# Microsoft Purview Integration

Connect Microsoft Purview to Capsule Security to enrich your AI data-source inventory with authoritative sensitivity labels and to reveal which identities can reach classified content that AI agents use.

## Overview

This integration connects to the Microsoft Graph API to read your organization's Microsoft Purview Information Protection data. Instead of inferring how sensitive a data source is, Capsule attaches the sensitivity labels your organization already applies through Purview to the data sources AI agents access - turning "an agent reads this file" into "an agent reads this **Highly Confidential** file."

The integration syncs:

- **Sensitivity labels** - Your tenant's Purview sensitivity-label catalog (names and priority order)
- **Data-source classifications** - Labels applied to SharePoint and OneDrive files that Capsule already tracks as AI data sources (for example, files referenced in Microsoft 365 Copilot interactions)
- **Identity access** - Which users can reach labeled content, resolved from file permissions including group membership


This is an **enrichment** integration: it does not create new inventory items. It layers classification onto data sources discovered by your other integrations, so it is most valuable alongside connectors like Microsoft 365 Copilot.

## Prerequisites

Before you begin, ensure you have:

- **Microsoft Purview Information Protection** sensitivity labels published in your tenant, with labels applied to content (manual labeling requires Microsoft 365 E3; automatic labeling requires E5)
- A **Microsoft Entra ID** account with **Global Administrator** or **Application Administrator** role (to grant admin consent)
- A **Capsule Security** account with admin access


## Step 1: Configure the Integration in Capsule

1. Log in to the **Capsule Security** portal
2. Click **Integrations** in the left sidebar
3. Find the **Microsoft Purview** card and click **Set up Integration**
4. Click **Connect with Microsoft**
5. You'll be redirected to Microsoft's sign-in page


## Step 2: Grant Admin Consent

Authorize the Capsule application to read your Purview sensitivity data.

### Steps

1. Sign in with your Microsoft Entra ID account that has the required administrator role (see Prerequisites)
2. Review the permissions requested by the Capsule application
3. Click **Accept** to grant admin consent for your organization


### Permissions

The Capsule application requires the following **application-level** permissions on the **Microsoft Graph** API. All permissions are read-only.

| Permission | Type | Description |
|  --- | --- | --- |
| `SensitivityLabels.Read.All` | Application | Read the tenant's sensitivity-label catalog |
| `Files.Read.All` | Application | Read file metadata and extract applied sensitivity labels |
| `Sites.Read.All` | Application | Enumerate SharePoint sites and drives |
| `Group.Read.All` | Application | Expand group membership for file-access resolution |
| `Directory.Read.All` | Application | Resolve users and groups in the directory |


Admin consent must be granted by a Global Administrator or Application Administrator. Once granted, the permissions apply tenant-wide.

## Step 3: Automatic Discovery and Sync

After you grant consent, Capsule automatically begins enriching your inventory.

### What happens

- The tenant's sensitivity-label catalog is synced and kept up to date
- Capsule scans the SharePoint and OneDrive locations that host data sources already in your inventory, and extracts the sensitivity label applied to each file
- Label changes and file deletions are picked up incrementally on a recurring schedule
- For labeled files, Capsule records which identities can access them - both direct permissions and access through group membership
- Classifications attach to matching data sources automatically, including data sources discovered *after* the classification was ingested


No manual configuration is needed. Content is never read or stored - only label and permission metadata.

## After Setup

Once the integration is configured:

- Initial sync begins automatically and may take several minutes depending on how many data sources are in scope
- Sensitivity labels appear on data sources in **Inventory > Data Sources** - open a data source to see its label and classification chips
- Files protected with double-key encryption cannot be read and are skipped


## Troubleshooting

### Common Issues

1. **Consent failed or permissions error**
  - Verify your account has **Global Administrator** or **Application Administrator** role in Microsoft Entra ID
  - Ensure all five permissions listed above are granted and admin consent has been given
2. **No labels appearing on data sources**
  - Confirm sensitivity labels are published and actually applied to files in your tenant
  - Labels only appear on data sources Capsule already tracks - connect an AI platform integration (for example, Microsoft 365 Copilot) so there are data sources to enrich
  - Allow several minutes after the first sync completes
3. **Labels missing for specific files**
  - Files protected with double-key encryption cannot be inspected and are skipped
  - Very long file URLs (over 255 characters) are not matched
4. **Connection test fails**
  - Ensure the Entra application has the required permissions granted with admin consent
  - Verify Microsoft Purview Information Protection is active in your tenant


## Support

For help with this integration:

- **Email**: support@capsule.security
- **Include**: Your organization ID, Entra tenant ID, and any error messages


## References

- [Microsoft Purview Information Protection](https://learn.microsoft.com/en-us/purview/information-protection)
- [Sensitivity labels overview](https://learn.microsoft.com/en-us/purview/sensitivity-labels)
- [Microsoft Graph - extractSensitivityLabels](https://learn.microsoft.com/en-us/graph/api/driveitem-extractsensitivitylabels)
- [Microsoft Entra ID application permissions](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent)