy defines how Purview classifies and acts on file and text content that Global Secure Access routes for inspection.

GSA sends matching traffic to Purview. Purview evaluates it and returns a decision, and GSA enforces that decision. Microsoft Learn lists four supported activities:

• Text sent to or shared with a cloud or AI app
• Text received from a cloud or AI app
• Files uploaded to or shared with a cloud or AI app
• Files downloaded from a cloud or AI app

The available actions are Audit only and Block. Independent blog Netics Labs makes the same point: Global Secure Access supports all four with the two available actions, Audit only and Block.

One question the roadmap leaves open​

Microsoft's current GSA documentation says content rule destinations can be exact URLs, FQDNs or web categories. It also says wildcards can't be used for top-level or second-level domains: *.contoso.com works, but .com and contoso. do not.

The roadmap item describes a change to the Purview DLP policy scope. It doesn't say whether the GSA content policy destinations will get a matching "everything" option, or whether admins will keep using web categories or long FQDN lists on the Entra side. Microsoft hasn't explained how the two sides will line up. Check the documentation when the preview arrives before assuming that one setting covers the whole web.

Summary: The change widens which destinations a Purview DLP policy can target. The GSA routing, TLS inspection, content policy and DLP rule still have to be set up.

Current setup steps​

If you want to be ready by November, here is the current documented setup from Microsoft Learn. The new scope option will plug into this.

1. Prepare routing. Enable the Internet Access traffic forwarding profile and assign users. Set up a TLS inspection policy. Install the GSA client on Entra ID-joined or hybrid-joined Windows or macOS devices.
2. Check that traffic is forwarded. In the GSA client, go to Troubleshooting > Advanced Diagnostics > Forwarding Profile and confirm the Internet Access rules are listed. Microsoft says this can take up to 15 minutes to reach clients.
3. Create the content policy. In the Entra admin center, go to Global Secure Access > Secure > Content policies. Add a rule with the Scan with Purview action, then select the activities, content types and destinations.
4. Link and enforce it. Link the content policy to a security profile. Then create a Conditional Access policy that targets All internet resources with Global Secure Access and uses that security profile under Session.
5. Create the Purview policy. In the Purview portal, go to Data loss prevention > Policies > Create policy and choose Inline web traffic. Select the cloud apps or adaptive scopes (this is where the new all-websites option is expected to appear), enable Network and non-Microsoft secure browsers, and add rules using Restrict browser and network activities.
6. Match both sides. The activities in the Purview rule must match the activities and content types selected in the GSA content policy.
7. Test. Use dummy sensitive data, such as sample credit card numbers. Check Global Secure Access > Monitor > Traffic logs in Entra, and check DLP alerts or Activity Explorer in Purview.

For a scope this wide, start with Purview's simulation mode or Audit before turning on Block. Blocking every website at once is a fast way to flood the helpdesk.

What "all websites" won't cover​

Microsoft's current documentation lists several limits that matter more as the scope grows:

• HTTP/S only. UDP and QUIC traffic isn't supported. Microsoft suggests a Windows Firewall rule that blocks outbound UDP 443 so that browsers fall back to TCP.
• Fail-open inspection. If Purview can't finish an inspection, for example because the payload is too large or an internal error occurs, the traffic is allowed. The PurviewStatus field in the traffic logs shows which transactions skipped inspection.
• Fail-closed rate limits. If API rate limits are exceeded, traffic is blocked.
• Size limits. The GSA documentation gives a 3 MB maximum for Scan with Purview. The Purview documentation says up to 4 MB for text and 3 MB for files. The documents differ, so plan for the lower figure.
• No OCR. Text inside images isn't extracted.
• Identity required. Only traffic tied to an Entra user identity is sent to Purview. Policies also don't apply to B2B guest users.
• Ways around file detection. Files encoded inside JSON or split across several encrypted requests may not be inspected. Over WebSockets, file-type filtering is skipped, though text is still evaluated.
• Consumer and enterprise versions together. When an app uses the same URL for both, such as ChatGPT, a policy can catch both.

Expanding to every website also means more inspection traffic, more alerts and more false positives. Before a broad Block rule goes live, test your classifiers and sensitivity labels.

Licensing​

Microsoft Learn currently lists two ways to license the GSA integration:

• Microsoft 365 E7 per-seat licenses
• Purview E5 (or equivalent) per-seat licenses plus Entra Internet Access (or equivalent) licenses

The same page says pay-as-you-go billing is not needed for the GSA path, unlike integrations with non-Microsoft SASE and secure browsers.

Older guidance said the opposite. A summary of Message Center post MC1181769 said admins must configure policies, TLS inspection, and activate Purview pay-as-you-go. Follow Microsoft Learn's current wording, and confirm what your tenant is entitled to before you finalize budgets.

Our take​

This change makes sense. A DLP policy that only covers the catalog misses whatever destinations aren't in it, and those are often the riskiest ones: the new AI tool someone found yesterday, or an unknown paste site.

Microsoft also has a commercial reason. Broader scope makes GSA Internet Access look more like a full alternative to third-party SASE products. That's a fair aim, but it doesn't mean the network layer can see everything. Fail-open inspection, size limits and HTTP/S-only coverage mean "all websites" really means all websites that pass through GSA and fit within the inspection limits. Endpoint DLP and browser controls are still needed alongside it.

Key points​

• What: Purview network DLP policies with Entra GSA Internet Access will be able to target all websites, or all websites except named cloud apps.
• Why: To cover destinations that aren't in the Defender for Cloud Apps catalog of more than 35,000 apps.
• When: Preview is targeted for November 2026 and general availability for December 2026, in the Worldwide multi-tenant cloud only. Both dates are estimates.
• What doesn't change: GSA routing, TLS inspection, the Scan with Purview content policy, matching DLP rules, and the documented limits on inspection.

If you're already running the GSA-Purview integration, now is a good time to check your traffic logs for skipped inspections and tune your classifiers before you widen the scope.