> For the complete documentation index, see [llms.txt](https://docs.euno.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.euno.ai/sources/data-security/microsoft-purview-integration.md). # Microsoft Purview Euno's Microsoft Purview integration discovers Purview Data Loss Prevention (DLP) policies, connects them to Power BI resources that Euno has already discovered, and can enrich matching Power BI resources with Microsoft Purview Data Map metadata. ## Setting up Microsoft Purview integration ### Overview Microsoft Purview is Microsoft's governance and compliance platform for Microsoft 365 and Fabric. In Euno, the Microsoft Purview integration reads sensitivity label metadata and DLP policy definitions from Microsoft Graph, then creates `purview_dlp_policy` resources in Euno. When a Purview DLP policy applies to supported Power BI items, Euno can show those Power BI resources as regulated by the Purview policy. If you also provide the Purview account name, Euno uses Microsoft Purview Data Map to add Purview metadata, such as tags, classifications, descriptions, and data policy names, to matching Power BI resources. The Power BI resources must already exist in Euno from the Power BI integration. {% hint style="info" %} The Microsoft Purview integration does not create Power BI reports, dashboards, apps, semantic models, dataflows, or columns. Run the Power BI integration first, then run Microsoft Purview to add policy and metadata context. {% endhint %} {% hint style="info" %} Policy regulation links depend on sensitivity labels. Power BI items need an applied sensitivity label that is referenced by a Purview DLP policy. Data Map enrichment is separate and requires Purview Account Name. {% endhint %} ### Step 1: Prepare Microsoft access #### Prerequisites * Microsoft Entra administrator access to create an app registration and grant admin consent. * Microsoft Purview DLP policies in the Microsoft 365 tenant. * A Power BI source in Euno if you want Purview policies linked to Power BI resources. * A Microsoft Purview account with Power BI assets in Data Map if you want Purview metadata enrichment on Power BI resources. #### Create an Entra app registration for Euno This step creates a **service application in your Microsoft tenant**. It is **not** an Azure Marketplace install of Euno, and it does not register the Euno product inside Azure. Instead, you create (or choose) an Entra **app registration** whose credentials Euno stores and uses to call Microsoft Graph when the Purview source runs. A common name is `Euno Purview Integration`. {% hint style="info" %} If you already have an Entra app for the [Power BI integration](/sources/business-intelligence/powerbi-integration.md), use a **separate** app registration for Microsoft Purview unless you intentionally want one shared service principal for both integrations. {% endhint %} 1. Open [Microsoft Entra](https://entra.microsoft.com/) and sign in. 2. In the sidebar, pick **App registrations**. 3. Click **New registration** (or open an existing app registration dedicated to this integration). 4. Enter a name (for example, `Euno Purview Integration`), select **Single tenant only** under **Supported account types**, and leave **Redirect URI** empty. In some Entra portal versions this option is labeled **Accounts in this organizational directory only** — it is the same setting.
Register an application: choose Single tenant only and leave Redirect URI empty

Register an application: choose Single tenant only and leave Redirect URI empty

5. Click **Register**. 6. On the **Overview** page, copy **Application (client) ID** and **Directory (tenant) ID**. You will enter these in Euno as **Client ID** and **Tenant ID**. 7. In the sidebar, open **Certificates & secrets**. 8. Under **Client secrets**, click **+ New client secret**, set an expiry, and click **Add**. 9. Copy the secret **Value** immediately. You will enter it in Euno as **Client Secret**. #### Grant Microsoft Graph application permissions 1. In the app registration sidebar, open **API permissions**. 2. Click **+ Add a permission**. 3. Select **Microsoft Graph**. 4. Select **Application permissions** (not Delegated permissions). 5. Search for and add the Microsoft Graph **Application permissions** needed so Euno can: * Read tenant sensitivity label metadata (used to map DLP policies to Power BI items) * Read Purview DLP policy definitions from Microsoft Graph (validated when you click **Test & Save**) Microsoft tenants can expose either the newer Data Security and Governance label API or the older Information Protection label API: * `SensitivityLabel.Read` — least-privileged permission for tenant sensitivity labels on the Microsoft Graph Data Security and Governance API. * `SensitivityLabels.Read.All` — broader alternative if your Microsoft tenant requires it. * `InformationProtectionPolicy.Read.All` — required by older Microsoft Graph Information Protection label APIs that Euno can use as a fallback. If **Test & Save** fails on DLP policy access after label permissions are granted, ask your Microsoft admin which additional Graph application permission your tenant requires for Data Security and Governance policy files, then grant admin consent again. 6. Click **Add permissions** at the bottom of the panel to return to the **API permissions** page.
Request API permissions: select Application permissions and add SensitivityLabel.Read

