top of page
Search

Data Loss Prevention When Your Team Pastes Into ChatGPT: What a Mac Fleet Can Actually Enforce

Writer: MacSmithAI
MacSmithAI
Sep 25
7 min read

Someone on your staff pasted a customer list into ChatGPT this week. Probably several someones. In a Zapier survey of 1,005 US workers at companies with 500 or more employees, fielded 13–21 May 2026, 89% had entered company data into an AI tool and 79% had entered something genuinely sensitive — HR records, customer PII, logins and API keys. Thirty-one percent had pasted credentials or API keys specifically. Half of them said they had ignored a workplace AI restriction to do it.


That last number is the one that should change how you think about this. If half your users route around the policy, the policy is not the control. So the question for a Mac admin is narrower and more useful: on a managed Mac, in September 2026, what can you actually enforce — and what are you only pretending to enforce?


Blocking the domain is theatre

The first instinct is a DNS or proxy block on chatgpt.com. It feels decisive and it is almost worthless. The user has a phone. The user has a home network. The user has a native desktop app that may not resolve through your proxy the way you assume. And per the survey above, the user has already demonstrated a willingness to work around you.


Worse, a hard block converts a known, loggable behaviour into an unknown one. Your staff do not stop using AI; they use it somewhere you cannot see, on a device you do not manage, with an account you cannot audit. A domain block gives you a clean dashboard and a dirtier reality.


Buy the tenant before you buy the endpoint control

The cheapest meaningful risk reduction here is a purchase order, not a configuration profile. OpenAI's enterprise privacy documentation states plainly that it does not train on your data by default across ChatGPT Business, Enterprise, Edu and the API platform. ChatGPT Enterprise and Edu let you control how long conversations are retained; on Business, workspace admins manage retention and deleted conversations are "removed from our systems within 30 days." Each of those products has completed a SOC 2 Type 2 audit. And Enterprise customers can pull an audit log of conversations and GPTs through the Enterprise Compliance API.


Read that last sentence again, because it is the whole argument. A licensed workspace turns an invisible paste into a logged event attached to a named identity. Your unlicensed staff pasting into consumer ChatGPT produces nothing you can subpoena, review or report on. You will not win this with endpoint tooling alone, and endpoint tooling is the expensive half.


What Purview can genuinely enforce on a Mac

Now the part that is real. Microsoft Purview Endpoint DLP can restrict pasting into a browser, and it works on macOS.


In the Purview portal the setting lives under Data loss prevention → Settings → Endpoint settings → Browser and domain restrictions to sensitive data, where you create a Sensitive service domain group containing the domains you care about. In the DLP policy itself, choose Audit or restrict activities on devices, and under Service domain and browser activities select Paste to supported browsers, with a restriction level of Audit, Block with override or Block.


Two details matter and are easy to get wrong. First, the paste restriction works only with Sensitive service domain groups — the older single-list Service domains setting does not support it. Second, Microsoft's documentation lists Edge, Chrome, Firefox and Safari as supported browsers for this on macOS, where on Windows Chrome and Firefox require the Purview browser extension. Sensitive service domain groups scale to 150 groups of 100 websites each, so there is no reason to be stingy about scoping.


The macOS side is configured through the com.microsoft.wdav preference domain (Defender also reads com.microsoft.wdav.ext). The keys you care about, taken from Microsoft's own sample profile in the mdatp-xplat repository:


Preference domain: com.microsoft.wdav

features
  dataLossPrevention          = enabled
dlp
  accessibility
    enforcement
      unallowedBrowserMode    = enforce        # enforce | audit | off
      pasteToBrowserMode      = enforce        # enforce | audit | off
    notification
      customMessage           = "Please enable Accessibility permissions to comply with IT Policy"

Deploy Microsoft's published .mobileconfig as a custom profile rather than hand-writing the XML — it is maintained, and the schema has moved before.


macOS 27 moved the permission out from under you

This is the item to act on this month, and it is why this post exists now rather than in June.


Before macOS 27, Endpoint DLP on the Mac depended on the Accessibility permission. In macOS 27, that capability is managed by Device Control and Data Access, under Settings → Privacy & Security. Microsoft's guidance requires Endpoint DLP client version 101.26072 or later, and the whole of macOS 27 support is published as a preview.


