Microsoft Purview DLP
Sync Microsoft Purview Data Loss Prevention (DLP) alerts into RAD Security via Microsoft Graph.
This guide walks you through registering an Azure AD application, granting it the Microsoft Graph permissions required to read Microsoft Purview Data Loss Prevention (DLP) alerts, and configuring the integration in RAD Security.
Once connected, RAD Security ingests DLP alerts from Microsoft Purview as security findings so you can correlate them with container, cloud, and identity activity in a single workspace.
Prerequisites
Before you begin, ensure you have:
- Global Administrator (or Application Administrator + Privileged Role Administrator) permissions in Microsoft Entra ID (Azure AD)
- A licensed Microsoft Purview tenant with DLP policies that generate alerts
- Access to a RAD Security workspace with integration permissions
This integration only reads DLP alerts via the Microsoft Graph Security API. It does not modify policies, dismiss alerts, or write data back to Microsoft Purview.
Step 1: Register an Azure AD Application
Open the Microsoft Entra Admin Center
Sign in to the Microsoft Entra admin center with an account that has permission to register applications.
Create a New Application Registration
- Navigate to Identity → Applications → App registrations
- Click + New registration
- Enter a name (e.g.
RAD Security - Purview DLP) - Under Supported account types, select Accounts in this organizational directory only (single tenant)
- Leave the Redirect URI empty — this integration uses the client credentials flow
- Click Register
Record the Tenant and Client IDs
From the application's Overview page, copy:
- Directory (tenant) ID
- Application (client) ID
You will need both values when configuring the integration in RAD Security.
Step 2: Grant Microsoft Graph Permissions
Add Application Permissions
- From your app's left menu, select API permissions
- Click + Add a permission → Microsoft Graph → Application permissions
- Search for and select the following permission:
SecurityAlert.Read.All
- Click Add permissions
Grant Admin Consent
- Back on the API permissions page, click Grant admin consent for <tenant>
- Confirm the consent prompt
- Verify that the Status column shows a green check mark next to
SecurityAlert.Read.All
Admin consent is required for application permissions. Without it the integration will fail with a 403 Forbidden error when querying alerts.
Step 3: Create a Client Secret
Open Certificates & Secrets
From your app's left menu, select Certificates & secrets.
Create a New Client Secret
- Click + New client secret
- Enter a description (e.g.
RAD Security integration) - Choose an expiration period that aligns with your secret rotation policy
- Click Add
Copy the Secret Value
Immediately copy the Value column of the new secret.
Azure displays the secret value only once. If you navigate away you will need to create a new secret. Store it in a password manager or secrets vault.
Step 4: Configure in RAD Security
In your RAD Security workspace, add a new Microsoft Purview DLP integration with the values gathered above:
| Parameter | Description | Example |
|---|---|---|
| Tenant ID | Azure Directory (tenant) ID from Step 1 | 11111111-2222-3333-4444-555555555555 |
| Client ID | Azure Application (client) ID from Step 1 | aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee |
| Client Secret | Secret value from Step 3 | Xx7~abcDEF... |
Click Verify to test the credentials, then Save to enable the integration.
Verify Integration
After saving, RAD Security will start syncing DLP alerts on its scheduled cadence.
- Navigate to Data Sources → Integrations in RAD Security
- Locate your Microsoft Purview DLP integration
- Confirm the status shows as Connected and a recent Last sync timestamp
- Open Security Findings and filter by source to see the ingested DLP alerts
Your Microsoft Purview DLP integration is now active. RAD Security will continue to pull new DLP alerts on a regular sync interval.
What Data is Synced
Troubleshooting
Security Best Practices
Use a Dedicated App Registration Create an app registration that is used only by RAD Security so its permissions and audit history stay isolated.
Least Privilege
Grant only SecurityAlert.Read.All. Avoid adding broader Graph or directory permissions.
Rotate Client Secrets Set a short expiration on the Client Secret and rotate it on a schedule that matches your security policy.
Monitor Sign-In Logs Review Microsoft Entra sign-in logs for the service principal to detect unexpected use of the credentials.