Overview
Enterprise customers can leverage SafeBase's integration with Microsoft Purview labeled files. This allows for specific files to be encrypted at rest at the file level, and allows an organization to maintain control over the users who can decrypt them.
Prerequisites
The organization's Azure tenant has a valid subscription to MP.
The organization has created a valid MP label.
The SafeBase app will reapply a new, email-scoped label for each customer who downloads a protected file.
Setup
Organizations should reach out to their dedicated CSM and ask about the add-on
Once the integration is active, navigate to Settings > Documents > Microsoft Purview Protection in the Trust Center.
Choose Microsoft Purview in the Encrypted Document Provider dropdown.
Enter the Azure Tenant ID. This is found in the Azure portal Directories + subscriptions settings.
Click Connect.
An Azure administrator (or other privileged user with permissions to approve new apps) will be required to complete the approval process. The OAuth connection requires the following permissions:
Click on Allow,
A new service principal will be created that has the following permissions:
UnifiedPolicy.Tenant.Read - Access to the policy configurations for MP
Content.Writer - Create protected content with labels.
Content.SuperUser - Read content that has already been labeled.
Application.Read.All - For SafeBase to log data and read the service configuration for MP.
After successfully connecting, navigate back to the Trust Center settings.
Upload your encrypted files with the appropriate label that allows for all authenticated users to access the file.
Notify the SafeBase team of the files that are MP labeled.
A SafeBase team member will adjust the content as MP labeled on our end.
After this has been completed, the MP-labeled files will have a tooltip distinguishing them from other, non-labeled files. This tooltip will indicate to the user that this file will take slightly longer to download.
These files will be scoped to the domain of the user who downloads the file from the Trust Center. Access will expire after 30 days.