# Microsoft 365 DLP Integration and Monitoring
#### **Summary of Actions Required:**
Register an app in Microsoft Entra ID and configure API permissions for Microsoft Graph and Office 365 Management APIs. Grant admin consent and collect credentials (Application ID, Tenant ID, Client Secret). Ensure Unified Audit Logging is enabled in Microsoft 365.
**Pre-requisites:**
- **Global Admin** access
- **Microsoft 365 E5** or Compliance add-on licenses
- **Required roles**: Compliance Administrator, Security Reader, Global Reader, or a custom role with DLP alert access
**DLP Alerts:**
- Go to Microsoft Purview Portal > Data Loss Prevention > Alerts
- Ensure DLP policies are set to generate alerts
---
##### **Important Note on Microsoft 365 Alert API Limitations**
There is an **inherent limitation in the Microsoft 365 Security Alert APIs** that impacts the level of detail you receive in alert data—this is critical when planning your integration and choosing the appropriate license tier.
- **v1.0 Alerts API** (available under Microsoft 365 E3 and E5):
- Provides only **basic alert information**, such as:
- Alert title, category, severity, and timestamps
- Limited context about the affected user or object
- Designed primarily for **initial alerting and manual investigation**
- **v2.0 Alerts API** *(currently in beta, available with Microsoft 365 E5 or Defender Plan 2)*:
- Delivers **richer alert context**, including:
- Detailed user activities leading up to the alert
- Supporting evidence (emails, files, device info)
- Remediation guidance and recommendations
- Useful for **automated triage**, faster incident response, and deeper analysis
- If you’re using **Microsoft 365 E3**, only **v1.0 is supported**, limiting you to high-level alert insights.
- For access to **v2.0’s extended context**, an **E5 license or add-on** is required.
**Consider this carefully when designing your alert ingestion pipeline or evaluating Microsoft 365 licensing options.**
---
##### **Step 1: Microsoft Entra ID - App Registration**
**Register Your Application in Microsoft Entra ID:**
- - Log in to your Azure Account, click here - **[Azure Portal Link](https://portal.azure.com/#home)**.
- Navigate to Azure Active Directory > **App registrations**.
- Click **New Registration**.
- Provide a Name for the application, we can suggest "**CyTechAQUILA-Monitoring**".
- Click **Register**.
- - Navigate to **App registrations** in the Azure Portal.
- Select the App you just created, then go to **API Permissions**.
- Search for **Microsoft Graph.**
- Click **Add a permission**.
- Select **Microsoft Graph** **>** **Application**** permissions**.
- Search for and add
- **AuditLog.Read.All**
- **Files.Read.All**
- **InformationProtectionConfig.Read.All**
- **InformationProtectionPolicy.Read.All**
- **Policy.Read.All**
- **SecurityAlert.Read.All**
- **SecurityEvents.Read.All**
- **SecurityEvents.ReadWrite.All**
- **SecurityIncident.Read.All**
- **SensitivityLabels.Read.All**
- **Sites.Read.All**
- **User.Read.All**
- - Search for **Office 365 Management APIs** and add the required permissions.
- In **Application Permissions**, look for permissions.
- To read DLP policy events under ActivityFeed select:
- **ActivityFeed.Read**
- **ActivityFeed.ReadDlp**
- **ServiceHealth.Read**
- - In API Permissions, click **Grant admin consent** for <tenant name>.
- **Confirm** the action.
- - Go to **App registrations** > **Select your application**.
- Copy the **Application (client) ID** from the overview page.
- - In the Azure Portal, navigate to **Azure Active Directory** > **Overview**.
- Copy the **Directory (tenant) ID**.
- - In **App registrations > Select your application**, go to **Certificates & secrets**.
- Click **New client secret**.
- Add a description and expiration period, then click Add.
- Copy the **Value** **(displayed only once)**.
1. Sign in to Microsoft 365:
- Go to **[https://admin.microsoft.com](https://admin.microsoft.com/)** and sign in with your Global Admin credentials.
2. Access the Security & Compliance Center:
- In the left-hand menu, under Admin centers, click on Security (or go directly to **[https://security.microsoft.com](https://security.microsoft.com/)**).
3. Navigate to Audit Log Search:
- In the Security & Compliance Center, go to Search in the left-hand menu and click on **Audit log search**.
4. Check Audit Log Status:
- If you see an option to **search the audit log**, then audit logging is already enabled(*refer to the image below*).
- If you see a banner that says "**Start recording user and admin activity**" or a prompt to enable auditing, it means that audit logging is not yet enabled.
5. Enable Audit Logging:
- If audit logging is not enabled, you can **click on the prompt to enable it**. This will enable auditing for all activities within your Microsoft 365 environment. The process may take a few hours to be fully operational.
| Scenario | Example Policy Configuration |
|---|
| Prevent employees from emailing credit card numbers | Condition: Credit Card Info
Action: Block email
Notify sender and admin |
| Warn users about sharing internal-only content to external domains | Condition: Sensitivity label = Internal
Action: Show policy tip
Allow override |
| Restrict uploading HR documents to personal OneDrive | Condition: HR keyword or file name
Location: Devices
Action: Block upload to personal apps |