How To Integrate Data Classification with MIP

PRO This feature is only available in Enterprise Recon Cloud PRO Edition. To find out more about upgrading your ER Cloud license, please contact Ground Labs Licensing. See Subscription License for more information.

This section covers the following:

• Overview
• How Data Classification with MIP Works
• Requirements
• Install the MIP Runtime Package
• Configure Data Classification with MIP
  • Generate a Client ID
  • Generate a Client Secret Key
  • Set Up MIP Credentials
  • Update MIP Credentials
• Disable Data Classification with MIP
• View Classification Status
• Apply Classification
• Remove Classification

Overview

Enterprise Recon Cloud seamlessly integrates with Microsoft Information Protection (MIP), enabling you to leverage the sensitive data discovery capabilities in ER Cloud to better classify, label, and protect sensitive data across your organization.

Once MIP integration is configured, you can view the sensitivity labels for match locations in the Investigate page. The filtering feature lets you easily select match locations with specific classification labels, and take the appropriate remediation or access control action to secure the data.

Sensitivity labels defined by your organization can be applied to supported match locations from the Enterprise Recon Cloud web interface and API. This metadata can be propagated to external services, such as data loss prevention (DLP) solutions, to implement additional controls to complete your organization's information protection strategy.

To integrate MIP Classification in ER Cloud, you must:

1. Have a valid Office 365 subscription (for more information, refer to Microsoft Information Protection (MIP) SDK setup and configuration).
2. Generate a Client ID.
3. Generate a Client Secret Key.
4. Set Up MIP Credentials.

How Data Classification with MIP Works

For the more detailed explanation on how this feature works, refer to the Analysis - How Data Classification with MIP Works section.

Requirements

Supported File Types

Enterprise Recon Cloud MIP integration supports the following file types:

For more information, refer to Microsoft 365 - Learn about sensitivity labels.

Install the MIP Runtime Package

1. Log in to the ER Cloud Web Console.
2. Go to Settings > Agents > Node Agent Downloads.
3. On the Node Agent Downloads page, download the appropriate Windows MIP runtime package (e.g. er2_2.x.x-windows-xxx_mip-runtime.msi). Select a MIP runtime package installer with the same computing architecture (64-/32-bit) as the installed Windows Agent.
4. (Optional) Verify the checksum of the downloaded Node Agent package file. Refer to Verify Checksum for Node Agent Package File in the Install Windows Agent section.
5. Run the downloaded installer on the same host as the installed Windows Agent and click Next >.
6. In the Choose Setup Type dialog, select Install.
7. In the Ready to Install dialog, select Install.
8. Click Finish to complete the installation.

Configure Data Classification with MIP

Generate a Client ID

1. With your administrator account, log in to the Azure app registration portal.
2. In the App registrations page, click on + New registration.

3. In the Register an application page, fill in the following fields:

   Field	Description
   Name	Enter a descriptive display name for ER Cloud. For example, Enterprise Recon.
   Supported account types	Select Accounts in this organizational directory only.

4. Click Register. A dialog box appears, displaying the overview for the newly registered app, "Enterprise Recon".
5. Take down the values for the Application (client) ID. This will be required to set up MIP credentials.
6. In the Manage panel, click API permissions.
7. In the Configured permissions section, click + Add a permission.

8. In the Request API permissions page, search and select the following permissions for the "Enterprise Recon: app:

   API Permission	Notes
   Microsoft APIs > Azure Rights Management Services > Delegated Permissions	Check the user_impersonation permission.
   APIs my organization uses > Microsoft Information Protection Sync Service > Delegated Permissions	Check the UnifiedPolicy.User.Read permission.

9. Click Add permissions.
10. In the Configured permissions page, click on Grant admin consent for <organization name>.
11. In the Permissions requested Accept for your organization window, click Accept. The Status column for all the newly added API permissions will be updated to "Granted for <organization name>".

Generate a Client Secret Key

1. With your administrator account, log in to the Azure app registration portal.
2. In the App registrations page, go to the Owner applications tab. Click on the app that you registered when generating a Client ID. For example, "Enterprise Recon".
3. In the Manage panel, click Certificates & secrets.
4. In the Client secrets section, click + New client secret.

5. In the Add a client secret page, fill in the following fields:

   Field	Description
   Description	Enter a descriptive label for the Client Secret key.
   Expires	Select a validity period for the Client Secret key.

6. Click Add. The Value column will contain the Client Secret key.
   

7. Copy and save the Client Secret key to a secure location. This will be required when you set up MIP credentials.

   Save your Client Secret key in a secure location. You cannot access this Client Secret key once you navigate away from the page.

Set Up MIP Credentials

Users with Global Admin and Classification Admin global permissions can set up the MIP credentials in the Settings > Analysis > Classification page.

