> For the complete documentation index, see [llms.txt](https://docs.euno.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.euno.ai/sources/data-security/microsoft-purview-integration.md).

# Microsoft Purview

Euno's Microsoft Purview integration discovers Purview Data Loss Prevention (DLP) policies, connects them to Power BI resources that Euno has already discovered, and can enrich matching Power BI resources with Microsoft Purview Data Map metadata.

## Setting up Microsoft Purview integration

### Overview

Microsoft Purview is Microsoft's governance and compliance platform for Microsoft 365 and Fabric. In Euno, the Microsoft Purview integration reads sensitivity label metadata and DLP policy definitions from Microsoft Graph, then creates `purview_dlp_policy` resources in Euno.

When a Purview DLP policy applies to supported Power BI items, Euno can show those Power BI resources as regulated by the Purview policy. If you also provide the Purview account name, Euno uses Microsoft Purview Data Map to add Purview metadata, such as tags, classifications, descriptions, and data policy names, to matching Power BI resources.

The Power BI resources must already exist in Euno from the Power BI integration.

{% hint style="info" %}
The Microsoft Purview integration does not create Power BI reports, dashboards, apps, semantic models, dataflows, or columns. Run the Power BI integration first, then run Microsoft Purview to add policy and metadata context.
{% endhint %}

### Step 1: Prepare Microsoft access

#### Prerequisites

* Microsoft Entra administrator access to create an app registration and grant admin consent.
* Microsoft Purview DLP policies in the Microsoft 365 tenant.
* A Power BI source in Euno if you want Purview policies linked to Power BI resources.
* A Microsoft Purview account with Power BI assets in Data Map if you want Purview metadata enrichment on Power BI resources.

#### Create an Entra app registration for Euno

This step creates a **service application in your Microsoft tenant**. It is **not** an Azure Marketplace install of Euno, and it does not register the Euno product inside Azure.

Instead, you create (or choose) an Entra **app registration** whose credentials Euno stores and uses to call Microsoft Graph when the Purview source runs. A common name is `Euno Purview Integration`.

{% hint style="info" %}
If you already have an Entra app for the [Power BI integration](/sources/business-intelligence/powerbi-integration.md), use a **separate** app registration for Microsoft Purview unless you intentionally want one shared service principal for both integrations.
{% endhint %}

1. Open [Microsoft Entra](https://entra.microsoft.com/) and sign in.
2. In the sidebar, pick **App registrations**.
3. Click **New registration** (or open an existing app registration dedicated to this integration).
4. Enter a name (for example, `Euno Purview Integration`), select **Single tenant only** under **Supported account types**, and leave **Redirect URI** empty.

   In some Entra portal versions this option is labeled **Accounts in this organizational directory only** — it is the same setting.

<figure><img src="/files/uuOJQaig3PnoCb3zju2u" alt="Register an application: choose Single tenant only and leave Redirect URI empty"><figcaption><p>Register an application: choose Single tenant only and leave Redirect URI empty</p></figcaption></figure>

5. Click **Register**.
6. On the **Overview** page, copy **Application (client) ID** and **Directory (tenant) ID**. You will enter these in Euno as **Client ID** and **Tenant ID**.
7. In the sidebar, open **Certificates & secrets**.
8. Under **Client secrets**, click **+ New client secret**, set an expiry, and click **Add**.
9. Copy the secret **Value** immediately. You will enter it in Euno as **Client Secret**.

#### Grant Microsoft Graph application permissions

1. In the app registration sidebar, open **API permissions**.
2. Click **+ Add a permission**.
3. Select **Microsoft Graph**.
4. Select **Application permissions** (not Delegated permissions).
5. Search for and add the permissions needed to read sensitivity label metadata. Microsoft tenants can expose either the newer Data Security and Governance label API or the older Information Protection label API:
   * `SensitivityLabel.Read` — least-privileged permission for tenant sensitivity labels on the Microsoft Graph Data Security and Governance API.
   * `SensitivityLabels.Read.All` — broader alternative if your Microsoft tenant requires it.
   * `InformationProtectionPolicy.Read.All` — required by older Microsoft Graph Information Protection label APIs that Euno can use as a fallback.
6. Click **Add permissions** at the bottom of the panel to return to the **API permissions** page.

