Microsoft Edge for Business: Protected Clipboard (In Preview)

Introduction

Protected Clipboard in Microsoft Edge for Business is designed to help organizations safeguard sensitive data by controlling copy and paste actions between managed and unmanaged web applications. By leveraging configurations in Purview DLP policies targeting managed cloud apps, Protected Clipboard helps ensure that data remains within admin defined trusted boundaries, reducing the risk of accidental or intentional data leakage, especially as users interact with modern SaaS and GenAI tools.

Protected Clipboard in Edge for Business empowers organizations to protect sensitive data at the clipboard level, balancing security and productivity. With policy-driven enforcement, silent user experience, and flexible admin controls, it’s a modern solution for today’s browser-based workflows.

About Screen Capture protection

For a stronger, unified story around clipboard protection, Edge for Business also includes Screen Capture protection. This feature restricts screenshots and recordings during protected browsing sessions to keep sensitive enterprise data secure. When enabled, screen capture is automatically blocked only on pages or sites where a Copy:Block policy is active. Screenshots are treated as an extension of copy protection, helping prevent unauthorized data exfiltration via screen capture, alongside clipboard controls.

When the Protected Clipboard toggle is configured in the Edge Management Service portal, the Screen Capture Protection policy will also be enabled by default. This ensures that both clipboard and screen capture controls work together to prevent data leakage. Screenshots can be used to bypass clipboard restrictions, so enabling both policies by default provides a more comprehensive layer of protection for sensitive enterprise data.

For organizations seeking broader screenshot restrictions beyond Purview DLP policies targeting managed cloud app enforcements, Microsoft Edge also supports global controls such as DisableScreenshots Policy:

• Admins can block screenshots across all sites in Edge for Business using the Microsoft Edge Browser Policy Documentation DisableScreenshots | Microsoft Learn

• This policy disables Edge’s built-in screenshot and Web Capture features for all sites, but doesn't block OS-level tools (such as Windows Snipping Tool).

Requirements

To use Protected Clipboard and Screen Capture protection, ensure your environment meets the following prerequisites:

Defining Trusted Boundaries for E5

Protected Clipboard in Microsoft Edge for Business lets organizations define how and where sensitive data can move via copy and paste. By configuring Purview DLP policies admins can establish their trusted boundary. A trusted boundary means that data inside the boundary can't leave, and is blocked from being pasted outside. At the same time, data from outside the boundary can enter, allowing it to be pasted inside when needed.

We describe a trusted boundary as a set of managed web apps and sites where clipboard data can safely flow. Attempts to move data outside this boundary (for example, into unmanaged apps, personal browser tabs, or GenAI tools) are silently blocked, reducing the risk of data leaks without disrupting user productivity.

Trusted boundaries are established through configurations made in Purview DLP policies targeting managed cloud apps. Admins can:

• Specify managed cloud apps to include in the policy boundary
• Target policies to specific users or groups
• Adjust boundaries as organizational needs evolve

When a Purview DLP policy targeting managed clouds with a rule applied to the Copy action is active, Edge automatically enforces clipboard controls based on these boundaries, helping prevent sensitive data from being pasted outside of the trusted boundary.

Trusted Boundary for E3

Protected Clipboard is also available for organizations using Microsoft 365 E3 with Intune Mobile Application Management (MAM). In this scenario, the trusted boundary is the Edge work profile. All copy/paste actions are restricted within the managed work profile. That is, data can't be pasted outside the profile, ensuring sensitive information remains protected even on BYOD or unmanaged devices. For more information about configuring this scenario, see Protected Clipboard within MAM profiles.

• Trusted Boundary: Edge work profile (Entra ID identity)
• Policy Enforcement: Admins configure Intune MAM policies to restrict copy/paste within the work profile.
• User Experience: Copy/paste is allowed only between sites and apps inside the managed profile. Attempts to paste outside the profile are blocked with the message: “Your organization’s data can't be pasted here.”

Why Modes Matter

Different organizations and scenarios require different levels of governed clipboard control. Protected Clipboard offers several enforcement modes, each shaping the trusted boundary in a unique way. These modes let you balance security and productivity, helping protect data sharing while users can work efficiently within approved environments. Admins can adjust these boundaries as organizational needs evolve.

Protected Clipboard Modes Explained

All modes require a rule using the Copy configuration Purview DLP policy set up via Microsoft Purview.