The failure mode is specific and worth memorising. If a user turns that permission off after your MDM deployment, Endpoint DLP loses browser and website visibility for Safari, Chrome and Firefox — the URL and browser context, and the ability to identify the active browser, website, application and file. It does not fail loudly. It quietly stops seeing the thing you bought it to see. Microsoft's own advice is to watch the Device Onboarding page for devices reporting the permission as off, which is a polite way of saying: build that report and look at it weekly.


Note the seam, too. Apple renamed the permission; Microsoft's sample profile still nests those enforcement keys under accessibility. Do not assume the key path tracks the UI label. (If TCC and Full Disk Access for AI apps is new ground, we covered the fundamentals in macOS Privacy Controls for AI Apps.)


The gap: everything that isn't a browser

Here is the honest limit of all of the above. "Paste to supported browsers" is browser-scoped. The ChatGPT macOS app is not a browser.


Purview's lever for a native Mac app is Restricted apps, where you add the app by its full path rather than an executable name — /System/Applications/TextEdit.app/Contents/MacOS/TextEdit is Microsoft's own example of the format. But what that restricts is an app's access to protected files. It is not a clipboard control. If someone copies a paragraph out of a spreadsheet and pastes it into a native AI client, your paste policy is not in that path.


And the gap is widening on Apple hardware first. OpenAI's Atlas browser runs on Apple-silicon Macs, is switched on automatically for ChatGPT Business workspaces with no admin action required, and is off by default for Enterprise until an owner enables it. OpenAI's own enterprise documentation is candid that Atlas currently has no Atlas-specific policy bundles, blocklists or allowlists beyond sign-in control, no SSO enforcement, no SCIM provisioning, no IP allowlists and no audit logging through the Compliance API. It also is not in the supported-browser list for the paste restriction. A browser your DLP does not recognise, arriving on Macs before anything else, with limited manageability, enabled by default on one of the paid tiers — that is a fleet problem with your name on it.


macOS 27 gives you the blunt answer. Apple's enterprise release notes state that device management can now manage which apps or binaries are allowed to run, and that a new tccutil list command can report current privacy authorisations for specified services or apps on managed devices. Execution control is not nuanced, but it is enforcement, and it is the first Apple-native tool in this conversation that actually is.


Where each control lands


What it stops

What it misses

Enforceable on macOS today?

DNS or proxy domain block

Casual use of the blocked site on the corporate network

Phones, home networks, native apps, and the half of users who route around policy

Yes - and largely counterproductive

ChatGPT Business or Enterprise workspace

Training on your data, unbounded retention, unattributable use

Nothing about what gets pasted - it logs, it does not block

Yes - a licence, not a profile

Purview paste to supported browsers

Pasting into your listed domains in Edge, Chrome, Firefox and Safari

Anything that is not a browser, and browsers Purview does not support

Yes - preview status on macOS 27

Purview restricted apps

A named app reading protected files, matched by full path

The clipboard - this is file access control, not paste control

Yes

macOS 27 app and binary execution control

The app running at all

Any nuance whatsoever

Yes - new in macOS 27


What this means at 10,000 devices

At fleet scale the technical question is almost secondary. You are deploying a preview-status agent whose enforcement depends on a permission the user can revoke, on a brand-new OS release, across a population that has already told researchers it ignores AI restrictions. That combination demands a rollout in audit mode, a report of permission-off devices before you rely on any block, and a communications plan that explains why the sanctioned workspace exists — because the only durable version of this control is one your staff do not want to defeat.


The practical takeaway

Do these three things, in this order. Licence a ChatGPT Business or Enterprise workspace first — it is the only step that turns invisible pastes into auditable ones, and it costs you no engineering. Then run Purview's paste restriction in Audit for thirty days against one Sensitive service domain group holding your AI domains, so you learn what your users are actually doing before you break anything; promote it to Block with override after that, not before. Do not block the domain outright. And treat Atlas as unmanaged software until OpenAI ships real policy controls — macOS 27's app and binary execution control is the right place to hold that line.


If you only have budget for one of these, it is the licence. Every endpoint control listed here fails open on a device you don't manage, and none of them can tell you what was pasted. The tenant log can.



Comments

bottom of page