API Permissions (UnifiedPolicy.Tenant.Read)

Hi thatsecurityguy,

The API permission for the Microsoft Information Protection SDK that you need to read unified labeling policies for the tenant is UnifiedPolicy.Tenant.Read.

This permission is listed in the Microsoft Entra app permissions blade under the MIP Sync Service. However, it is not currently available in the Azure AD admin portal.

Required API permissions - Microsoft Information Protection SDK | Microsoft Learn

To grant this permission to your app registration, you can use the Azure AD Graph API.
You can use this PowerShell Script as a strating point (example):

# Set the variables
$appId = "<your-app-registration-id>"
$tenantId = "<your-tenant-id>"
$accessToken = "<your-graph-api-access-token>"

# Create the JSON body for the request
$body = @{
    "id" = "$appId"
    "addPermissions" = @{
        "value" = @{
            "apiId" = "27453c88-c861-411c-8041-00f0a2486951"
            "type" = "Application"
            "value" = "UnifiedPolicy.Tenant.Read"
        }
    }
}

# Make the request to the Graph API
$response = Invoke-WebRequest -Uri "https://graph.windows.net/$tenantId/applications/$appId" -Method Patch -Headers @{Authorization = "Bearer $accessToken"} -Body $body

# Check the response status code
if ($response.StatusCode -eq 200) {
    Write-Host "The UnifiedPolicy.Tenant.Read permission was successfully granted to your app registration."
} else {
    Write-Host "An error occurred while granting the UnifiedPolicy.Tenant.Read permission to your app registration." -ForegroundColor Red
}

Once you have granted the UnifiedPolicy.Tenant.Read permission to your app registration, you will be able to use it to read all of the unified labeling policies in your tenant.