Microsoft Purview

Euno's Microsoft Purview integration discovers Purview Data Loss Prevention (DLP) policies, connects them to Power BI resources that Euno has already discovered, and can enrich matching Power BI resources with Microsoft Purview Data Map metadata.

Setting up Microsoft Purview integration

Overview

Microsoft Purview is Microsoft's governance and compliance platform for Microsoft 365 and Fabric. In Euno, the Microsoft Purview integration reads sensitivity label metadata and DLP policy definitions from Microsoft Graph, then creates purview_dlp_policy resources in Euno.

When a Purview DLP policy applies to supported Power BI items, Euno can show those Power BI resources as regulated by the Purview policy. If you also provide the Purview account name, Euno uses Microsoft Purview Data Map to add Purview metadata, such as tags, classifications, descriptions, and data policy names, to matching Power BI resources.

The Power BI resources must already exist in Euno from the Power BI integration.

The Microsoft Purview integration does not create Power BI reports, dashboards, apps, semantic models, dataflows, or columns. Run the Power BI integration first, then run Microsoft Purview to add policy and metadata context.

Step 1: Prepare Microsoft access

Prerequisites

• Microsoft Entra administrator access to create an app registration and grant admin consent.

• Microsoft Purview DLP policies in the Microsoft 365 tenant.

• A Power BI source in Euno if you want Purview policies linked to Power BI resources.

• A Microsoft Purview account with Power BI assets in Data Map if you want Purview metadata enrichment on Power BI resources.

Create an Entra app registration for Euno

This step creates a service application in your Microsoft tenant. It is not an Azure Marketplace install of Euno, and it does not register the Euno product inside Azure.

Instead, you create (or choose) an Entra app registration whose credentials Euno stores and uses to call Microsoft Graph when the Purview source runs. A common name is Euno Purview Integration.

If you already have an Entra app for the Power BI integration, use a separate app registration for Microsoft Purview unless you intentionally want one shared service principal for both integrations.

1. Open Microsoft Entra and sign in.

2. In the sidebar, pick App registrations.

3. Click New registration (or open an existing app registration dedicated to this integration).

4. Enter a name (for example, Euno Purview Integration), select Single tenant only under Supported account types, and leave Redirect URI empty.

   In some Entra portal versions this option is labeled Accounts in this organizational directory only — it is the same setting.

Register an application: choose Single tenant only and leave Redirect URI empty

1. Click Register.

2. On the Overview page, copy Application (client) ID and Directory (tenant) ID. You will enter these in Euno as Client ID and Tenant ID.

3. In the sidebar, open Certificates & secrets.

4. Under Client secrets, click + New client secret, set an expiry, and click Add.

5. Copy the secret Value immediately. You will enter it in Euno as Client Secret.

Grant Microsoft Graph application permissions

1. In the app registration sidebar, open API permissions.

2. Click + Add a permission.

3. Select Microsoft Graph.

4. Select Application permissions (not Delegated permissions).

5. Search for and add the permissions needed to read sensitivity label metadata. Microsoft tenants can expose either the newer Data Security and Governance label API or the older Information Protection label API:

   • SensitivityLabel.Read — least-privileged permission for tenant sensitivity labels on the Microsoft Graph Data Security and Governance API.

   • SensitivityLabels.Read.All — broader alternative if your Microsoft tenant requires it.

   • InformationProtectionPolicy.Read.All — required by older Microsoft Graph Information Protection label APIs that Euno can use as a fallback.

6. Click Add permissions at the bottom of the panel to return to the API permissions page.

Request API permissions: select Application permissions and add SensitivityLabel.Read

1. Back on the API permissions page, click Grant admin consent for [your organization] above the permissions table.

2. Confirm when prompted. The Status column for each permission should show a green checkmark for Granted for [your organization].

API permissions after admin consent: all required Application permissions show Granted for [your organization]

Grant Microsoft Purview Data Map access

This step is required only if you want Euno to read Purview Data Map metadata for Power BI assets.

Grant the Euno app registration access to the relevant Microsoft Purview Data Map collection. Use the least-privileged role that lets the app read assets, classifications, and labels, such as Data Reader. Use a broader role only if your organization's Purview access model requires it.

If you skip Data Map access or leave the Purview Account Name blank in Euno, the Microsoft Purview source still reads DLP policies from Microsoft Graph. It will skip Data Map metadata enrichment.

Step 2: Configure New Microsoft Purview Source in Euno

Access the Sources Page

1. Go to the Sources page in Euno.

2. Click Add New Source.

3. Select Microsoft Purview.

General Configuration

Asterisk (*) means a mandatory field.

Configuration	Description
Name*	Enter a name for your Microsoft Purview source, for example Microsoft Purview - Production.
Tenant ID*	Microsoft Entra directory tenant ID.
Client ID*	Application (client) ID for the Entra app registration.
Client Secret*	Client secret value for the Entra app registration.
Purview Account Name	Optional. Enter the Microsoft Purview account name to enable Data Map metadata enrichment for matching Power BI resources. For example, use contoso from https://contoso.purview.azure.com.

Microsoft Graph DLP policy discovery does not require a Purview account name. Data Map metadata enrichment requires the Purview account name and Data Map collection access.

Step 3: Schedule

• Enable the Schedule option.

• Choose:

  1. Weekly: Set specific days and times.

  2. Hourly: Define the interval in hours.

Recommended: schedule Microsoft Purview after the Power BI source has refreshed. This lets Euno link Purview DLP policies to the latest Power BI resources.

Step 4: Resource Cleanup

To keep your data relevant and free of outdated resources, Euno provides automatic resource cleanup options. For a detailed explanation on Euno's cleanup strategies, see: Resource Sponsorship in Euno.

• Immediate Cleanup: Remove resources not detected in the most recent successful source integration run.

• No Cleanup: Keep all resources indefinitely, even if they are no longer detected.

Step 5: Save Configuration

Click Test & Save to complete setup. Euno validates Microsoft Graph authentication, sensitivity label access, and DLP policy access before saving the source. If Purview Account Name is configured, Euno also performs a small Data Map search probe to validate Data Map access.

What Euno discovers

The Microsoft Purview integration creates purview_dlp_policy resources and can connect them to supported Power BI resources through policy regulation relationships. When Data Map is configured, it also reads Power BI Data Map asset metadata and enriches existing Power BI resources with Purview tags, classifications, descriptions, and data policy names.

For detailed information about discovered resources, properties, relationships, and EQL examples, see microsoft-purview-integration-discovered-resources.