Arctera Insight Information Governance Administrator's Guide

1. Executing PowerShell script:

   • App Authentication method: Create Azure Application by following the steps given at https://learn.microsoft.com/en-us/powershell/azure/aip/setup-information-protection-client-powershell?view=azureipps#create-and-configure-microsoft-entra-applications-for-set-authentication and then execute the following script:

     param (
     	[parameter(Mandatory=$true)]
         [string]$filePath,
         [parameter(Mandatory=$true)]
         [string]$AppID,
         [parameter(Mandatory=$true)]
         [string]$AppSecret,
         [parameter(Mandatory=$true)]
         [string]$TenantId,
         [parameter(Mandatory=$true)]
         [string]$DelegatedUser
      )
     
      $creds = Get-Credential
     
     Set-Authentication -AppId $AppID -AppSecret $AppSecret 
     -TenantId $TenantId 
     -DelegatedUser $DelegatedUser
     
     Export-DebugLogs -FileName $filePath
     Clear-Authentication

     Note:

     Make sure the following command comes in a single line:

     Set-Authentication -AppId $AppID -AppSecret $AppSecret -TenantId $TenantId -DelegatedUser $DelegatedUser

     After running the script, you will be prompted to enter the location where you want to download .zip file. For example, c:\temp\MIPlabel.zip

     Enter Admin credentials of the machine where PowerShell is running.

     Enter App ID, App Secret, Tenant ID and Delegate User credentials

     Note:

     Make sure UnifiedPolicy.Tenant.Read permission is granted while creating an application.

   • User Authentication method: Execute the following script:

     param (
     	[parameter(Mandatory=$true)]
         [string]$filePath
      )
     
      $creds = Get-Credential
     
     Set-Authentication -OnBehalfOf $creds
     Export-DebugLogs -FileName $filePath
     Clear-Authentication

     After running the script, you will be prompted to enter the location where you want to download .zip file. For example, c:\temp\MIPlabel.zip

     Enter Admin credentials of the machine where PowerShell is running.

     After authentication, one more Microsoft pop up will appear.

     Enter Azure User credentials, having minimum roles of Information Protection Reader and Sensitivity Label Reader.

   • After fetching MIP Labels, open the ZIP file.

   • Navigate to the MSIP folder and copy any files that have an .xml file name extension.

   • (Only applicable for offline mode) Paste these files into the %localappdata%\Microsoft\MSIP folder on the Management Server node.

2. Performing Manual Steps:

   • For the App Authentication method: Create Azure Application by following the steps given at https://learn.microsoft.com/en-us/powershell/azure/aip/setup-information-protection-client-powershell?view=azureipps#create-and-configure-microsoft-entra-applications-for-set-authentication.

   • For the User Authentication method:

     • Execute the following command Set-Authentication -OnBehalfOf.

     • A pop-up will appear.

     • Enter the Admin credentials of the machine where PowerShell is running.

     • After authentication, one more Microsoft pop-up will appear.

     • Enter the Azure User credentials, having minimum roles of Information Protection Reader and Sensitivity Label Reader.

   • Execute the following command: Export-DebugLogs -FileName <File location where we want to export logs>

     Note:

     The file extension should be .ZIP. For example: C:\Policy.zip

   • Execute the following command Clear-Authentication

   • Navigate to the MSIP folder and copy any files that have an .xml file name extension.

   • (Only applicable for offline mode) On the Management Server node, paste these files into the %localappdata%\Microsoft\MSIP folder, where %localappdata% is the AppData folder of the domain user account, through which the workflow services are running. For example, c:\Users\<domain user>\AppData

To automate policy creation of MIP labels:

1. Save the Policy.xml file at <Datadir>/tmp/Policy.xml.
2. Navigate to Settings > Remediation > Data Management and click Configure Microsoft Purview Information Protection (MIP) Label.
3. Enable Set/Remove MIP label action box should be checked.
4. If you are opting for Online mode, enter the required credentials.
5. Click OK.

To configure MIP labels in Online mode:

1. Log in to Information Governance console and click Settings > Remediation > Data management in the left pane.
2. Click Configure Microsoft Purview Information Protection (MIP) Label and then click Edit in the right pane.
3. You can select either User scan credentials or Select user in the Run As field. If your choice is Select user, make sure the selected user has access to the filer.
4. Click MIP Action Mode and select Online
5. Enter Tenant Id, Client Id, Client Secret Key, and Microsoft Administrator Account details.

   Note:

   Use Microsoft Administrator Account which is either Global Administrator account or Minimum Privilege account with Information Protector reader and Sensitivity Label reader privileges.

6. In the Run Set MIP Action on field, select the option where you want to run the set MIP action, either Management Server or Collector

   Note:

   If you are opting for Collector node, you need to perform all pre-requisite steps on the Collector node as well.

7. Click OK

To configure MIP labels in Offline mode:

1. Log in to Information Governance console and click Settings > Remediation > Data management in the left pane.
2. Click Set Microsoft Purview Information Protection (MIP) Label and then click Edit in the right pane.
3. Click MIP Action Mode and select Offline.
4. You can select either User scan credentials or Select user in the Run As field. If your choice is Select user, make sure the selected user must have access to the filer.
5. In the Run Set MIP Action on field, select the option where you want to run the set MIP action, either Management Server or Collector

   Note:

   If you are opting for Collector node, you need to perform all pre-requisite steps on the Collector node as well.

6. Click OK