An organization wants to prevent employees from using unauthorized consumer AI tools (like public ChatGPT) on corporate devices. They want to block uploads of sensitive files to these services while allowing approved enterprise AI tools. Which Microsoft solution enforces this endpoint-level control?

Microsoft Purview DLP endpoint policy that blocks uploading files with sensitivity labels to unauthorized cloud AI services is correct because Microsoft Purview DLP endpoint policies, deployed through Microsoft Defender for Endpoint, can detect when a user attempts to upload a file containing sensitive content or bearing a sensitivity label to cloud services, including web browsers. An endpoint activities DLP rule can list unauthorized AI services, such as chat.openai.com, as restricted domains and block file uploads to them while allowing uploads to approved enterprise AI services. This gives granular control at the file-sensitivity level on the endpoint itself. Azure Firewall application rules blocking specific AI service FQDNs is wrong because Azure Firewall blocks traffic at the network perimeter, not on individual endpoints; it would block all traffic to a domain, including legitimate personal use outside corporate time, and it does not distinguish between uploading a sensitive labeled file and general browsing. Microsoft Entra ID Conditional Access blocking access to non-approved applications is wrong because Conditional Access blocks application sign-in for corporate identities, while consumer AI tools often do not require corporate identity sign-in, making Conditional Access ineffective for blocking them. Microsoft Defender for Endpoint network protection with web content filtering is wrong because Defender for Endpoint web content filtering blocks entire site categories, such as social media or adult content, at the network level; it cannot distinguish between uploading sensitive files and normal browsing on an AI site.