Veritas Data Insight Administrator's Guide

To set MIP labels in Online mode,

1. Log in to Data Insight console and click Remediation > Data management in the left pane.
2. Click Set Microsoft Purview Information Protection (MIP) Label and then click Edit in the right pane.
3. You can select either User scan credentials or Select user in the Run As field. If your choice is Select user, make sure the selected user has access to the filer.
4. Click MIP Action Mode and select Online
5. Enter Tenant Id,Client Id Client Secret Key and Microsoft Administrator Account details.

   Note:

   User Microsoft Administrator Account which is either Global Administrator account or Minimum Privilege Account with Information Protector reader and Sensitivity Label reader privileges. For more information See Creating Minimum Privilege Account Role in Compliance Center .

6. In the Run Set MIP Action on field, select the option where you want to run the set MIP action, either Management Server or Collector

   Note:

   If you are opting for Collector node, you need to perform all pre-requisite steps on the Collector node as well.

7. Click OK

Downloading list of MIP Labels using PowerShell scripts

1. If you want to download list of MIP labels using App Authentication method, create Azure Application by following the steps given at https://learn.microsoft.com/en-us/azure/information-protection/rms-client/clientv2-admin-guide-powershell#create-and-configure-azure-ad-applications-for-set-aipauthentication and then execute the following script

   param (
   	[parameter(Mandatory=$true)]
       [string]$filePath,
       [parameter(Mandatory=$true)]
       [string]$AppID,
       [parameter(Mandatory=$true)]
       [string]$AppSecret,
       [parameter(Mandatory=$true)]
       [string]$TenantId,
       [parameter(Mandatory=$true)]
       [string]$DelegatedUser
    )
   
    $creds = Get-Credential
   
   Set-AIPAuthentication -AppId $AppID -AppSecret $AppSecret -TenantId $TenantId 
   -DelegatedUser $DelegatedUser
   
   Export-AIPLogs -FileName $filePath
   Clear-AIPAuthentication

   Note:

   Make sure the following string in point 1, comes in a single line.

   Set-AIPAuthentication -AppId $AppID -AppSecret $AppSecret -TenantId $TenantId -DelegatedUser $DelegatedUser

   After running the script, you will be prompted to enter the location where you want to download .zip file. For example, c:\temp\MIPlabel.zip

   Enter Admin credentials of the machine where PowerShell is running.

   Enter App ID, App Secret, Tenant ID and Delegate User credentials

2. If you want to fetch labels by User Authentication method , execute the following script

   param (
   	[parameter(Mandatory=$true)]
       [string]$filePath
    )
   
    $creds = Get-Credential
   
   Set-AIPAuthentication -OnBehalfOf $creds
   Export-AIPLogs -FileName $filePath
   Clear-AIPAuthentication

   After running the script, you will be prompted to enter the location where you want to download .zip file. For example, c:\temp\MIPlabel.zip

   Enter Admin credentials of the machine where PowerShell is running.

   After authentication, one more Microsoft pop up will appear.

   Enter Azure User credentials, having minimum roles of Information Protection Reader and Sensitivity Label Reader.

3. After fetching MIP Labels, open the ZIP file.
4. Navigate to the MSIP folder and copy any files that have an .xml file name extension.
5. Paste these files into the %localappdata%\Microsoft\MSIP folder on the Management Server node.

Downloading list of MIP Labels using manual steps

1. Login to machine with internet connection and open PowerShell in elevated mode (Run as administrator)

   Note:

   The machine should have Azure Unified Client and .NET Framework 4.6.2 or higher installed.

2. To Set AIP Authentication in the PowerShell, you have 2 options. Using App Authentication or Using User Authentication.

   Using App Authentication

   Create Azure Application by following the steps given at https://learn.microsoft.com/en-us/azure/information-protection/rms-client/clientv2-admin-guide-powershell#create-and-configure-azure-ad-applications-for-set-aipauthentication

   Using User Authentication

   • Execute the following command Set-AIPAuthentication -OnBehalfOf .

   • A command pop up will appear.

   • Enter Admin credentials of the machine where PowerShell is running.

   • After authentication, one more Microsoft pop up will appear.

   • Enter Azure User credentials, having minimum roles of Information Protection Reader and Sensitivity Label Reader.

   See Creating Minimum Privilege Account Role in Compliance Center .

3. Execute the following command Export-AIPLogs -FileName <File location where we want to export logs>

   Note:

   The file extension should be .ZIP. For example: C:\policy.zip

4. Execute the following command Clear-AIPAuthentication
5. Navigate to the MSIP folder and copy any files that have an .xml file name extension.
6. On the Management Server node, paste these files into the %localappdata%\Microsoft\MSIP folder, where %localappdata% is the AppData folder of the domain user account, through which the workflow services are running. For example, c:\Users\<domain user>\AppData

Note:

1. You will not be able add any protected label (properties like encrypted mode) to files.
2. You will not be able set any MIP label to encrypted files.
3. Labels which have Allow offline access property set to Never or Some days, will not be applied as Data Insight supports only offline mode.

To set MIP labels in Offline mode,

1. Log in to Data Insight console and click Remediation > Data management in the left pane.
2. Click Set Microsoft Purview Information Protection (MIP) Label and then click Edit in the right pane.
3. Click MIP Action Mode and select Online
4. You can select either User scan credentials or Select user in the Run As field. If your choice is Select user, make sure the selected user must have access to the filer.
5. In the Run Set MIP Action on field, select the option where you want to run the set MIP action, either Management Server or Collector

   Note:

   If you are opting for Collector node, you need to perform all pre-requisite steps on the Collector node as well.

6. Click OK