Connect Microsoft Purview

Imports Data Loss Prevention (DLP) alerts, sensitivity labels, and retention labels from Microsoft Purview via the Microsoft Graph API.

This connector covers Microsoft Purview's compliance features reachable through Microsoft Graph — not Azure Purview Data Map / Unified Catalog, which is a separate product for cataloguing data estates.

For the general flow of adding a source, see Connect Data Sources.

Before you start

• Microsoft 365 E5 / E5 Compliance license — or, standalone, Information Protection & Governance (sensitivity labels, DLP) and Data Lifecycle Management (retention labels)

• Azure account with Global Administrator or Application Administrator role

• An active Microsoft Entra ID tenant

💡 Without the right license, these APIs authenticate successfully and return zero rows rather than an error. An empty table here usually means the tenant isn't licensed for that feature, not that there's nothing to report.

Step 1 — Create an App Registration

1. Sign in to portal.azure.com

2. Search for App registrations → New registration

3. Name: HARVEN-Purview, type: Single tenant

4. Click Register

5. Note the Application (client) ID and Directory (tenant) ID

Step 2 — Configure API permissions

API permissions → Add a permission → Microsoft Graph → Application permissions

• SensitivityLabels.Read.All — Sensitivity labels

• RecordsManagement.Read.All — Retention labels

• SecurityAlert.Read.All — DLP alerts

⚠️ Click Grant admin consent to activate permissions.

Step 3 — Create a Client Secret

1. Left menu: Certificates & secrets

2. New client secret → choose a duration (24 months recommended)

3. Copy the value immediately — it is only shown once

What to enter in HARVEN

• Tenant ID — Your Azure AD tenant identifier (App Registration → Directory (tenant) ID)

• Client ID — Application identifier (App Registration → Application (client) ID)

• Client Secret — Secret created in Step 3 (Certificates & secrets → Value)

What HARVEN reads

• dlp_alert — Data Loss Prevention alerts (the DLP slice of your Microsoft Defender alert stream): identification (alert_id, provider_alert_id, incident_id, alert_policy_id, title), triage (severity, status, classification, determination, assigned_to), timing (created_date, resolved_date, last_update_date, first_activity_date, last_activity_date), context (categories, detection_source, product_name, description, alert_web_url, evidence, entra_tenant_id)

• sensitivity_label — Your tenant's sensitivity-label taxonomy, including sublabels: identity (label_id, name, parent_label_id), ranking (priority, is_enabled, is_endpoint_protection_enabled), configuration (action_source, applicable_to, description, tool_tip, auto_tooltip, color)

• retention_label — Retention / records-management label catalog: what the tenant retains, for how long, and what happens at the end — not the content the labels are applied to: identity (label_id, name, created_by, created_date, last_modified_date), retention rules (behavior_during_retention_period, action_after_retention_period, retention_trigger, retention_duration_days, is_in_use), records posture (default_record_behavior, label_to_be_applied, description_for_admins, description_for_users)

💡 If you also connect SharePoint, HARVEN automatically resolves the sensitivity-label IDs on your SharePoint sites into their label name and priority in reports.

Official documentation

• Microsoft Graph Permissions

• Azure App Registration

Need help? Contact [email protected].