<figure><img src="/files/T9X7483fV16p4dY4Id2M" alt="Request API permissions: select Application permissions and add SensitivityLabel.Read"><figcaption><p>Request API permissions: select Application permissions and add SensitivityLabel.Read</p></figcaption></figure>

7. Back on the **API permissions** page, click **Grant admin consent for \[your organization]** above the permissions table.
8. Confirm when prompted. The **Status** column for each permission should show a green checkmark for **Granted for \[your organization]**.

<figure><img src="/files/JuTUXXpJkpmpWltdNjCW" alt="API permissions after admin consent: all required Application permissions show Granted for [your organization]"><figcaption><p>API permissions after admin consent: all required Application permissions show Granted for [your organization]</p></figcaption></figure>

#### Grant Microsoft Purview Data Map access

This step is required only if you want Euno to read Purview Data Map metadata for Power BI assets.

Grant the Euno app registration access to the relevant Microsoft Purview Data Map collection. Use the least-privileged role that lets the app read assets, classifications, and labels, such as **Data Reader**. Use a broader role only if your organization's Purview access model requires it.

{% hint style="info" %}
If you skip Data Map access or leave the Purview Account Name blank in Euno, the Microsoft Purview source still reads DLP policies from Microsoft Graph. It will skip Data Map metadata enrichment.
{% endhint %}

### Step 2: Configure New Microsoft Purview Source in Euno

#### Access the Sources Page

1. Go to the **Sources** page in Euno.
2. Click **Add New Source**.
3. Select **Microsoft Purview**.

#### General Configuration

Asterisk (\*) means a mandatory field.

| Configuration        | Description                                                                                                                                                                                     |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name\*               | Enter a name for your Microsoft Purview source, for example `Microsoft Purview - Production`.                                                                                                   |
| Tenant ID\*          | Microsoft Entra directory tenant ID.                                                                                                                                                            |
| Client ID\*          | Application (client) ID for the Entra app registration.                                                                                                                                         |
| Client Secret\*      | Client secret value for the Entra app registration.                                                                                                                                             |
| Purview Account Name | Optional. Enter the Microsoft Purview account name to enable Data Map metadata enrichment for matching Power BI resources. For example, use `contoso` from `https://contoso.purview.azure.com`. |

Microsoft Graph DLP policy discovery does not require a Purview account name. Data Map metadata enrichment requires the Purview account name and Data Map collection access.

### Step 3: Schedule

* Enable the Schedule option.
* Choose:
  1. **Weekly**: Set specific days and times.
  2. **Hourly**: Define the interval in hours.

{% hint style="info" %}
Recommended: schedule Microsoft Purview after the Power BI source has refreshed. This lets Euno link Purview DLP policies to the latest Power BI resources.
{% endhint %}

### Step 4: Resource Cleanup

To keep your data relevant and free of outdated resources, Euno provides automatic **resource cleanup** options. For a detailed explanation on Euno's cleanup strategies, see: [Resource Sponsorship in Euno](/developer-reference/technical-concepts/resource-sponsorship-and-cleanup-in-euno.md).

* **Immediate Cleanup**: Remove resources not detected in the most recent successful source integration run.
* **No Cleanup**: Keep all resources indefinitely, even if they are no longer detected.

### Step 5: Save Configuration

Click **Test & Save** to complete setup. Euno validates Microsoft Graph authentication, sensitivity label access, and DLP policy access before saving the source. If Purview Account Name is configured, Euno also performs a small Data Map search probe to validate Data Map access.

## What Euno discovers

The Microsoft Purview integration creates `purview_dlp_policy` resources and can connect them to supported Power BI resources through policy regulation relationships. When Data Map is configured, it also reads Power BI Data Map asset metadata and enriches existing Power BI resources with Purview tags, classifications, descriptions, and data policy names.

For detailed information about discovered resources, properties, relationships, and EQL examples, see [microsoft-purview-integration-discovered-resources](/sources/data-security/microsoft-purview-integration/microsoft-purview-integration-discovered-resources.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.euno.ai/sources/data-security/microsoft-purview-integration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.