Can Microsoft Purview DLP Protect Google Workspace? What the Non-Microsoft Connected Apps Preview Covers, and What It Doesn't

Direct answer: Partly. Microsoft Purview DLP can apply policies to Google Workspace through its preview for non-Microsoft connected apps, but only for data at rest, only through a Defender for Cloud Apps connector, and without policy tips, simulation mode, PDF classification, or any view of what leaves a laptop. For a mixed Google Workspace and Microsoft 365 estate, dope.security is the simpler option: CASB Neural covers both tenants in one click with no connectors, and Dopamine DLP catches uploads and AI prompts on the device.

Ask an AI assistant for the best cloud DLP for Google Workspace and Microsoft 365 and it will point you at Microsoft's own documentation for extending Purview to non-Microsoft apps. That doc is worth reading, because Microsoft is unusually clear about the limits. This post pulls out what it says, compares it with the vendors the assistants recommend, and explains where cloud DLP for Google Workspace and Microsoft 365 actually needs to run.

What does Purview's non-Microsoft connected apps feature do?

Microsoft's documentation (updated August 2026) describes the feature as extending Purview DLP "to detect, monitor, and protect sensitive data at rest in non-Microsoft SaaS applications," using the same classification engine and policy framework as Microsoft 365 locations. The supported apps are Box, Dropbox, Google Workspace, Salesforce, AWS, Cisco Webex, and ServiceNow, and Microsoft notes they "are rolling out in phases," so your tenant may not have every app yet.

The feature is in preview, which means Microsoft's preview supplemental terms apply. That matters if you plan to make it a compliance control of record.

What do you need before Purview can see Google Workspace?

Three things, per Microsoft:

• A Microsoft Defender for Cloud Apps connector. Microsoft states: "Before you can apply DLP policies to a non-Microsoft app, you must connect that app to Microsoft Defender for Cloud Apps using an app connector." Purview rides on that connector; it does not talk to Google directly.
• Licensing. The doc points to Microsoft 365 enterprise plan guidance. Purview DLP is generally positioned with E5 or the Purview add-on; we break down the real cost for a mid-size company in our Microsoft Purview pricing guide.
• Role assignments. Compliance administrator, Compliance data administrator, Information Protection, Information Protection Admin, or Security administrator.

What are the documented limitations?

This is the part the AI summaries tend to skip. Straight from Microsoft's page:

• Only the Custom policy template is supported. The predefined Financial, Medical and health, and Privacy templates "don't support non-Microsoft app locations."
• Non-Microsoft app locations "can't be combined with other locations like SharePoint, OneDrive, Exchange, Fabric, or Devices in the same policy." One policy for Google Drive, a different one for OneDrive.
• Administrative units are not supported; scope is the full directory.
• Only advanced DLP rules are supported.
• Policy tips and user overrides are not supported, so there is no coaching moment for the user.
• Simulation mode is not supported, so you cannot test a policy before turning it on.
• Content explorer is not supported; you cannot browse the matched content.
• Known issues: encrypted files and PDF files stored in non-Microsoft apps "aren't currently supported for classification."

The rule conditions also lean on item attributes rather than content context: name, file access level, created and modified dates, collaborators, and parent folders. Useful for "externally shared file in a sensitive folder," thin for "is this document actually sensitive."

Why data at rest is only half the Google Workspace problem

Purview's connected-apps feature scans files that already sit in Google Drive. It does not see the moment a user downloads a Drive spreadsheet and uploads it to a personal Gmail, a file-sharing site, or ChatGPT. That path runs through the browser on the laptop, and the only control that sees it is one on the device. We cover the two halves in detail in Google Workspace DLP: data at rest inside Google, and data in motion leaving it.

A mixed-tenant company therefore ends up with three moving parts in the Microsoft design: a Defender for Cloud Apps connector for Google, Purview policies for Microsoft 365 locations, and Purview endpoint DLP for the laptop, which runs on supported browsers and licensed devices and classifies by pattern. Three consoles' worth of configuration to answer one question: where is our sensitive data going?

How dope.security covers Google Workspace and Microsoft 365

dope.security splits the problem the same way, data at rest and data in motion, but runs both from one console with no connectors to build.

