Explanation:
Box 1: Test it out first
To configure the policy that blocks elevated risk users from uploading or pasting sensitive data to AI websites, you will configure the policy in "Test" mode within the Microsoft Purview portal to begin with, and then change it to a block-with-override mode to enforce protection on risky users for the relevant web browsers.
Box 2: Devices only
* Devices - Yes
Policies within Microsoft Purview's Data Security Posture Management for AI (DSPM for AI) can apply to user devices, specifically through Endpoint data loss prevention (DLP), which monitors and can block sensitive data from being pasted or uploaded to third-party AI sites accessed via browsers on those devices. This is achieved by onboarding Windows computers to Microsoft Purview and configuring Endpoint DLP policies to detect and prevent sharing sensitive information through the browser.
Reference:
https://learn.microsoft.com/en-us/purview/dspm-for-ai-considerations