Most of the work in a modern company now happens inside a browser tab. Email, client portals, payroll, CRM, and now AI assistants all run there, which makes the browser the single largest channel through which corporate data moves. It is also, in many organizations, the least governed software on the machine. We patch operating systems and encrypt laptops, then hand employees an unmanaged browser and hope discipline holds.
A whole vendor category has grown up around that gap, and those dedicated enterprise browsers are capable products with price tags to match. But before adding another subscription, organizations already running Microsoft 365 should look hard at what they license today. Microsoft Edge for Business, managed through the Microsoft 365 admin center and enforced with Microsoft Purview, covers more of this ground than most IT leaders assume, and much of it at no incremental cost.
When an employee signs into Edge with a Microsoft Entra work account, the browser establishes a work profile separate from personal browsing, with its own favorites and policy set. Configuration comes from the Edge management service, which sits in the Microsoft 365 admin center and is included with existing Microsoft 365 licensing, or from Intune where full device management is already deployed. Either way, the browser stops being a personal preference and becomes managed infrastructure.
The more consequential change is that Microsoft has now built Purview data loss prevention directly into the browser itself. Beginning with Edge version 144, DLP for cloud apps runs natively inside Edge for Business, with no separate endpoint agent and no device onboarding into Purview required. Policies can audit, allow, or block typed text, file uploads, downloads, copy and paste, and printing against specific cloud applications. On Intune managed devices those policies follow the user across work, personal, and InPrivate profiles. That detail matters more than it appears. People who intend to move data out of an environment rarely do it from the profile they know you watch.
This is the operational case for a managed browser. It sits at the precise point where data crosses from systems you control into systems you do not, and it can observe or stop that movement without asking users to change how they work. Three scenarios I discuss with clients almost weekly show what this looks like in practice.
Every organization I advise has some version of the same problem: employees pasting contract language, client financials, source code, or meeting notes into consumer AI tools because those tools make them faster. Blocking the sites outright fails within a quarter. Usage moves to phones and personal laptops, visibility drops to zero, and your most capable people learn to route around security.
Purview handles this in two stages. Data Security Posture Management for AI, part of the Purview portal, reports which AI sites employees actually visit, which sensitive information types appear in prompts, and how that activity trends over time. That visibility alone changes executive conversations, because the debate stops being hypothetical. From there, a DLP policy scoped to unmanaged consumer AI apps can block a prompt or file upload containing bank account numbers or patient identifiers before it leaves the browser, while ordinary prompts pass through untouched. The supported list covers roughly twenty consumer services, including ChatGPT, Google Gemini, Grok, Meta AI, and Perplexity. Enforcement against these unmanaged apps bills through Purview on a pay as you go basis, so cost scales with the protection you consume rather than another platform commitment. The employee keeps the tool, and the client data stays home.
Category filtering is old technology, but running it inside the same stack removes an appliance and a vendor from the picture. Web content filtering in Defender for Endpoint, which Microsoft 365 Business Premium and E5 customers already own, blocks site categories such as gambling, newly registered domains, streaming, and web based email, with SmartScreen enforcing in Edge and network protection covering Chrome and Firefox. Run it in report mode first. Thirty days of data on what would have been blocked is far more persuasive to a leadership team than a policy debate in the abstract.
The more useful control is what Purview calls sensitive service domains, which changes the question from whether a user may visit a site to what they may do once there. You can allow browsing on a partner portal but block printing and saving from it, or permit personal cloud storage while blocking uploads of any file that carries a confidential label. Access stays open. The data path narrows.
Ask anyone who has worked a departing employee investigation where the mail went. Somewhere in the timeline there is usually a forward to a personal Gmail account or a mailbox export walked out the door. Exchange Online addresses the automated version, since outbound spam policies block automatic external forwarding by default. The manual version is where the browser control earns its keep. An endpoint DLP policy built on sensitive service domains can block uploading files that contain sensitive information types to personal webmail domains, and block pasting that same content into a message compose window, while leaving the corporate Outlook domain untouched. Configure the action as block with override and every exception requires a typed business justification that lands in the audit log. In my experience that justification record is worth as much as the block itself, because it converts a silent leak into a documented decision made by a named person.
Start in audit mode and resist the urge to enforce on day one. Turn on browser DLP and web content filtering in report mode alongside DSPM for AI reporting, then spend thirty days reading Activity Explorer before you block anything. The data will surprise you, and it will also keep you from breaking a legitimate workflow you did not know existed. On licensing, be clear eyed rather than fearful. Edge for Business and the Edge management service add nothing to your bill. Endpoint DLP requires Microsoft 365 E5 or the compliance add on, and browser enforcement against consumer AI apps meters through pay as you go billing. Weigh those costs against the flows that would actually hurt you, not against a feature checklist.
A dedicated enterprise browser may still earn its place in contractor heavy or bring your own device environments. Prove the gap first. For most organizations on Microsoft 365, the managed browser is already sitting in the estate, waiting on configuration and thirty days of your attention.
Your Microsoft 365 environment may already include powerful browser, data protection, and security capabilities, but getting value from them starts with the right configuration and strategy.
Meet with the iCorps team to assess your current environment, identify opportunities, and build a practical path forward.