Cloud Connector: Can you connect Microsoft Purview to CloudNine Review to transfer eDiscovery data directly into CloudNine Review? 

About CloudNine's Cloud Connector 

CloudNine’s Cloud Connector provides a secure path for transferring approved Microsoft Purview eDiscovery export data into CloudNine Review. The connector reduces reliance on manual export handling by allowing approved Purview exports to be ingested into the review platform.

This guide explains the configuration process: first, registering and permissioning the application in Microsoft Entra ID; second, registering and permissioning the service principal for Purview access; third, granting the appropriate Purview roles and case access; and fourth, adding the resulting connection details in CloudNine Review so the connector can collect approved data.

Downloadable Version: CloudConnector_ThirdPartySetupandConfiguration_Purview

Before you Begin

Ensure the following prerequisites are met before starting configuration.

Microsoft Requirements

• Microsoft Purview eDiscovery licensing is enabled for the tenant.
• A Microsoft Entra ID Global Administrator or Cloud Application Administrator is available to register an application and grant administrator consent.
• A Microsoft Purview administrator has permission to manage role groups and eDiscovery access.

CloudNine Requirements

• You have CloudNine Review Global Administrator permission.
• You can access the Connectors administration area within CloudNine Review.

Information to Capture

During setup, record the following values:

• Application (Client) ID
• Directory (Tenant) ID
• Client Secret Value
• Enterprise Application Object ID

You will need these values to configure the connector in CloudNine Review.

Helpful Microsoft Resources

• Register an Application: The foundational guide for creating an app identity in Entra ID.
• Configure API Permissions: Detailed steps on how to add and authorize permissions for your registered app.
• Add a Redirect URI: A security feature for Microsoft Entra ID authentication, sent to the intended recipient.
• Microsoft Graph Permissions Reference: A complete list of all scopes for emails (Mail.*) and files (Files.*).
• Granting Admin Consent: Instructions for administrators to approve high-privilege permissions tenant-wide.
• Restrict App To Users: Provides information on restricting users who can access the app.
• Permissions in Microsoft Purview portal: Management of permissions for users performing tasks in Microsoft Purview.

Step 1: Register the Application in Microsoft Entra ID

Cloud Connector authenticates to Microsoft 365 through a dedicated application registration. This application establishes a secure trust relationship between your Microsoft environment and CloudNine Review.

Create the Application

1. Sign in to the Microsoft Entra Admin Center.
2. Navigate to Identity-> Applications-> App registrations.
3. Select New Registration.
4. Enter the following configuration:
   1. Name: CloudNine Cloud Connector Purview Ingestion.
   2. Supported Account Types: Accounts in this organizational directory only (Single tenant).
5. Click Register.
6. Copy and Save the following; you will use these values later when creating the Cloud Connector.
   1. Application (Client) ID.
   2. Directory (Tenant) ID.

Step 2: Create a Client Secret

Cloud Connector uses a client secret to securely authenticate with Microsoft services.

1. Open the application registration.
2. Select Certificates & secrets.
3. Select New Client Secret.
4. Enter a description and expiration period.
5. Create the secret.

Managing Secret Expiration

To avoid service interruptions:

• Monitor secret expiration dates.
• Create a replacement secret before the existing secret expires.
• Update the Cloud Connector configuration with the new secret value.

Step 3: Add a Redirect URI (required)

A Redirect URI is required for the application authentication flow used by the CloudNine Discovery Portal and Cloud Connector.

1. Select Authentication.
2. Choose Add a platform.
3. Select Mobile and Desktop Applications.
4. Enter http://localhost:5000.
5. Select Configure.

Step 4: Assign API Permissions

Cloud Connector requires access to Microsoft Graph and Microsoft Purview APIs to discover and collect approved eDiscovery content.

1. Navigate to API Permissions -> Add a permission.
2. Select Microsoft Graph, then choose Application Permissions.
3. Add the following permissions:

Grant Administrator Consent

After permissions have been assigned:

1. Select Grant Admin Consent.
2. Confirm the request.
3. Verify all required permissions display a status of Granted.

Step 5: Grant Microsoft Entra ID App Access to Purview

Microsoft requires the backend application service principal to be registered with Microsoft Purview and assigned to an appropriate eDiscovery role group before it can use app-only eDiscovery access.

Before running the PowerShell commands, confirm that the Exchange Online PowerShell module is installed and that the administrator can connect to Security and Compliance PowerShell.

