Configuring Microsoft Information Protection

You can configure the Microsoft Information Protection Properties page to decrypt and analyze Microsoft Office files encrypted by Microsoft Information Protection (MIP).

Microsoft Information Protection (MIP) can be used to protect files created using Office 2007 or later. You can configure to import MIP labels for detection (for more information about creating file labeling classifiers for detection, see File Labeling section), and for labeling (for more information about configuring labels in an action plan, see Forcepoint Data Discovery options section).

Forcepoint DLP can perform the following:
  • Decrypt and analyze content that was encrypted using MIP.
  • Detect and label content that was using MIP labels.
To configure the Microsoft Information Protection Properties page, do the following:

Steps

  1. Log into the Microsoft 365 Admin Consent page and authenticate using your Microsoft 365 admin credentials and accept the permission requests for the Forcepoint DLP enterprise application.

    The Forcepoint DLP application gets created.

    If you use the System admin credentials credential type, the application works as expected and labels are imported successfully. For the Application user credentials credential type, you must register the application inorder to create the client secret which is required to import labels.

  2. To register your system as an application in the Microsoft Entra admin center, in Azure Portal, go to Entra ID > App Registrations > New App (or existing Forcepoint DLP app) and grant the following API permissions:

  3. To add a secret key for login with the application and import labels, you must set up the Azure standard configuration in Client secrets in Microsoft Azure > Home > Forcepoint DLP > Manage > Certificates & secrets.

  4. Once the MIP application is configured, you can open the Microsoft Information Protection Properties page in FSM by navigating to Settings > General > Services > Decryption and File Labeling, and click the Microsoft Information Protection link.
    In the Microsoft Information Protection Properties page, configure the following:
    • Microsoft admin credentials
    • MIP decryption
    • Import Labels
    • File Labeling