# Microsoft Purview Information Protection data connector is enabled on the Microsoft Sentinel workspace
The Purview Information Protection connector brings sensitivity label events from the Microsoft 365 audit log into Microsoft Sentinel.
Source: https://maester.dev/docs/tests/ZTA.61018
## Overview
The Purview Information Protection connector brings sensitivity label events from the Microsoft 365 audit log into Microsoft Sentinel. For AI workloads, this makes it possible to determine whether classified content was involved in a Copilot or agent interaction by correlating label events with session activity. Without this connector, that correlation cannot run.
When the Purview Information Protection connector is not enabled, Sentinel has no record of sensitivity label events and cannot determine whether classified content was involved in a Copilot or agent interaction. Threat actors who direct Copilot toward highly classified documents through a compromised account can exploit this gap because the sensitivity dimension of the session is invisible to the SIEM — only the undifferentiated Copilot activity event reaches Sentinel. Without this connector, the organization cannot distinguish a session that processed public content from one that accessed Highly Confidential material, preventing any triage based on data classification.
## Remediation
- [Connect Microsoft Purview Information Protection to Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/connect-microsoft-purview)
- [Sensitivity labels overview](https://learn.microsoft.com/purview/sensitivity-labels)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | AI |
| Category | AI Threat Detection |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| Licence | MIP_S_CLP1, Consumption-based: Microsoft Sentinel |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.