Skip to main content

Microsoft Purview

The Microsoft Purview integration enhances data governance and compliance management capabilities. This integration empowers JupiterOne users to more efficiently govern their data landscape, manage compliance across various regulations, and mitigate risks through Purview's advanced data discovery and classification tools.

Installation​

info

To use this integration, JupiterOne requires an app registration in Microsoft Entra ID (Azure Active Directory) and the created app's credentials. The app's service principal must then be granted the required roles on your Microsoft Purview root collection.

Prerequisites​

The integration authenticates as a service principal and reads from the Microsoft Purview data plane. Before you begin, assign the following collection roles to the service principal on your Purview root collection (a collection administrator must make these assignments):

  • Data readers — read-only access to data assets, classifications, classification rules, collections, and glossary terms. This covers reading the account, collections, data map assets, and classifications.
  • Data source administrator — manage and monitor data sources and scans. This covers listing data sources and reading their scans.
note

When a Purview account is created, no one but the creator can use its APIs until they are added to one or more of these roles in a collection. For a service-principal-created account, a collection administrator must grant these roles on the root collection.

Create the app registration in Azure​

  1. Sign in to the Azure portal.
  2. Go to App registrations and select New registration. After the app is created, record its Application (client) ID and Directory (tenant) ID.
  3. In the app, go to Certificates & secrets and select New client secret. Record the secret Value; it is shown only once.

Assign the Purview collection roles​

  1. Open your Purview account in the Azure portal and select Open Microsoft Purview governance portal, or go to the Microsoft Purview governance portal.
  2. From the left-side menu, select Data Map, then Collections.
  3. Select the root collection, which is named after your Microsoft Purview account and appears at the top of the list.
  4. Open the Role assignments tab and add the app's service principal to both Data readers and Data source administrator.
note

Only a collection administrator can add role assignments.

Configuration in JupiterOne​

To install this integration, navigate to the Integrations tab in JupiterOne and select Microsoft Purview. Select New Instance to begin configuring the integration.

In the new instance configuration, provide:

  • Account Name used to identify the integration instance in JupiterOne. Ingested entities have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

Creating an instance requires:

  • Purview Account Name — the name of your Microsoft Purview account. This is the account name used to reach the Purview data plane.

  • Tenant ID — the Microsoft Entra ID directory (tenant) ID from your app registration.

  • Client ID — the application (client) ID from your app registration.

  • Client Secret — the client secret value generated under the app registration's Certificates & secrets.

Select Create once all values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.