To set up MIP credentials:

1. Log in to the ER Cloud Web Console.

2. Go to Settings > Analysis > Classification.

3. Set the toggle button to On.

4. In the Microsoft Information Protection (MIP) section, fill in the following fields:

   Field	Description
   Login ID	Enter the Microsoft 365 user account that will be used for classification. For example, enterprise-recon-user@example.onmicrosoft.com. Sensitivity labels that can be retrieved by ER Cloud depends on the labels that are available in label policies published to the specified user. The Data Classification with MIP feature in ER Cloud does not support user accounts with two-factor authentication (2FA) enabled. You are recommended to use a Microsoft service account that does not require 2FA to be enabled when setting up the MIP credentials.
   App ID	Enter the Application (client) ID value obtained when generating a Client ID. For example, myAppId-example-enterpriserecon-1234.
   App Secret	Enter the Client Secret key value obtained when generating a Client Secret Key. For example, myAppSecretKey-enterpriserecon-123.
   Password	Enter the password of the user specified in the Login ID field.
   Agent	Select a Windows Agent with direct internet access. The selected Windows Agent will be used to retrieve classification labels that are published to the user specified in the Login ID field.

5. Click Retrieve to verify the MIP credentials and retrieve the sensitivity labels published to the user specified in the Login ID field. MIP credentials are saved (and overwritten) upon successful authentication.

   The Retrieve button will only be enabled when there is at least one suitable Windows Agent that is available and connected to the Master Server.

Update MIP Credentials

Users with Global Admin and Classification Admin global permissions can modify the MIP credentials configured in ER Cloud.

To modify the MIP credentials:

1. Log in to the ER Cloud Web Console.

2. Go to Settings > Analysis > Classification.

3. In the Microsoft Information Protection (MIP) section, edit the following fields:

   Field	Description
   Login ID	Enter the Microsoft 365 user account that will be used for classification. For example, enterprise-recon-user@example.onmicrosoft.com. Sensitivity labels that can be retrieved by ER Cloud depends on the labels that are available in label policies published to the specified user. The Data Classification with MIP feature in ER Cloud does not support user accounts with two-factor authentication (2FA) enabled. You are recommended to use a Microsoft service account that does not require 2FA to be enabled when setting up the MIP credentials.
   App ID	Enter the Application (client) ID value obtained when generating a Client ID. For example, myAppId-example-enterpriserecon-1234.
   App Secret	Enter the Client Secret key value obtained when generating a Client Secret Key. For example, myAppSecretKey-enterpriserecon-123.
   Password	Enter the password of the user specified in the Login ID field.
   Agent	Select a Windows Agent with direct internet access. The selected Windows Agent will be used to retrieve classification labels that are published to the user specified in the Login ID field.

4. Click Retrieve to verify the updated MIP credentials and retrieve the sensitivity labels published to the user specified in the Login ID field. MIP credentials are saved (and overwritten) upon successful authentication.

   The Retrieve button will only be enabled when there is at least one suitable Windows Agent that is available and connected to the Master Server.

Disable Data Classification with MIP

To disable Data Classification integration with MIP:

1. Go to Settings > Analysis > Classification.
2. Set the toggle button to Off.

View Classification Status

Navigate to the Investigate page to view the results grid (refer to the View Investigate Page section).

In the Investigate page results grid, the MIP Classification status for a supported match location is reflected in the following columns:

Apply Classification

You can manually apply the sensitivity classification of a supported match location in ER Cloud. To manually apply or modify the MIP sensitivity label associated with a match location:

1. Go to the Investigate page.

2. Select the match location(s) that you want to apply or modify the MIP classification labels for.

   A file that is applied with a classification label with protection settings (encryption) can only be decrypted by users that are authorized by the label's encryption settings.
3. Click the Classify button to bring up the Classify locations with a Sensitivity Label (MIP) dialog box.
4. Select a sensitivity label from the dropdown menu to be applied to or modified for the match location(s).
5. Enter a name in the Please sign-off to confirm label modification field.
6. Enter a reason in the Reason field.
7. Click Ok to classify the match location(s) with the selected MIP sensitivity label. Otherwise click Cancel to cancel the data classification operation.

Remove Classification

You can manually remove the sensitivity classification of a supported match location in ER Cloud. To manually remove the MIP sensitivity label associated with a match location:

1. Go to the Investigate page.
2. Select the match location(s) that you want to apply or modify the MIP classification labels for.
3. Click the Classify button to bring up the Classify locations with a Sensitivity Label (MIP) dialog box.
4. Select Remove sensitivity label from the dropdown menu.
5. Enter a name in the Please sign-off to confirm label modification field.
6. Enter a reason in the Reason field.
7. Click Ok to remove the classification for the match location(s). Otherwise click Cancel to cancel the data classification operation.