Labels for Azure Information Protection
Purpose of the page¶
This page provides information on creating an application and its endpoint to access the Azure Information Protection label list.
Configuring the Azure Information Protection label application¶
Registering a new application¶
From the Microsoft Entra administration centre, section 'Applications -> Enterpise applications', create a new application for label access. Select create your own application. Enter a name for the application. Click on the Create button. An application will be created and you will navigate to the application overview page.
Take note of the Application (Client) ID of the newly created application.
References: https://entra.microsoft.com/
API permissions¶
Assign the following permissions, see section 'Applications -> App registration -> API Permissions'.
| APIs | API / Permission Name | Type |
|---|---|---|
| Microsoft Graph | InformationProtectionPolicy.Read.All | Application |
| Microsoft Information Protection Sync Service | UnifiedPolicy.Tenant.Read | Application |
Once the permissions have been entered, give consent to the grant for Microsoft (see the relevant button).
Secret¶
From the 'Certificates and Secrets' section, create a new secret for the application and note the value of the secret.
Caution: The secret value will only be accessible for a short time.
Configuring the endpoint for the Azure Information Protection labels¶
Repository > Endpoint
Required information¶
The following information will be required for configuration:
- Directory (tenant) ID. Example: 51ce633b-266a-4f37-0001-b9d0d77e2d90
- The Application (client) ID of an application configured to access label information.
- A secret related to the authentication application Example: fwH8Q~kxWMe6bmnWwZjVpW4Ujn6ayzUXhItnacuF
Be careful to use the secret and not the secret id.
Configure an endpoint.¶
Add a new endpoint by means of the add button.
Attributes Section¶
| Field | Value |
|---|---|
| Code | Identified endpoint code for labels, Example: LABELS |
| Description | Shows the description in full. |
| Endpoint type | Select API REST. |
REST API subsection¶
| Field | Value |
|---|---|
| URL | Enter the following URL: https://graph.microsoft.com/beta/dataClassification/sensitivityLabels |
| Type of response | Select: JSON |
| Path | enter: value |
| Managed levels | Set value 2 |
Leave the rest of the subsections untouched.
Authentication section¶
| Field | Value |
|---|---|
| Authentication Type | Select: OAuth 2.0 |
| Grant type | Select: Client credentials |
| Token Endpoint | Enter the following text replacing the text |
| Client Id | Insert Cliend ID. |
| Client Secret | Enter the Secret of the application configured to access the labels. |
| Scopes | Enter the following text: https://graph.microsoft.com/.default |
| Resource | Leave blank. |
| Client Authentication | Select: Send as basic authentication header. |
Save the configuration.
It will now be possible to set the labels to be used for Azure Information Protection. See: Endpoint Label Setting