Share via

Authoring and publishing protection policies for Azure sources (preview)

  • Article

Protection access control policies (protection policies) enable organizations to automatically protect sensitive data across data sources. Microsoft Purview already scans data assets and identifies sensitive data elements, and this new feature allows you to automatically restrict access to that data using sensitivity labels from Microsoft Purview Information Protection.

Protection policies ensure that Enterprise Admins must authorize data access for a sensitivity type. After enabling these policies, access control is automatically imposed whenever sensitive information is detected with Microsoft Purview Information Protection.

Actions supported

  • Restrict access on labeled data assets so that only users and groups you select can access them.
  • Action configured on Sensitivity Labels in the Microsoft Purview Information Protection solution.

Sources supported

  • Azure SQL Database
  • Azure Blob Storage*
  • Azure Data Lake Storage Gen2*

Note

*Azure Storage sources are currently in a gated preview. To enroll, follow this link.

Supported regions

Region Azure SQL Azure Storage
South Africa North x
East Asia x
Southeast Asia x
Australia Central x
Australia East x x
Australia Southeast x
Brasil South x
Canada Central x x
Canada East x
China East x
China East 3 x
China North x
China North 2 x
China North 3 x
North Europe x x
West Europe x x
France Central x x
Germany West Central x
Central India x
South India x
Israel Central x
Italy North x
Japan East x
Japan West x
Korea Central x
Norway East x
Poland Central x
Qatar Central x
Sweden Central x
Switzerland North x
UAE North x
UK South x
UK West x
Central US x
East US x x
East US 2 x x
North Central US x
South Central US x x
West Central US x
West US x
West US 2 x
West US 3 x

Prerequisites

  • Microsoft 365 E5 licenses. For information about the specific licenses required, see this information on sensitvity labels. Microsoft 365 E5 trial licenses can be attained for your tenant by navigating here from your environment.

  1. Configure users and permissions.

  2. Enable advanced resource sets in Microsoft Purview:

    1. Have a user who is a data curator or a data reader at the root collection, sign in to the Microsoft Purview portal and open the Settings menu.

    2. Under the Account page, find Advanced Resource Sets and set the toggle to On.

      Screenshot of the account page in the settings, with the Advanced resource sets toggle set to on.

  3. Create or extend sensitivity labels from Microsoft Purview Information Protection to data map assets.

    Note

    Be sure to also publish your labels after creating them.

  4. Register sources - register any of these sources you like:

    1. Azure SQL Database
    2. Azure Blob Storage
    3. Azure Data Lake Storage Gen2

    Note

    To continue, you need to be a data source administrator in the collection where your Azure storage source is registered.

  5. Enable data policy enforcement

    1. Go to the new Microsoft Purview portal.

    2. Select the Data Map tab in the left menu.

    3. Select the Data sources tab in the left menu.

    4. Select the source where you want to enable data policy enforcement.

    5. Set the Data policy enforcement toggle to On, as shown in the image below.

      Set data policy enforcement toggle to **On** within data source details.

  6. Scan sources - register any of the sources you've registered.

    1. Azure SQL Database
    2. Azure Blob Storage
    3. Azure Data Lake Storage Gen2

    Note

    Wait at least 24 hours after scanning.

Users and permissions

There are several types of users you need, and you need to set up the corresponding roles and permissions for these users:

  1. Microsoft Purview Information Protection Admin - Broad rights to manage Information Protection solution: reviewing / creating / updating / deleting protection policies, sensitivity labels and label/auto-labeling policies, all classifier types. They should also have full access to data explorer, activity explorer, Microsoft Purview Information Protection insights, and reports.
    • User needs the roles from within the built-in role group “Information Protection”, along with new roles for data map reader, insights reader, scan reader, source reader. Full permissions would be:
      • Information Protection reader
      • Data Map Reader
      • Insights Reader
      • Source Reader
      • Scan Reader
      • Information Protection admin
      • Information Protection analyst
      • Information protection investigator
      • Data classification list viewer
      • Data classification content viewer
      • Microsoft Purview evaluation administrator
    • Option 1 - Recommended:
      1. Within the Microsoft Purview role groups panel, search for Information Protection.
      2. Select the Information Protection role group, select Copy.
      3. Name it: "Preview - Information Protection", and select Create copy.
      4. Select Preview - Information Protection and select Edit.
      5. On the Roles page, + Choose roles and search for “reader”.
      6. Select these four roles: Data map reader, insights reader, scan reader, source reader.
      7. Add the Microsoft Purview Information Protection admin test user account to this new copied group and complete the wizard.
    • Option 2- uses built-in groups (will provide more permissions than needed)
      1. Place a new Microsoft Purview Information Protection admin test user account within the built-in groups for Information Protection, Data Estate Insights Readers, Data Source Administrators.
  2. Data Owner/Admin - This user will enable your source for data policy enforcement in Microsoft Purview for Azure and Amazon S3 sources.

Create protection policy

Now that you've checked the prerequisites and prepared your Microsoft Purview instance and source for protection policies and waited at least 24 hours after your most recent scan, follow these steps to create your protection policies:

  1. Depending on the portal you're using, navigate to one of the following locations:

  2. Select Protection policies.

    Screenshot of the Information Protection menu, with the Policies dropdown open and Protection policies highlighted.

  3. Select New protection policy.

    Screenshot of the Protection policies page, with the + New protection policy button highlighted.

  4. Provide a name and description and select Next.

  5. Select + Add sensitivity label to add sensitivity label(s) to detect for the policy, and select all the labels you want the policy to apply to.

  6. Select Add then select Next.

  7. Select the sources you want to apply the policy to. You can select multiple, and select the Edit button to manage the scope for each you select.

    Screenshot of the new protection policy menu, showing the edit buttons for each source as they've been selected.

  8. Depending on your source, select the + Include button at the top to add up to 10 resources your scope list. The policy will be applied to all the resources you select.

    Note

    Currently a maximum of 10 resources is supported, and they must be selected under Edit for them to be enabled.

  9. Select Add and then select Done when your list of sources is complete.

  10. Depending on your source, select the type of protection policy you want to create.

  11. Select the users who will NOT be denied access based on the label. Everyone in your org will be denied access to labeled items except for the users and groups you add here.

  12. Select Next.

  13. Choose whether turn on the policy right away or not, and select Next.

  14. Select Submit.

  15. Select Done.

  16. You should now see your new policy in the list of protection policies. Select it to confirm that all the details are correct.

Manage protection policy

To edit or delete an existing protection policy, follow these steps:

  1. Open the Microsoft Purview portal.

  2. Open the Information Protection solution.

  3. Select the Policies drop down, and select Protection policies.

    Screenshot of the Information Protection menu, with Protection policies highlighted.

  4. Select the policy you want to manage.

  5. To change any of the details, select the Edit policy button.

  6. To delete the policy, select the Delete policy button.

    Screenshot of a policy detail page, with the edit and delete buttons highlighted.