Microsoft Purview Information Protection data connector is enabled on the Microsoft Sentinel workspace
Overview
Section titled “Overview”The Purview Information Protection connector brings sensitivity label events from the Microsoft 365 audit log into Microsoft Sentinel. For AI workloads, this makes it possible to determine whether classified content was involved in a Copilot or agent interaction by correlating label events with session activity. Without this connector, that correlation cannot run.
When the Purview Information Protection connector is not enabled, Sentinel has no record of sensitivity label events and cannot determine whether classified content was involved in a Copilot or agent interaction. Threat actors who direct Copilot toward highly classified documents through a compromised account can exploit this gap because the sensitivity dimension of the session is invisible to the SIEM — only the undifferentiated Copilot activity event reaches Sentinel. Without this connector, the organization cannot distinguish a session that processed public content from one that accessed Highly Confidential material, preventing any triage based on data classification.
Remediation
Section titled “Remediation”Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | AI |
| Category | AI Threat Detection |
| Product | Azure |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| Licence | MIP_S_CLP1, Consumption-based: Microsoft Sentinel |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.