Microsoft Purview Integration

Connect Microsoft Purview to Capsule Security to enrich your AI data-source inventory with authoritative sensitivity labels and to reveal which identities can reach classified content that AI agents use.

This integration connects to the Microsoft Graph API to read your organization's Microsoft Purview Information Protection data. Instead of inferring how sensitive a data source is, Capsule attaches the sensitivity labels your organization already applies through Purview to the data sources AI agents access - turning "an agent reads this file" into "an agent reads this Highly Confidential file."

The integration syncs:

• Sensitivity labels - Your tenant's Purview sensitivity-label catalog (names and priority order)
• Data-source classifications - Labels applied to SharePoint and OneDrive files that Capsule already tracks as AI data sources (for example, files referenced in Microsoft 365 Copilot interactions)
• Identity access - Which users can reach labeled content, resolved from file permissions including group membership

This is an enrichment integration: it does not create new inventory items. It layers classification onto data sources discovered by your other integrations, so it is most valuable alongside connectors like Microsoft 365 Copilot.

Before you begin, ensure you have:

• Microsoft Purview Information Protection sensitivity labels published in your tenant, with labels applied to content (manual labeling requires Microsoft 365 E3; automatic labeling requires E5)
• A Microsoft Entra ID account with Global Administrator or Application Administrator role (to grant admin consent)
• A Capsule Security account with admin access

1. Log in to the Capsule Security portal
2. Click Integrations in the left sidebar
3. Find the Microsoft Purview card and click Set up Integration
4. Click Connect with Microsoft
5. You'll be redirected to Microsoft's sign-in page

Authorize the Capsule application to read your Purview sensitivity data.

1. Sign in with your Microsoft Entra ID account that has the required administrator role (see Prerequisites)
2. Review the permissions requested by the Capsule application
3. Click Accept to grant admin consent for your organization

The Capsule application requires the following application-level permissions on the Microsoft Graph API. All permissions are read-only.

Admin consent must be granted by a Global Administrator or Application Administrator. Once granted, the permissions apply tenant-wide.

After you grant consent, Capsule automatically begins enriching your inventory.

• The tenant's sensitivity-label catalog is synced and kept up to date
• Capsule scans the SharePoint and OneDrive locations that host data sources already in your inventory, and extracts the sensitivity label applied to each file
• Label changes and file deletions are picked up incrementally on a recurring schedule
• For labeled files, Capsule records which identities can access them - both direct permissions and access through group membership
• Classifications attach to matching data sources automatically, including data sources discovered after the classification was ingested

No manual configuration is needed. Content is never read or stored - only label and permission metadata.

Once the integration is configured:

• Initial sync begins automatically and may take several minutes depending on how many data sources are in scope
• Sensitivity labels appear on data sources in Inventory > Data Sources - open a data source to see its label and classification chips
• Files protected with double-key encryption cannot be read and are skipped

1. Consent failed or permissions error

   • Verify your account has Global Administrator or Application Administrator role in Microsoft Entra ID
   • Ensure all five permissions listed above are granted and admin consent has been given

2. No labels appearing on data sources

   • Confirm sensitivity labels are published and actually applied to files in your tenant
   • Labels only appear on data sources Capsule already tracks - connect an AI platform integration (for example, Microsoft 365 Copilot) so there are data sources to enrich
   • Allow several minutes after the first sync completes

3. Labels missing for specific files

   • Files protected with double-key encryption cannot be inspected and are skipped
   • Very long file URLs (over 255 characters) are not matched

4. Connection test fails

   • Ensure the Entra application has the required permissions granted with admin consent
   • Verify Microsoft Purview Information Protection is active in your tenant

For help with this integration:

• Email: support@capsule.security
• Include: Your organization ID, Entra tenant ID, and any error messages

• Microsoft Purview Information Protection
• Sensitivity labels overview
• Microsoft Graph - extractSensitivityLabels
• Microsoft Entra ID application permissions