Clariti Docs
Credentials5 minutes· easy

Microsoft Purview

Data Protection

The Microsoft Purview adapter pulls sensitivity labels and Data Loss Prevention (DLP) alerts into Clariti for visibility into your data classification and protection posture.

What Clariti Collects

What You'll Need

  • Global Administrator or Application Administrator role in Microsoft Entra ID
  • A Microsoft 365 E5, E5 Compliance, or Information Protection license
  • ~5 minutes to complete setup
  • Your Clariti account with adapter management permissions

Get Your Credentials

If you have already set up the Microsoft Entra ID adapter, you can reuse the same app registration — just add the additional API permissions listed below and re-grant admin consent. See the Microsoft Entra ID guide for the full app registration walkthrough.

In the Azure portal, go to App registrations and select your Clariti app. Under API permissions > Add a permission > Microsoft Graph, add these Application permissions:

  • InformationProtectionPolicy.Read.All
  • SecurityAlert.Read.All — required for Data Loss Prevention alerts. If you connected Purview before this permission was introduced, add it now and re-grant admin consent, or the DLP alert pull will 403 until you do (sensitivity-label data keeps syncing normally either way).

Click Grant admin consent for your tenant. Copy the Application (client) ID, Directory (tenant) ID, and a valid Client secret value.

Enter Credentials in Clariti

Value from vendor consolePaste into Clariti field
Directory (tenant) IDTenant / Directory ID
Application (client) IDClient ID
Client secret valueClient Secret

Verify Connection

Click Test Connection in Clariti. A successful connection returns a green checkmark. The first data sync typically completes within a few minutes.

Troubleshooting

  • 401 Unauthorized — The client secret may have expired. Generate a new secret in Azure and update it in Clariti.
  • 403 Forbidden — Verify admin consent was granted for InformationProtectionPolicy.Read.All and SecurityAlert.Read.All. These permissions require an E5 or Information Protection license. Missing only SecurityAlert.Read.All degrades gracefully — sensitivity-label findings keep syncing, DLP alerts are simply skipped until you re-consent.
  • Timeout — Purview policy data is lightweight. Timeouts are rare; Clariti retries automatically.