Blog Post

Microsoft Security Community Blog
5 MIN READ

Identify organizational use/misuse of sensitive information using Microsoft 365 and Sentinel

Jon_Nordstrom's avatar
Jon_Nordstrom
Icon for Microsoft rankMicrosoft
Apr 11, 2022
We are commonly receiving requests such as, how do I visualize MIP label usage? How can I use MIP label changes to trigger alerts? How do I get more detail on the sensitive information being processe...
Updated Apr 11, 2022
Version 1.0
data loss prevention
microsoft 365
microsoft defender for endpoint
microsoft information protection
microsoft sentinel
security
threat protection
Jon_Nordstrom's avatar
Jon_Nordstrom
Icon for Microsoft rankMicrosoft
Apr 13, 2022

ChristopheHumbert , I will shoot an update once I validate, the "RemoveProtection" event is the event that is pushed if you use SuperUser creds to remove protection. It will show up in the Label Downgraded or Removed.  It seems like those events were formatted a bit differently.