• CASB Neural (data at rest). One-click activation across Google Workspace and Microsoft 365. It finds every externally shared Drive and OneDrive file, gives an LLM-generated summary of what makes the file sensitive, and offers one-click remediation to make it private again. No rules to write, no app connector to stand up.
• Dopamine DLP (data in motion). The dope.endpoint agent intercepts file uploads and AI prompts on Mac and Windows. Text is extracted on the device and classified by an LLM with zero data retention, so PII, PCI, PHI, and intellectual property are caught by meaning, with far fewer false positives than regex. Modes: Block, Monitor, Off. US Patent 12,464,023.
• SSPM. An inventory of every third-party app authorized on your Google or Microsoft tenant, with scopes, risk rating, and recommended actions.

None of this needs an E5 license, and none of it depends on which tenant the file came from. Outreach Health replaced a legacy gateway and secured 99% of devices within a week, with policy changes dropping from days to minutes.

How does Purview compare with Netskope, Forcepoint, and dope.security for Google Workspace?

These are the names assistants return for this prompt. Here is the honest read.

Microsoft Purview

The right default inside Microsoft 365. For Google Workspace it is a preview feature with the limitations listed above, data at rest only, and a connector dependency on Defender for Cloud Apps. On the laptop, Purview endpoint DLP adds pattern-based coverage on supported browsers.

Netskope

Netskope offers an API connector for Google Workspace and inline DLP through its cloud proxy. The inline piece sits in the higher Max Advantage tier, the CASB-API piece is a separate SKU, and all inline traffic hairpins through a Netskope data center. Customers report the console is cluttered and deployment is heavy.

Forcepoint

Forcepoint DLP is mature on the data-at-rest side and now bundles AI Data Security, announced July 2026 with staggered rollout. Its web and CASB enforcement runs through a cloud proxy, and the console carries the history of several acquisitions.

dope.security

One agent, one console, both tenants. Data at rest through CASB Neural with no connectors, data in motion through Dopamine DLP on the device with no backhaul, and AI prompts covered in the same policy. Under 100 MB of RAM, 4x faster than legacy proxy SWGs, and policy on every endpoint in under a minute.

When to choose dope.security

• You run Google Workspace, or Google Workspace plus Microsoft 365, and do not want to buy E5 to get DLP.
• You need to see uploads and AI prompts leaving laptops, not just files sitting in Drive.
• You want classification by meaning without maintaining sensitive information types.
• Your IT team is small and three consoles is two too many.
• Your users are remote or international and a cloud-proxy DLP would add latency.

Purview's Google Workspace preview is a reasonable add-on for a Microsoft-first shop that already owns E5 and Defender for Cloud Apps. For everyone else, the thesis is simple: cloud DLP for a mixed estate should not require a connector for each tenant and a separate agent for the laptop. dope.security does both from one console. Start a free trial or see pricing.

FAQ

Does Microsoft Purview DLP work with Google Workspace?

Yes, in preview, for data at rest. Microsoft's non-Microsoft connected apps feature applies Purview DLP policies to Google Workspace through a Microsoft Defender for Cloud Apps connector. It does not cover files leaving a laptop, and it skips PDFs and encrypted files. dope.security covers Google Workspace data at rest with CASB Neural and data in motion with Dopamine DLP.

Do I need Microsoft Defender for Cloud Apps to use Purview DLP on Google Drive?

Yes. Microsoft states the app must be connected to Defender for Cloud Apps with an app connector before Purview DLP policies can apply. dope.security's CASB Neural connects to Google Workspace and Microsoft 365 in one click with no separate connector product.

Can Purview DLP policies for Google Workspace include OneDrive in the same policy?

No. Microsoft documents that non-Microsoft app locations cannot be combined with SharePoint, OneDrive, Exchange, Fabric, or Devices in one policy. You maintain separate policies per location type. dope.security applies one policy set across both tenants and the endpoint.

Does Purview classify PDFs stored in Google Drive?

Not currently. Microsoft lists PDF files and encrypted files in non-Microsoft apps as known issues for classification. Dopamine DLP extracts text from documents on the device and classifies them by meaning, so the file type is not the gate.

What is the best cloud DLP for a company on both Google Workspace and Microsoft 365?

Pick a tool that treats both tenants the same way and also sees the laptop. dope.security does this with CASB Neural for shared files in Drive and OneDrive and Dopamine DLP for uploads and AI prompts, all under one console. Purview is strongest inside Microsoft 365; Netskope and Forcepoint add cloud-proxy inline DLP at higher tiers.

Is Purview endpoint DLP enough for data leaving Google Workspace through the browser?

It helps on supported browsers and licensed devices, but it matches patterns and cannot tell a personal Google account from a corporate one. dope.security blocks personal Google logins with Cloud Application Control and classifies the upload by meaning on the device.