Another month, another Inside the System is here, and this time we are talking about the gap between what your clients think they blocked and what is actually happening on their screens. Most of your clients know how to block a website, but far fewer can name the helper sitting right beside the page their team opens every single day. That gap is precisely how a client email leaves the building without anyone ever pressing copy. Picture sitting down with a managing director who proudly tells you they blocked the public chatbot last month. You open a laptop together. The mailbox on screen is the official corporate account, but right next to it sits a narrow vertical bar offering to polish up a sentence. Nobody copied and pasted the letter anywhere. The bar simply reads whatever page happens to be open on the screen. That is the environment your clients are actually working in.
If you rely on traditional checks, you will miss this setup entirely. The invoice tracks money, but a free helper never generates a line item. The identity admin tracks login grants and authorized apps, but a browser helper often bypasses that layer by living directly inside the browser on top of a tool the company already trusts. A domain block tracks web addresses, so it has no idea an extension was added back in January. In your next client review, focus on three specific patterns, and stick to the one browser people actually open to draft client mail rather than auditing every obscure icon across fifty laptops.
First, look for the custom sidebar. Rewrite buttons, summarizers, and translators are installed from a browser store on a busy Tuesday because someone had a tight deadline. It earns its keep by reading the screen. The installation screen popped up a warning saying it could read data on visited sites, but people clicked right through it. Take a look at the exact wording on the client machine before you quote permissions back to them. Second, check the built-in browser sidebars. On Microsoft Edge, Copilot in the side pane can be allowed to read open pages, history, and video transcripts under the EdgeEntraCopilotPageContext setting for company Entra accounts. In the EU, the default setting is off, but users can still toggle it on manually unless you enforce a policy. If they are signed in with a personal Microsoft profile, that policy will not apply anyway, though strict data-loss rules on a page will still block access. Double-check Microsoft's current docs before telling a client how their defaults behave. Third, look for helpers meant for completely different jobs, such as coupon finders, read-later tools, or a translator added for a holiday. If it was given permission to run on all sites, your work tools are on that list. Treat this as a standard operational check rather than an accusation that every extension is actively stealing data. You do not need a complex stack to make this real. Just ask which button sits beside the inbox and whether it can see the screen without a copy-paste.
Relying on old playbooks leaves obvious gaps. Saying you blocked the chatbot only closes a web domain, while the sidebar was never that domain. Telling staff not to paste client data covers manual habits, but it does nothing when a helper reads the open page automatically. Reviewing identity admin permissions will not uninstall a browser extension. Disabling a leaver’s mailbox leaves the browser profile intact on unmanaged or home machines, and uninstalling an extension does not guarantee the vendor wiped data they already processed. Locking down extensions only on managed profiles ignores personal profiles, alternative browsers, and home PCs. Banning extensions entirely, including password managers, just drives work further into the dark. Furthermore, this is not a background data pipe like a scheduled automation flow; a sidebar acts in real time, only while the page is open.
Turn this inspection into a high-value service. During your next review, bring a simple single-page breakdown covering their primary browser. List the browser used for client communication, any active helpers that read page content, what the user thinks the tool does, and whether it can read the open page. If permissions are unclear, write "not visible" because that phrase speaks volumes. Note whether it sits on a managed company profile or an unmonitored one, and for built-in sidebars, state whether policy enforces access or if users can toggle it themselves. Then ask one simple decision question: which of these does the team actually need, and which come off today? If a tool is genuinely useful, document its single business function and assign it to a managed company profile where you can review it again next quarter. Follow up with the question that elevates the conversation: if a customer asked who else can see the email your team has open right now, which of these helpers would you forget to mention?
People install sidebars because rewriting a complex email on a deadline is faster than using whatever official tool they were given. Find out what job they were trying to do before telling them to delete it. If the operational need is real, give them a clear path forward by identifying the core job, consolidating to one approved helper on a managed browser profile, cleaning house on anything no one can explain, and adding browser profiles and extensions to your leaver checklist alongside mailbox revocation. MSPs who bring this level of clarity become the trusted advisors who replace "we blocked that website" with actual visibility. MSPs who stick to domain-block lists will stay trapped in ticket queues trying to answer for data exposure after the fact.
The page a user is allowed to open is already the data. A sidebar sitting on that page sees it without needing a copy-paste, a new subscription, or an admin approval. If you need a quick summary to drop into a client email, use this: The team opens the client mailbox in the approved browser. A small helper next to that page can read it, even if no one ever pastes text into a chatbot. It will not show up on a software invoice or in your app registry. We can list these helpers on a single page covering what each one does, whether it reads the screen, and whether it sits on a managed browser. From there, you can decide which ones stay.