Microsoft 365 Audit.DLP

1. Register an Entra ID Application

⚠️ If you already have an app from the Audit.General connector, you can **reuse the same app**. Otherwise: 1. Go to **Microsoft Entra ID** > **App registrations** > **New registration** 2. Name: `Sentinel-M365Audit` (or your preferred name) 3. **Supported account types**: Accounts in this organizational directory only 4. Click **Register** 5. Note the **Application (client) ID** - you'll need this later 6. Go to **Certificates & secrets** > **New client secret** 7. Add a description, set expiration, click **Add** 8. **Copy the secret Value immediately** - it won't be shown again

2. Configure API Permissions

⚠️ Audit.DLP requires **ActivityFeed.ReadDlp** permission (different from Audit.General which needs ActivityFeed.Read). 1. In your app registration, go to **API permissions** > **Add a permission** 2. Select **Office 365 Management APIs** 3. Choose **Application permissions** 4. Select **ActivityFeed.ReadDlp** 5. Click **Add permissions** 6. Click **Grant admin consent** for your tenant 7. Verify the permission shows as **Granted** Note: If sharing the same app with Audit.General connector, add both ActivityFeed.Read and ActivityFeed.ReadDlp permissions.

3. Subscribe to DLP.All Content

[concat('Run this PowerShell script to subscribe to the DLP.All content type (required before data flows): ```powershell # Replace with your values $tenantId = ''YOUR_TENANT_ID'' $clientId = ''YOUR_CLIENT_ID'' $clientSecret = ''YOUR_CLIENT_SECRET'' $publisherId = $tenantId # Publisher identifier is your tenant ID # Get OAuth token $body = @{ grant_type = ''client_credentials'' client_id = $clientId client_secret = $clientSecret resource = ''https://manage.office.com'' } $tokenResponse = Invoke-RestMethod -Method Post -Uri "', environment().authentication.loginEndpoint, '$tenantId/oauth2/token" -Body $body $token = $tokenResponse.access_token # Start subscription $headers = @{Authorization = "Bearer $token"} $subscribeUri = "https://manage.office.com/api/v1.0/$tenantId/activity/feed/subscriptions/start?contentType=DLP.All&PublisherIdentifier=$publisherId" Invoke-RestMethod -Method Post -Uri $subscribeUri -Headers $headers ```')]

4. Connect the Data Connector

Provide your Entra ID application credentials below. You can use the **same app credentials** as the Audit.General connector. The connector will automatically use your subscription's tenant ID for authentication and API calls.