Request API permissions: select Application permissions and add SensitivityLabel.Read

7. Back on the **API permissions** page, click **Grant admin consent for \[your organization]** above the permissions table. 8. Confirm when prompted. The **Status** column for each permission should show a green checkmark for **Granted for \[your organization]**.
API permissions after admin consent: all required Application permissions show Granted for [your organization]

API permissions after admin consent: all required Application permissions show Granted for [your organization]

#### Grant Microsoft Purview Data Map access This step is required only if you want Euno to read Purview Data Map metadata for Power BI assets. Grant the Euno app registration access to the relevant Microsoft Purview Data Map collection. Use the least-privileged role that lets the app read assets, classifications, and labels, such as **Data Reader**. Use a broader role only if your organization's Purview access model requires it. {% hint style="info" %} If you skip Data Map access or leave the Purview Account Name blank in Euno, the Microsoft Purview source still reads DLP policies from Microsoft Graph. It will skip Data Map metadata enrichment. {% endhint %} ### Step 2: Configure New Microsoft Purview Source in Euno #### Access the Sources Page 1. Go to the **Sources** page in Euno. 2. Click **Add New Source**. 3. Select **Microsoft Purview**. #### General Configuration Asterisk (\*) means a mandatory field. | Configuration | Description | | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name\* | Enter a name for your Microsoft Purview source, for example `Microsoft Purview - Production`. | | Tenant ID\* | Microsoft Entra directory tenant ID. | | Client ID\* | Application (client) ID for the Entra app registration. | | Client Secret\* | Client secret value for the Entra app registration. | | Purview Account Name | Optional. The Azure **Microsoft Purview account** resource name. Required for Data Map metadata enrichment on matching Power BI resources. See [Find your Purview account name](#find-your-purview-account-name) below. | Microsoft Graph DLP policy discovery does not require a Purview account name. Data Map metadata enrichment requires the Purview account name and Data Map collection access. #### Find your Purview account name The value is the **Name** of the Microsoft Purview account resource in Azure — not your Entra tenant ID, and not a value from the new Microsoft Purview portal URL (`https://purview.microsoft.com/...`). 1. Open the [Azure portal](https://portal.azure.com/). 2. Search for **Microsoft Purview** and open **Microsoft Purview accounts**. 3. Select the Purview account for your organization. 4. On the **Overview** page, copy the account **Name** (for example, `Euno` or `contoso`). If you still use the classic governance endpoint, the same value appears as the hostname prefix: `https://.purview.azure.com` (for example, `contoso` from `https://contoso.purview.azure.com`). ### Step 3: Schedule * Enable the Schedule option. * Choose: 1. **Weekly**: Set specific days and times. 2. **Hourly**: Define the interval in hours. {% hint style="info" %} Recommended: schedule Microsoft Purview after the Power BI source has refreshed. This lets Euno link Purview DLP policies to the latest Power BI resources. {% endhint %} ### Step 4: Resource Cleanup To keep your data relevant and free of outdated resources, Euno provides automatic **resource cleanup** options. For a detailed explanation on Euno's cleanup strategies, see: [Resource Sponsorship in Euno](/developer-reference/technical-concepts/resource-sponsorship-and-cleanup-in-euno.md). * **Immediate Cleanup**: Remove resources not detected in the most recent successful source integration run. * **No Cleanup**: Keep all resources indefinitely, even if they are no longer detected. ### Step 5: Save Configuration Click **Test & Save** to complete setup. Euno validates Microsoft Graph authentication, sensitivity label access, and DLP policy access before saving the source. If Purview Account Name is configured, Euno also performs a small Data Map search probe to validate Data Map access. If Microsoft Entra rejects authentication, the connection-test error includes its rejection reason and AADSTS code when available. Use that explanation to check your tenant ID, client ID, and current client-secret value. The configured secret is redacted from the error; long explanations may be shortened. ## What Euno discovers The Microsoft Purview integration creates: * `purview_dlp_policy` resources from Microsoft Graph DLP policies * `purview_datamap_asset` resources when Purview Account Name is set, used to enrich matching Power BI resources It can connect supported Power BI resources to those DLP policies through policy regulation relationships. When Data Map is configured, it also adds Purview tags, classifications, descriptions, and data policy names to matching Power BI resources. For detailed information about discovered resources, properties, relationships, and EQL examples, see [microsoft-purview-integration-discovered-resources](/sources/data-security/microsoft-purview-integration/microsoft-purview-integration-discovered-resources.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.euno.ai/sources/data-security/microsoft-purview-integration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.