Follow these steps to grant the Entra ID application access to Purview.

1. Connect to Microsoft Security & Compliance PowerShell: Run:

Connect-IPPSSession

Sign in using an account authorized to manage Microsoft Purview role groups.

2.  Register the application's service principal with Microsoft Purview:

Run:

New-ServicePrincipal `
      -AppId "<APPLICATION-CLIENT-ID>" `
      -ObjectId "<ENTERPRISE-APPLICATION-OBJECT-ID>" `
      -DisplayName "<APPLICATION-NAME>"

Example: 

New-ServicePrincipal `
      -AppId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" `
      -ObjectId "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" `
      -DisplayName "Company Purview Export Application"

This step registers a reference to the existing Entra Enterprise Application with Microsoft Purview. It does not create another Entra application and does not itself grant eDiscovery access.

3.  Verify the service principal registration: Run:

Get-ServicePrincipal `
     -Identity "<APPLICATION-CLIENT-ID>" |
     Format-List DisplayName,AppId,ObjectId

Verify:

AppId: Matches the Entra Application (Client) ID, and:

ObjectId: Matches the Enterprise Application Object ID.

4.  Assign the minimum Purview role: Run:

Add-RoleGroupMember `
   -Identity "eDiscoveryManager" `
   -Member "<ENTERPRISE-APPLICATION-OBJECT-ID>"

This assigns the application's service principal to the Microsoft Purview eDiscovery Manager role group.

5. Verify the assignment: Run:

 Get-RoleGroupMember `
      -Identity "eDiscoveryManager" 

Confirm that the application appears in the returned membership.

Step 6: Assign Microsoft Purview Roles and Permissions

API permissions determine what the application can request. Microsoft Purview roles determine what content the application can access and manage.

Role Groups Overview

Add the service principal or authorized user to the appropriate Microsoft Purview role group based on the level of access required:

In the Microsoft Purview Portal, go to Settings -> Roles and Scopes -> Role Groups.

• eDiscovery Manager: Appropriate for scoped access. Members can create and manage their own cases and access cases where they are explicitly added.
• eDiscovery Administrator: Appropriate for tenant-wide eDiscovery administration. Members can access and manage all cases across the organization.
• Compliance Administrator or Organization Management: May provide broader compliance administration capabilities but should be assigned only when required by the organization’s access model.

Step 7: Grant Access to eDiscovery Cases

Role-group membership and case membership work together. Role groups determine whether the user or service principal has the required eDiscovery capabilities, while case access determines which cases and exports are available for the connector workflow.

For case-scoped workflows, add the user or role group that will initiate the connector workflow to the relevant eDiscovery case. This step helps ensure the connector can access only the cases and data that the organization has approved.

1. Sign in to the Microsoft Purview portal with an account that has Case Management permissions (or as an eDiscovery Administrator).
2. In the navigation panel, go to eDiscovery -> Cases.
3. Select the case you want to modify.
4. Open Case settings tab, then select Access and permissions.
5. Select Add User.
6. Select the user(s) or role group(s) you wish to add.
7. Select Add to confirm. Save your changes.

Step 8: Create the Connector in CloudNine Review

Once Microsoft configuration is complete, create the Cloud Connector within CloudNine Review.

1. Sign in to CloudNine Review as a Global Administrator.  
2. On the My Projects page, open the User menu in the top-right corner and select Connectors.
   
   
3. Select Create New.
4. Enter the following values:
   
   1. Connector Name: Enter a unique descriptive name. This might be as simple as Purview Connector, or you may choose to name it after the eDiscovery Collection.
   2. Connection Type: Purview.
      
   3. Client ID: Application (client) ID.
   4. Secret: Client Secret Value.
   5. Tenant ID: Directory (Tenant) ID.
5. Select Create New.

The connector will appear in the Connectors list and will be available for authorized users to select when initiating approved Purview collection workflows.

Verify the Configuration: Validation Checklist

Before performing a production collection, CloudNine recommends validating the configuration by confirming that the connector can:  

• Authenticate successfully.
• Connect to Microsoft Purview.
• Display authorized eDiscovery cases.
• Access approved mailboxes and data locations.
• Complete a small test collection without errors.

Security Best Practices

CloudNine recommends the following security controls:

• Follow least-privilege access principles.
• Review API permissions regularly.
• Rotate client secrets according to organizational policy.
• Limit connector administration access to authorized personnel.
• Use separate connectors when different matters, departments, or regions require distinct security boundaries.