A security engineer is auditing an organization's Microsoft Purview DLP policies for AI coverage. The engineer discovers that employees are using a third-party AI chatbot (not Microsoft 365 Copilot) accessed through a web browser to submit sensitive work documents. Which Microsoft Purview and Defender feature combination should be configured to detect and block this behavior?

B is correct because Microsoft Defender for Cloud Apps session policies can intercept browser traffic to cloud applications (including third-party AI chatbots) and block or audit file uploads to these services. Microsoft Purview Endpoint DLP with the browser extension monitors and can block sensitive data being pasted or uploaded from managed Windows devices to web applications, including third-party AI chatbots accessed through browsers. Together, they provide detection and blocking at both the cloud app proxy level and the endpoint level. A is incorrect because Communication Compliance monitors communications within Microsoft 365 services, not browser-based access to third-party web applications. C is incorrect because a DLP policy scoped to Microsoft 365 Apps controls data handling within Microsoft applications (Word, Excel), not browser-based uploads to third-party websites. D is incorrect because Conditional Access blocks authentication to specified enterprise applications registered in Entra ID, but consumer/third-party AI chatbots typically are not registered in the organization's Entra ID tenant.