How to Choose a Mode

• Start with your data protection goals: Do you want to keep data within a single app, groups of apps, or allow broader sharing within trusted apps?
• Consider user workflows: If users need to copy between multiple managed apps, Shared Boundary or Hybrid may be best. For strict isolation, Tab-Only is ideal.
• Monitor and adjust: Use reporting to see how policies are working and refine your trusted boundaries as needed.

Getting started

Protected Clipboard is designed for simplicity and seamless integration into your existing security workflows. Refer to Help Prevent Users from Sharing Sensitive Info with Cloud Apps in Edge for Business | Microsoft Learn to get started.

Setting up Protected Clipboard with Purview DLP requires configuration across four portals in this order:

Step 1 — Entra: Create a Conditional Access policy

1. Navigate to entra.microsoft.com > Conditional Access > New policy.
2. Under Assignments > Users, select your pilot user group.
3. Under Target resources > Cloud apps, select Office 365. This is an example configuration. You can select any apps connected to your tenants with Entra. Learn more.
4. Under Conditions > Client apps, select Browser only.
5. Under Session, select Use Conditional Access App Control > Use custom policy.
6. Enable and save the policy.

Step 2 — Authenticate once to register apps with CA App Control

After the CA policy is live, at least one targeted user must sign in to one of the in-scope cloud apps (Outlook on the web, OneDrive, SharePoint, etc.) before continuing. Apps only appear in Defender's CA App Control apps list after a user authenticates through the CA policy for the first time. If the list is empty, Edge for Business won’t detect the CA policy and the Purview DLP policy will not enforce.

To verify Step 2 worked: In security.microsoft.com > System > Settings > Cloud apps > Conditional Access App Control apps, confirm at least one app appears with Status: Enabled, IDP: Entra ID app.

Step 3 — Defender for Cloud Apps: Turn on Edge for Business browser protection

1. Navigate to security.microsoft.com > System > Settings > Cloud apps > Conditional access app control > Edge for Business protection.
2. Set Edge for Business browser protection = ON.
3. Set Enforce usage = Allow access only from Edge (required).
4. Set Enforce for which devices = All devices or Unmanaged devices only.
5. Set Notify users in non-Edge browsers = ON.
6. Save.

Step 4 — Purview: Create the DLP policy with the Copy rule

1. Navigate to purview.microsoft.com → DLP > Policies > Create policy.
2. Under Location, select Managed cloud apps (located at the bottom of the locations list).
3. Edit the location and add target apps to the same apps as your CA policy (for example: Exchange Online, SharePoint Online, etc.).
4. Set Rule condition = Device is managed or Device is unmanaged (create two rules if you target both device states).
5. Set Activity = Copy > Enforcement = Block.
6. Enable and save the policy.

If you see a Conditional Access policy not found banner, confirm the settings are corrected for the CA policy and the Edge for Business protection in Step 2 and 3.

Step 5 — Edge Management Service: Enable Protected Clipboard

1. Go to the Microsoft 365 admin center and sign in
2. In the main left navigation bar, go to Settings > Microsoft Edge.
3. Create a configuration policy (defaults are fine).
4. Edit the policy > Customization settings > Security settings.
5. Set Protected Clipboard = ON > Select enforcement mode (typically Shared Boundary).
6. Save and assign.

Step 6 — Wait for propagation, then test

• Browser policies typically apply within ~1 hour; full propagation can take up to a day
• Verify on an unmanaged device (our hero scenario) or device matching the condition set in the policy by signing into a targeted user account, copying from a managed app, and confirming paste is blocked outside the boundary
• Run edge://policy/ in the work profile to confirm Protected Clipboard policies appear as applied

Common setup failures and how to fix them

Additional Customization (Coming Soon)

Protected Clipboard and related policy controls are currently in Preview. Additional customization options are planned for future releases, developed in close collaboration with the Microsoft Purview team. These improvements will allow for more granular enforcement and flexibility, and provide admins with greater control over data protection scenarios to fit unique business needs, user groups, and compliance requirements, delivering a more robust and adaptable security posture.

Please refer to the Microsoft 365 roadmap for Edge for Business for the most up to date information on feature availability.

Feedback and support

This experience is supported by Microsoft Support. You can reach out to Microsoft Support to report issues or give feedback. You can also leave feedback in our TechCommunity forum.

See also

• Microsoft Edge Enterprise landing page