Microsoft 365 Community Microsoft Graph, 15 Feb 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Introduction to Microsoft Information Protection Policy APIs

Description

In this 15-minute developer focused demo - Tom Moser clearly articulates how MIP capabilities help organizations to classify, label, manage and protect data based on sensitivity. Learn about the MIP SDK (File, Policy and Protection SDKs). Microsoft Graph exposes MIP Policy APIs - policy-specific functionality and resolves state to Actions (add a header/footer, add metadata…). Graph (Beta) endpoint Policy APIs reviewed - Get Labels, Evaluate (add/remove labels), Extract Label (metadata), are moving to Graph this week. This PnP Community demo is taken from the weekly Microsoft 365 Platform Community call recorded on February 15, 2022.

Demo Presenter: Tom Moser (Microsoft)

Supporting materials:
• Article - Microsoft Information Protection SDK: Now Generally Available! | aka.ms/mipsdk
• SDK - Microsoft Information Protection Software Development Kit Version 1.11 | aka.ms/mipsdkbins
• Documentation - Microsoft Information Protection SDK documentation | aka.ms/MIPSDKDocs
• Code Samples - mip sdk | aka.ms/MIPSDKSamples
• Documentation - Information Protection overview | https://docs.microsoft.com/graph/information-protection-overview
• Tool - Microsoft.InformationProtection.Protection | https://www.nuget.org/packages/Microsoft.InformationProtection.Protection
• Documentation - Learn about sensitivity labels | https://docs.microsoft.com/microsoft-365/compliance/sensitivity-labels

Learn more:
• Learn more about the Microsoft 365 Patterns and Practices community at: http://aka.ms/m365pnp
• Visit the Microsoft 365 Patterns and Practices community YouTube channel: https://aka.ms/m365pnp/videos

A

So my name is tom moser, I'm a senior program manager on the cloud data security team form, really the azure information protection team and I'm going to talk to y'all today about some apis that we shipped and graphed quite a while ago, they're still in beta everything I'll talk about today is changing like this week, but functionally uh everything remains about the same.

A

We just moved to a different endpoint and uh changed some of the classes a little bit so I'll walk you through what exactly microsoft information protection is does today and then we'll get into some quick demos on the graph apis.

A

So you may have heard of microsoft. Information protection, it's a not a product, it's not something! We sell it's a set of capabilities that centers really around our ability to classify and protect data, whether that data is an office document, whether it's a team, a sharepoint site. We can apply sensitivity, labels that information and the sensitivity labels drive the protection story downstream. So I can prevent guests from accessing the site.

A

I can encrypt the content, so it's only consumable by users in my organization and various other protections that we can apply based on the sensitivity label, and the idea is that users can apply that label based on their knowledge of the information which will then hopefully secure it.

A

So the sensitivity labels themselves are configured as part of compliance center. You may have seen this taxonomy where we started public and things go all the way highly confidential, completely customizable, based on your organizational needs, so I'll show you an example of what the microsoft taxonomy looks like here. In a minute you can have top secrets whatever you want to call them, and the idea is that by users or automations applying what they know about the content to some piece of information.

A

We can help to better restrict access that information and protect our organizations from data leakage. So a few examples of integrations that we have today in just microsoft, products uh with the sensitivity labeling. You may have seen this in teams where I can create a team, and I can set the sensitivity and and setting that sensitivity like in the slide here. We've set it to confidential, restricts the audience for that. So by setting that to confidential, I can make this team, so it's only available for my organization. It can't have guests or be public power.

A

Bi has also shipped support for labeling, wherein that I can apply labels to power, bi artifacts to power, bi desktop uh reports and things, and then that again drives the protection story, um so it'll encrypt that pbix file, preventing me from sharing it outside of my organization and then finally, on the right side, you can see the office example. So this is the sensitivity label interface inside of of office.

A

This is, I think, actually, the azure information protection, one where we've defined our classification taxonomy all the way from non-business to highly confidential and then under confidential and highly confidential. We have a set of sub-labels that all apply a different behavior and those behaviors can be things like applying metadata to the content so that we know the label exists, applying protection settings to the content.

A

So, in the case of confidential microsoft fte, we would restrict that for only microsoft, full-time employees extended would expand to our vendors and other partners, and you can use that to scope, scope down the audience on documents or emails. As far as who can access that information.

