Blog Post

Microsoft Security Community Blog
5 MIN READ

Identify organizational use/misuse of sensitive information using Microsoft 365 and Sentinel

Jon_Nordstrom's avatar
Jon_Nordstrom
Icon for Microsoft rankMicrosoft
Apr 11, 2022
We are commonly receiving requests such as, how do I visualize MIP label usage? How can I use MIP label changes to trigger alerts? How do I get more detail on the sensitive information being processe...
Updated Apr 11, 2022
Version 1.0
data loss prevention
microsoft 365
microsoft defender for endpoint
microsoft information protection
microsoft sentinel
security
threat protection
Jon_Nordstrom's avatar
Jon_Nordstrom
Icon for Microsoft rankMicrosoft
May 30, 2022

Dean_Gross , good question. As long as you are licensed for MDA it is really easy to enable without really having to configure MDA. Enable integration and you are good to go, it is the supported way to integrate.

 

If you are not licensed, I did create a function app that brings all the relevant events to Sentinel here O365-ActivityFeed-AzureFunction/Sentinel/mipservice at master · OfficeDev/O365-ActivityFeed-AzureFunction · GitHub. It is based on similar code and steps as this Advanced Incident Management for Office and Endpoint DLP using Azure Sentinel - Microsoft Tech Community.

 

I've avoided to document the availability of the MIP synch function since the MDA function doesn't require the custom components. We will take your feedback into consideration as we are improving the product. 

Thank you