Skip to content

Labels for Azure Information Protection

Purpose of the page

This page provides information on creating an application and its endpoint to access the Azure Information Protection label list.

Configuring the Azure Information Protection label application

Registering a new application

From the Microsoft Entra administration centre, section 'Applications -> Enterpise applications', create a new application for label access. Select create your own application. Enter a name for the application. Click on the Create button. An application will be created and you will navigate to the application overview page.

Take note of the Application (Client) ID of the newly created application.

References: https://entra.microsoft.com/

API permissions

Assign the following permissions, see section 'Applications -> App registration -> API Permissions'.

APIs API / Permission Name Type
Microsoft Graph InformationProtectionPolicy.Read.All Application
Microsoft Information Protection Sync Service UnifiedPolicy.Tenant.Read Application

Once the permissions have been entered, give consent to the grant for Microsoft (see the relevant button).

Secret

From the 'Certificates and Secrets' section, create a new secret for the application and note the value of the secret.

Caution: The secret value will only be accessible for a short time.

Configuring the endpoint for the Azure Information Protection labels

Repository > Endpoint

Required information

The following information will be required for configuration:

  • Directory (tenant) ID. Example: 51ce633b-266a-4f37-0001-b9d0d77e2d90
  • The Application (client) ID of an application configured to access label information.
  • A secret related to the authentication application Example: fwH8Q~kxWMe6bmnWwZjVpW4Ujn6ayzUXhItnacuF

Be careful to use the secret and not the secret id.

Configure an endpoint.

Add a new endpoint by means of the add button.

Attributes Section

Field Value
Code Identified endpoint code for labels, Example: LABELS
Description Shows the description in full.
Endpoint type Select API REST.

REST API subsection

Field Value
URL Enter the following URL: https://graph.microsoft.com/beta/dataClassification/sensitivityLabels
Type of response Select: JSON
Path enter: value
Managed levels Set value 2

Leave the rest of the subsections untouched.

Authentication section

Field Value
Authentication Type Select: OAuth 2.0
Grant type Select: Client credentials
Token Endpoint Enter the following text replacing the text with the Tenant ID of your organisation. https://login.microsoftonline.com//oauth2/v2.0/token Example: https://login.microsoftonline.com/73727f63-b5c4-4b0d-905d-e9c951753cd3/oauth2/v2.0/token
Client Id Insert Cliend ID.
Client Secret Enter the Secret of the application configured to access the labels.
Scopes Enter the following text: https://graph.microsoft.com/.default
Resource Leave blank.
Client Authentication Select: Send as basic authentication header.

Save the configuration.

It will now be possible to set the labels to be used for Azure Information Protection. See: Endpoint Label Setting