A

Additionally, we can apply things like content marking, so header, footer and watermark, so that we can visually see that this information is protected, and then we support a bunch of other non-office related things that are more for power, bi teams and other workloads um question about licensing. This is uh available in e3. So as long as you have m365e3, you can access all of this. Now the the features may vary. You don't get some of the auto classification capabilities, but the labeling itself is available for e3 so today, to enable this. This is my responsibility.

A

What I work on today is the microsoft information protection developer platform, which includes really two main parts.

A

Today, uh one is the mip sdk which has been available for about four years and then the others are graph interface, so I'll cover the sdk only because it really sets us up for talking about the graph api and then we'll talk about exactly what the graph api offers so map sdk enables my apps and services to take all the labeling stuff that I just showed you and build it into my line of business apps into uh third-party apps show you some partners in the next slide.

A

It's written in c plus cross platform, so it works across mac windows, linux, uh ios and android, and we have dot net flavors available for ubuntu and windows and we're working on a java wrapper. That's in preview. Now, eventually, the java wrapper will work across all of our supported platforms. We don't expect that to be generally available until later this year and again, this allows you to extend the classification, labeling and protection capabilities into your own apps and services and line of business apps.

A

This is used across a whole bunch of our partners and vendors. Internal workloads include teams, sharepoint onedrive office apps. We have some internal workloads, there's first party only that are starting to take this up and then we've got a whole bunch of third-party partners that are integrating this as well and then finally talk about this more in a minute. We have the graph interfaces that expose some of our policy interface, so the mip sdk itself is really three different sdks. We have our starting at the bottom right, the protection sdk, which is purely about encryption.

A

It allows me to encrypt and decrypt buffers or streams of bytes and to expose some information about the rights management. So inside of office we can restrict things like copy and print or across any app that consumes the sdk and the protection. Sdk is responsible for surfacing the crypto operations and the rights management component, and then it's up to my app to enforce that to the left of that we have the policy sdk, which is useful for client applications.

A

So, a couple of slides ago, where I showed you, those those admin, interfaces or user interfaces where I can configure the label- that's driven by our policy sdk, which is what we'll talk about in graph today and then, finally, is our file sdk. So this is used by partners like veritas, digital guardian, forcepoint, varonis, to reason over files directly. I don't have to know anything about how to encrypt a file. I don't have to parse out streams from a word doc or anything.

A

I point the api to a file.

A

I point the api to a label id and it takes care of the rest for me, also used inside of line of business applications and customer environments to encrypt things like pdf files or office docs at creation, instead of relying on the user to do something so we'll get to the policy sdk, because that's what the graph interface is covering today, the policy sdk and our graph apis, I like to say, don't actually do anything they're not going to label any content for you, they're not going to take any actions on something that you own.

A

It's more of a state machine that returns some information about policy that your application then has to apply. So what we'll do is allow you to pass in a state. You can say the document has this label on it or has no label on it, and I want to apply this label to the content and what our api will return is a set of actions and those actions need to be taken by your application in order to appropriately label the content based on the mip defined labeling patterns.

A

So the input's always going to be this. What we call an execution, state or content state and the output will always be a list of actions for our evaluate apis and I'll. Show you some examples here momentarily.

A

This also covers our auditing. So if you've seen the auditing story inside of the compliance portal in m365, the policy sdk is responsible for those events landing inside of the audit experience.

A

This api is exposed via both graph and map sdk. So you could go to nuget, download our net package and run this in like a local, app or an app hosted in azure, or you can just hit our graph endpoint directly, so I'll switch over to demos. Now my demos are all in postman today we're in the middle of changing these apis based on feedback from customers and trying to consolidate, and so today what you'll see is I've got a bunch of different uh apis over here and calls that I can make get labels.

A

These evaluate calls and then extract label are the ones that we'll look at today, because those are the primary ones. The rest of these are mostly for testing.

A

So today this is hitting the graph beta endpoint we're not available at the v1 endpoint, yet we're shipping some updates again to graph where we're going to migrate this so rather than this endpoint being under information protection policy. You'll see this, hopefully by the end of the week under security, slash information, protection, sensitivity, labels and we're doing some work internally to consolidate across security and compliance and get all of our apis in one one place.

A

So this is our get labels api, a user, could call this or an application could call this. uh If I'm a user- and I call this api- I will get back the labels that are specific to me. If I'm a service- and I call this- I can either make a delegated call. Where I say give me the labels for a user, or I can call and get all the labels for the tenant, so that might be used by, for example, networks shift and integration with their next generation firewall.

