How to Configure and Use the Microsoft Purview and Spirion Integration

Overview: What does this integration provide?

Spirion Sensitive Data Platform's integration with Microsoft Purview is mutually beneficial to both products by enhancing both the reach and capabilities of each.

Spirion Enhances Microsoft Purview

Spirion provides the following enhancements:

• Significantly more accurate data discovery
• Automated conditional Context Rich label application via Spirion Playbooks
• More coverage across filetypes, non-MS apps, and data repositories
• True endpoint support
• Actional reporting

Spirion Enhances Microsoft Purview

Microsoft Purview provides the following enhancements:

• Label protection with rights managed encryption, watermarking, etc. provides direct action to Spirion Playbook driven decision paths.
• Native Application labeling support in the M365 ecosystem

Prerequisites

Purview Protection Client

• Download and install Purview Protection client anywhere that the Spirion agent is installed.

License

• Microsoft license applied to user: Microsoft 365 E5 (E3 can be used as well; see differences below)

Roles

• Roles assigned to user in this document:
• • Azure Information Protection Administrator
  • Compliance Administrator
  • Compliance Data Administrator

Other

• The following Microsoft applications deployed on the machine that will be scanned:
• • Microsoft Excel
  • OneDrive
  • Outlook
  • PowerPoint
  • Word

Test Purview First!

• Purview configuration should be setup and tested independently of Spirion before using this process. 
• This confirms the labels are working as expected. 

Microsoft 365 – E3 vs. E5 licensing for Purview

File Type Support with Purview Labeling

File Types Fully Supported (Labels + Encryption)

These file types support both labeling and protection, including native encryption like Rights Management:

File Types Partially Supported (Label Only)

These formats can have labels only (no encryption):

File Types Not Supported for Labeling or Protection

These file types cannot have labels or encryption via Microsoft Purview:

• System files: .sys, .bat, .cmd, .vbs, .sh
• Database files (.mdb, .accdb, .sqlite, .db) unless scanned through Purview Data Map
• Executables or scripts with dynamic content
• Files with no persistent storage or metadata capability

How to Configure and Integrate Microsoft Purview

How to Create and Manage Labels in Purview

Procedure:

1. Navigate to the Microsoft Purview admin center.
   
2. Create and define labels:
   
3. Example of creating one label (Top Secret) – example used on all four labels:
   
   
4. • NOTE: Certain files require control access (see “File Type Support with Purview Labeling”)
     
   • NOTE: To use Purview labels with Spirion, you must “assign permissions now” on the screen below.  If “Let Users Decide” is chosen, Purview does not label the file with this process because there would be no way Spirion/Purview would know which permissions to apply. We’ve assigned permissions to one user below. You can choose users/groups in this option.
     
     
4. Use a label policy to publish the four labels created (Public, Restricted, Confidential, Top Secret). See below.
   
   
5. • NOTE: The Microsoft account that is used to create the connection from Spirion to Microsoft tenant and sync the labels (steps 6 and 7 below) needs to be included in this admin unit AND in the Users and Groups published so that they have access to labels to synchronize.
     
     
   • NOTE: These options are optional.  You can choose what you would like on this screenshot.  No default labels are selected.  Spirion removes the default label if we apply a label. 
     
     
     
     
     
     
     
     
5. No Auto-Labeling functionality created:
6. • NOTE: Auto-labeling can interact with Spirion. 
   • •  Scenario:
     • • Purview applies a label automatically based on Purview’s out-of-the-box data types. 
       • Spirion will scan the file with Spirion data types. 
       • If Spirion finds a match in the second step it will apply the Purview label that is setup in the playbook.
       • Purview will eventually review the file and automatically replace the label put on the file in step three and apply the auto-label based on Purview’s out-of-the-box data types. 
       • If you scan with Spirion again:
       • 1. Spirion will scan the file with Spirion data types. 
         2. If Spirion finds a match in the second step it will apply the Purview label that is setup in the playbook.
   • The issue that could happen is that Purview and Spirion could think the data is found is not the same data type therefore the file would be caught in a loop (Purview reviews, Purview labels, Spirion scans, Purview labels with Spirion playbook, etc., etc., etc.)
     

How to Connect the MS Purview Labels to the Spirion Sensitive Data Platform Console

To connect the above created lables to the Spirion Sensitive Data Platform Console use the following steps:

1. Navigate to Application Settings > Scan Settings.
2. Click the blue Manage button under Microsoft Information Protection.
   
   
3. Enter the email of the user that will be used to authenticate Purview labels on the Manage Protection pop-up.
   
   
4. Sign in to Microsoft and consent to the permissions requested.
   
   
5. Copy the entire URL from the webpage that opens up and paste the URL in the box labeled "Authentication Code" on the Manage Protection pop-up box.
   
6. Click Save. If successful, a green box on the bottom left appears, confirming the Authentication.
   

Next Article: How to Set Up Purview Labels in a Playbook and Scan

View the article