Reads the sensitivity label taxonomy and the DLP alerts of Microsoft Purview through Microsoft Graph.
For the general flow of adding a source, see Connect Data Sources.
Prerequisites
Active Microsoft Entra ID tenant
Microsoft 365 E5 / E5 Compliance licence (or the Information Protection & Governance add-on) for sensitivity labels and DLP
Azure account with Global Administrator or Privileged Role Administrator role ā an Application Administrator can create the App Registration but cannot grant admin consent to Microsoft Graph application permissions
Setup
Step 1 - Create an App Registration
Azure portal ā App registrations ā New registration
Name:
HARVEN-Purview, type: Single tenantNote the Application (client) ID and Directory (tenant) ID
Step 2 - Configure Microsoft Graph permissions
API permissions ā Add a permission ā Microsoft Graph ā Application permissions ā one permission per table:
Permission | Table |
|---|---|
SensitivityLabels.Read.All | sensitivity_label |
SecurityAlert.Read.All | dlp_alert |
ā ļø Click Grant admin consent. A missing permission makes the table next to it fail on the Tables tab.
Step 3 - Create a Client Secret
Certificates & secrets ā New client secret ā copy the value immediately.
Licensing: empty tables are not an error
Without the E5 / E5 Compliance licence, Microsoft accepts the connection but returns zero rows. An empty table then means "not licensed or not configured", not "no incident".
Fields to fill in HARVEN
Field | Where to find it |
|---|---|
Tenant ID | App Registration ā Directory (tenant) ID |
Client ID | App Registration ā Application (client) ID |
Client Secret | Certificates & secrets ā Value |
Collected data
sensitivity_label ā Sensitivity labels, sublabels included: Identification and hierarchy (label_id, name, parent_label_id), Rank, on the tenant's own scale (priority, sensitivity), State and endpoint DLP protection (is_enabled, is_endpoint_protection_enabled)
dlp_alert ā Microsoft Purview DLP alerts only: Triage (severity, status, classification, assigned_to), Lifecycle (last 30 days by default) (created_date, resolved_date, first_activity_date), Policy that fired and Defender portal link (alert_policy_id, alert_web_url)
Retention labels
Retention labels are not read: Microsoft Graph serves them only to a signed-in user, never to an application such as this connector.
Official documentation
Need help? Contact [email protected].