A

They would want to do that as an admin, so they have a full purview into all the labels that are in the tenant, so they can block things leaving the network and if I run this and if everything goes well, I'll get reply back and you'll see a whole bunch of labels in here. So these these label names aren't great they're for testing, but what I get back is a collection of these information protection policy labels that contains really the the assets that I need to render this inside of an application.

A

So I'm not going to get any details on policy. This doesn't tell me what to do when I apply that label. It just says: here's the label name: here's the color. If it's set here's the sensitivity value, so I know how to order this in my list: here's, whether it's active or not, and then I could use that to render the experience inside my application, so whether that's a web app, whether it's a mobile client.

A

This is how I can fetch the labels. So then the next call a user might make is I've. uh My application has rendered these labels, and now I want to call the api and say: hey, tell me what to do. I've got this content state and now I want to apply a label. So in this case, what we've got is this content info object that we pass in we're going to set some information about the current state, so we pass in some key value pairs.

A

That say this is the label that exists on the document today and if we scroll down and then we'll say- and this is the label id that I want to apply now so tell me what to do and when I run this I'll get a response. That tells me exactly what I have to do. So this contains a bunch of what we call information, protection actions and, in this case, add content, footer action. So specifically, this api is going to say I need to add a content footer.

A

I need to add a content header with this text and this font. So it's completely configurable by the by the admin. I need to apply this metadata to the content, so this is what tells us that the information is labeled. So if I apply this to a word doc or to a pdf downstream applications using mip sdk will be able to consume that label and understand how to treat that information.

A

um Sorry, this is the remove. The add is here so this is where we'll actually add the the metadata.

A

If I had protection actions, those would surface here as well, so it would say, apply this template id or allow the user to define the protection. Then the user would have some user interface to set that oh, we have an api for removal.

A

So if you have a piece of information so similar to apply applicator evaluate application, I'm going to pass in some content state that says: here's what I have on the document tell me how to remove this label and then the api is just going to return some explicit instructions on which metadata I need to strip out of that to remove the myth label only for my organization. So if, if contoso and fabricam have both both labeled, this document and I'm calling this remove from fabrikam I'll only remove the fabric cam metadata.

A

So then the next one is extract label. So this might be if um I've I've written some software that can extract the strings or metadata out of some document. That's that I found either dlp software or or my firewall software, or maybe just a line of business app. I can pass that metadata up to the extract label. Api and it'll tell me exactly which labels on that content. So here you can see that I've extracted some key pairs.

A

Key value pairs from the document that I found call this api and we'll actually get the label id back. So I would know that this label is scoped to bob tests and then finally, this one, I say till last only because it's only sort of available this one allows you to perform classification. So one of the e5 features that's available inside of mip is that I can perform auto classification by setting rules inside the label policy.

A

So I can say if you find a certain number of credit cards or social security numbers, that information should be highly confidential and you should apply that label to it now. The gap here is that we don't actually have any public apis that allow customers and partners to do this classification, so you could certainly go into our docs and look up like find the sensitive information type id and build your own classification system pass that into our api here, and we would give you a result but doing that classification would be up to you.

A

So what this api takes in is is a content info where we give an identifier. This is what'll actually show up in my analytics for the admin review, some state information at rest in motion and then format, so this is default or email default refers to files and then I'll pass in some classification results. So assuming I wrote my own classifier or I'm using the microsoft classification engine, which is what office uses, I pass it a sensitive information id.

A

I pass in the number of occurrences that I found in my confidence level and based on all of that, the api will return, a recommended label or an automatic label recommended means: hey user. We found some information in your document. You should label this appropriately and, and they can choose to do that or to ignore it automatic is just happens. The the user gets no choice. We say well, there's 100 credit card numbers in this document. We need to make that highly confidential and then we'll apply that label.

A

So overall, what we've exposed here in graph and what we're moving to the new endpoint here this week are just the apis that allow us to reason over policy. I can again list labels in my application. I can use it to evaluate label application or removal.

A

I can use it to extract the content metadata and resolve that to a label uh or I can perform the classification results. Quick plug I'll, be on the the 425 dev show on thursday morning. This week, at 8 am to talk more about mip sdk I'll show a sample application there uh asp.net core sample app, probably on linux and windows, and so, if you're wanting to learn more about mip sdk, that's at 8am on thursday, and I will answer questions in chat cool. Thank you tom, on that one.