Merge pull request #85559 from cabailey/cabailey-azuredocs

Clarifications for Sentinel data connector for AIP

Author: Jak-MS

articles/sentinel/connect-azure-information-protection.md

@@ -3,9 +3,8 @@ title: Connecting Azure Information Protection data to Azure Sentinel Preview| M
 description: Learn how to connect Azure Information Protection data in Azure Sentinel.
 services: sentinel
 documentationcenter: na
-author: rkarlin
+author: cabailey
 manager: rkarlin
-editor: ''
 
 ms.assetid: bfa2eca4-abdc-49ce-b11a-0ee229770cdd
 ms.service: azure-sentinel
@@ -14,8 +13,8 @@ ms.devlang: na
 ms.topic: conceptual
 ms.tgt_pltfrm: na
 ms.workload: na
-ms.date: 04/07/2019
-ms.author: rkarlin
+ms.date: 09/15/2019
+ms.author: cabailey
 
 ---
 # Connect data from Azure Information Protection
@@ -25,34 +24,46 @@ ms.author: rkarlin
 > This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. 
 > For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
 
-You can stream logs from [Azure Information Protection](https://docs.microsoft.com/azure/information-protection/reports-aip) into Azure Sentinel with a single click. Azure Information Protection helps protect your data whether it’s stored in the cloud or in on-premises infrastructures and control and help secure email, documents, and sensitive data that you share outside your company. From easy classification to embedded labels and permissions, enhance data protection at all times with Azure Information Protection. When you connect Azure Information Protection to Azure Sentinel, you stream all the alerts from Azure Information Protection into Azure Sentinel.
+You can stream logging information from [Azure Information Protection](https://azure.microsoft.com/services/information-protection/) into Azure Sentinel by configuring the Azure Information Protection data connector. Azure Information Protection helps you control and secure your sensitive data, whether it’s stored in the cloud or on-premises.
 
+If [central reporting for Azure Information Protection](https://docs.microsoft.com/azure/information-protection/reports-aip) is already configured so that logging information from this service is stored in the same Log Analytics workspace as you've currently selected for Azure Sentinel, you can skip the configuration of this data connector. The logging information from Azure Information Protection is already available to Azure Sentinel.
 
-## Prerequisites
+However, if logging information from Azure Information Protection is going to a different Log Analytics workspace than the one you've currently selected for Azure Sentinel, do one of the following:
 
-- User with global administrator, security administrator, or information protection permissions
+- Change the workspace selected in Azure Sentinel.
 
+- Change the workspace for Azure Information Protection, which you can do by configuring this data connector.
+    
+    If you change the workspace, new reporting data for Azure Information Protection will now be stored in the workspace you're using for Azure Sentinel, and historical data isn't available to Azure Sentinel. In addition, if the previous workspace is configured for custom queries, alerts, or REST APIs, these must be reconfigured for the Azure Sentinel workspace if you want to carry on using them for Azure Information Protection. No reconfiguration is needed for clients and services that use Azure Information Protection.
 
-## Connect to Azure Information Protection
+## Prerequisites
 
-If you already have Azure Information Protection, make sure it is [enabled on your network](https://docs.microsoft.com/azure/information-protection/activate-service).
-If Azure Information Protection is deployed and getting data, the alert data can easily be streamed into Azure Sentinel.
+- One of the following Azure AD administrator roles for your tenant: Azure Information Protection administrator, Security administrator, or Global administrator.
+    
+    > [!NOTE]
+    > You cannot use the Azure Information Protection administrator role if your tenant is on the [unified labeling platform](https://docs.microsoft.com/azure/information-protection/faqs#how-can-i-determine-if-my-tenant-is-on-the-unified-labeling-platform).
 
+- Permissions to read and write to the Log Analytics workspace you're using for Sentinel and Azure Information Protection.
 
-1. In Azure Sentinel, select **Data connectors** and then click the **Azure Information Protection** tile.
+- Azure Information Protection has been added to the Azure portal. If you need help with this step, see [Add Azure Information Protection to the Azure portal](https://docs.microsoft.com/azure/information-protection/quickstart-viewpolicy#add-azure-information-protection-to-the-azure-portal).
 
-2. Go to the [Azure Information Protection portal](https://portal.azure.com/?ScannerConfiguration=true&EndpointDiscovery=true#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade) 
+## Connect to Azure Information Protection
 
-3. Under **Connection**, set up streaming of logs from Azure Information Protection to Azure Sentinel by clicking [Configure analytics](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/analyticsOnboardBlade)
+Use the following instructions if you haven't configured a Log Analytics workspace for Azure Information Protection, or you need to change the workspace that stores the Azure Information Protection logging information. 
 
-4. Select the workspace into which you deployed Azure Sentinel. 
+1. In Azure Sentinel, select **Data connectors**, and then **Azure Information Protection**.
 
-5. Click **OK**.
+2. On the **Azure Information Protection** blade, select **Open connector page**.
 
-6. To use the relevant schema in Log Analytics for the Azure Information Protection alerts, search for **InformationProtectionLogs_CL**.
+3. On the next blade, in the **Configuration** section, select **Azure Information Protection** to go to **Azure Information Protection analytics**.
 
+4. From the list of available workspaces, select the workspace that you're currently using for Azure Sentinel. If you select a different workspace, the reporting data from Azure Information Protection won't be available to Azure Sentinel.
 
+5. When you have selected a workspace, select **OK** and the connector **STATUS** should now change to **Connected**.
 
+6. The reporting data from Azure Information Protection is stored in the **InformationProtectionLogs_CL** table within the selected workspace. 
+    
+    To use the relevant schema in Azure Monitor for this reporting data, search for **InformationProtectionEvents**. For information about these event functions, see the [Friendly schema reference for event functions](https://docs.microsoft.com/azure/information-protection/reports-aip#friendly-schema-reference-for-event-functions) section from the Azure Information Protection documentation.
 
 ## Next steps
 In this document, you learned how to connect Azure Information Protection to Azure Sentinel. To learn more about Azure Sentinel, see the following articles: