Connectors Reference

Microsoft 365 compliance

The Microsoft 365 compliance center is home to integrated solutions for protecting and governing data, mitigating risks, and more. Simplify tasks across these solutions so you can focus on your compliance posture.

 

Status: Preview

Tier: Premium

Version: 1.0

 

Actions:

Name

Summary

GetIrmAlert (string Alert_Id)

Get insider risk management alert

GetTaggedFiles (string caseid, string tagName, integer pageIndex, [Optional]integer pageSize)

Get tagged privacy files

AddIrmCaseNote (string Case_Id, [Optional]AddIrmCaseNoteParameterBody body)

Add insider risk management case note

AddPrivacyCaseNote (string Case_Id, [Optional]AddPrivacyCaseNoteParameterBody body)

Add privacy management case note

GetIrmRiskyUser (string RiskyUser_Id)

Get insider risk management user

GetViolationMetadata (string caseId, string workingsetId, string docId, string flowName)

Get communication compliance violation metadata

GetIrmCase (string Case_Id)

Get insider risk management case

GetPrivacyCase (string Case_Id)

Get privacy management case

GetIrmAlertsForCase (string Case_Id)

Get insider risk management alerts for a case

OnIRMCaseSelected ()

When insider risk management case is selected

OnIRMRiskyUserSelected ()

When insider risk management risky user is selected

OnIRMItemSelected ()

When insider risk management item is selected

OnCCItemSelected ()

When an Communication Compliance Item Selected

OnPrivacyCaseSelected ()

When privacy management case is selected

 

Triggers:

Name

Summary

 

Objects:

Name

Summary

AddIrmCaseNoteParameterBody

 

AddIrmCaseNoteResponse

 

AddPrivacyCaseNoteParameterBody

 

AddPrivacyCaseNoteResponse

 

GetIrmAlertResponse

 

GetIrmAlertsForCaseResponse

 

GetIrmCaseResponse

 

GetIrmRiskyUserResponse

 

GetPrivacyCaseResponse

 

GetTaggedFilesResponse

 

GetViolationMetadataResponse

 

OnCCItemSelectedResponse

 

OnIRMCaseSelectedResponse

 

OnIRMItemSelectedResponse

 

OnIRMRiskyUserSelectedResponse

 

OnPrivacyCaseSelectedResponse

 

 

Actions:

GetIrmAlert

Summary: Get insider risk management alert

Description: Get insider risk management alert.

 

Syntax:

Microsoft365compliance.GetIrmAlert (string Alert_Id)

 

Parameters:

Name

Type

Summary

Required

Related Action

Alert_Id

string

(Alert ID)

The unique identifier of the insider risk management alert.

True

 

Returns:

          Type:GetIrmAlertResponse

 

GetTaggedFiles

Summary: Get tagged privacy files

Description: Get a list of tagged privacy files.

 

Syntax:

Microsoft365compliance.GetTaggedFiles (string caseid, string tagName, integer pageIndex, [Optional]integer pageSize)

 

Parameters:

Name

Type

Summary

Required

Related Action

caseid

string

(Case Id)

The unique identifier of privacy management case.

True

tagName

string

(Tag Name)

The name of a tag for privacy file.

True

pageIndex

integer

(Page Index)

The page index of the search for tagged privacy files.

True

pageSize

integer

(Page Size)

The page size of the search for tagged privacy files.

False

 

Returns:

          Type:GetTaggedFilesResponse

 

AddIrmCaseNote

Summary: Add insider risk management case note

Description: Adds a note to the insider risk management case

 

Syntax:

Microsoft365compliance.AddIrmCaseNote (string Case_Id, [Optional]AddIrmCaseNoteParameterBody body)

 

Parameters:

Name

Type

Summary

Required

Related Action

Case_Id

string

(Case ID)

The unique identifier of an insider risk management case

True

body

AddIrmCaseNoteParameterBody

 

 

False

 

Returns:

          Type:AddIrmCaseNoteResponse

 

AddPrivacyCaseNote

Summary: Add privacy management case note

Description: Adds a note to the privacy management case

 

Syntax:

Microsoft365compliance.AddPrivacyCaseNote (string Case_Id, [Optional]AddPrivacyCaseNoteParameterBody body)

 

Parameters:

Name

Type

Summary

Required

Related Action

Case_Id

string

(Case ID)

The unique identifier of an privacy management case

True

body

AddPrivacyCaseNoteParameterBody

 

 

False

 

Returns:

          Type:AddPrivacyCaseNoteResponse

 

GetIrmRiskyUser

Summary: Get insider risk management user

Description: Get insider risk management user.

 

Syntax:

Microsoft365compliance.GetIrmRiskyUser (string RiskyUser_Id)

 

Parameters:

Name

Type

Summary

Required

Related Action

RiskyUser_Id

string

(User ID)

The unique identifier of the insider risk management user.

True

 

Returns:

          Type:GetIrmRiskyUserResponse

 

GetViolationMetadata

Summary: Get communication compliance violation metadata

Description: Get Violation Metadata

 

Syntax:

Microsoft365compliance.GetViolationMetadata (string caseId, string workingsetId, string docId, string flowName)

 

Parameters:

Name

Type

Summary

Required

Related Action

caseId

string

(Case id)

Communication compliance case id

True

workingsetId

string

(Workingset id)

Communication compliance working set id

True

docId

string

(Document id)

Communication compliance document id

True

flowName

string

(Flow name)

Communication compliance flow name

True

 

Returns:

          Type:GetViolationMetadataResponse

 

GetIrmCase

Summary: Get insider risk management case

Description: Get insider risk management case.

 

Syntax:

Microsoft365compliance.GetIrmCase (string Case_Id)

 

Parameters:

Name

Type

Summary

Required

Related Action

Case_Id

string

(Case ID)

The unique identifier of insider risk management case.

True

 

Returns:

          Type:GetIrmCaseResponse

 

GetPrivacyCase

Summary: Get privacy management case

Description: Get privacy management case.

 

Syntax:

Microsoft365compliance.GetPrivacyCase (string Case_Id)

 

Parameters:

Name

Type

Summary

Required

Related Action

Case_Id

string

(Case ID)

The unique identifier of privacy management case.

True

 

Returns:

          Type:GetPrivacyCaseResponse

 

GetIrmAlertsForCase

Summary: Get insider risk management alerts for a case

Description: Get insider risk management alerts for a case.

 

Syntax:

Microsoft365compliance.GetIrmAlertsForCase (string Case_Id)

 

Parameters:

Name

Type

Summary

Required

Related Action

Case_Id

string

(Case ID)

The unique identifier of the case.

True

 

Returns:

          Type:GetIrmAlertsForCaseResponse

 

OnIRMCaseSelected

Summary: When insider risk management case is selected

Description: For internal use with the visual button hybrid trigger.

 

Syntax:

Microsoft365compliance.OnIRMCaseSelected ()

 

Returns:

          Type:OnIRMCaseSelectedResponse

 

OnIRMRiskyUserSelected

Summary: When insider risk management risky user is selected

Description: For internal use with the visual button hybrid trigger.

 

Syntax:

Microsoft365compliance.OnIRMRiskyUserSelected ()

 

Returns:

          Type:OnIRMRiskyUserSelectedResponse

 

OnIRMItemSelected

Summary: When insider risk management item is selected

Description: For internal use with the visual button hybrid trigger.

 

Syntax:

Microsoft365compliance.OnIRMItemSelected ()

 

Returns:

          Type:OnIRMItemSelectedResponse

 

OnCCItemSelected

Summary: When an Communication Compliance Item Selected

Description: For internal use with the visual button hybrid trigger.

 

Syntax:

Microsoft365compliance.OnCCItemSelected ()

 

Returns:

          Type:OnCCItemSelectedResponse

 

OnPrivacyCaseSelected

Summary: When privacy management case is selected

Description: For internal use with the visual button hybrid trigger.

 

Syntax:

Microsoft365compliance.OnPrivacyCaseSelected ()

 

Returns:

          Type:OnPrivacyCaseSelectedResponse

 


 

AddIrmCaseNoteParameterBody

Summary:

Description:

 

          Properties:

Name

Type

Summary

content

string

Note content

The content of the case note.


 

AddIrmCaseNoteResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary


 

AddPrivacyCaseNoteParameterBody

Summary:

Description:

 

          Properties:

Name

Type

Summary

content

string

Note content

The content of the case note.


 

AddPrivacyCaseNoteResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary


 

GetIrmAlertResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

severity

string

Alert severity

The severity of the alert.

name

string

Alert name

The name of the alert.

status

string

Alert status

The status of the alert.

resolutionTimeInHours

number(float)

Time to resolve in hours

The total time elapsed in hours to resolve the alert.

id

string

Alert ID

The unique identifier of the alert.

createdDateTimeUtc

string

Alert creation time

The timestamp in UTC when alert was generated.

assignedCase

AssignedCase

 

The case associated with alert.

violatedPolicy

ViolatedPolicy

 

The policy that generated the alert.

riskyUser

RiskyUser

 

The user associated with the alert.

 

AssignedCase

Summary:

Description: The case associated with alert.

 

          Properties:

Name

Type

Summary

caseId

string

Case ID

The unique identifier of the case associated with alert.

name

string

Case name

The name of the case associated with alert.

status

string

Case status

The status of the case associated with alert.

 

ViolatedPolicy

Summary:

Description: The policy that generated the alert.

 

          Properties:

Name

Type

Summary

policyId

string

Matched policy ID

The unique identifier of the policy associated with alert.

policyName

string

Matched policy name

The name of the policy associate with alert.

 

RiskyUser

Summary:

Description: The user associated with the alert.

 

          Properties:

Name

Type

Summary

riskyUserId

string

User ID

The unique identifier of the user associated with the alert.

userPrincipalName

string

User principal name

The UPN of the user associated with the alert.

 


 

GetIrmAlertsForCaseResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

value

array of (ValueItem)

 

 

 

ValueItem

Summary:

Description:

 

          Properties:

Name

Type

Summary

severity

string

Alert severity

The severity of the alert.

name

string

Alert name

The name of the alert.

status

string

Alert status

The status of the alert.

closureReason

string

Resolution reason

The closure reason associated with the alert.

resolutionTimeInHours

number(float)

Time to resolve in hours

The total time elapsed in hours to resolve the alert.

id

string

Alert ID

The unique identifier of the alert.

tenantId

string

Tenant ID

The unique identifier of the organization.

createdDateTimeUtc

string

Alert created timestamp

The UTC timestamp identifying the creation time of the alert.

assignedCase

AssignedCase

 

The case associated with alert.

violatedPolicy

ViolatedPolicy

 

The policy associated with alert.

riskyUser

RiskyUser

 

The user associated with alert.

 

AssignedCase

Summary:

Description: The case associated with alert.

 

          Properties:

Name

Type

Summary

caseId

string

Case ID

The unique identifier of the case associated with alert.

name

string

Case name

The name of the case associated with alert.

status

string

Case status

The status of the case associated with alert.

 

ViolatedPolicy

Summary:

Description: The policy associated with alert.

 

          Properties:

Name

Type

Summary

policyId

string

Matched policy ID

The unique identifier of the policy associated with alert.

policyName

string

Matched policy name

The name of the policy associated with alert.

 

RiskyUser

Summary:

Description: The user associated with alert.

 

          Properties:

Name

Type

Summary

riskyUserId

string

User ID

The unique identifier of the user associated with alert.

userPrincipalName

string

User principal name

The UPN of the user associated with alert.

 


 

GetIrmCaseResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

name

string

Case name

The name of the case.

status

string

Case status

The status of the case.

resolutionTimeInHours

number(float)

Case resolution time

The time elapsed in hours to resolve the case.

createdBy

string

Created by

The identifier for the user who created the case.

id

string

Case ID

The unique identifier of the case.

tenantId

string

Tenant ID

The unique identifier of the organization.

createdDateTimeUtc

string

Case created timestamp

The timestamp in UTC corresponding to the time when the case was created.

riskyContentInfo

RiskyContentInfo

 

The content associated with the case.

closingNote

ClosingNote

 

The closing note for this case.

riskyUser

RiskyUser

 

The user associated with the case.

teamInfo

TeamInfo

 

The Teams information associated with the case.

 

RiskyContentInfo

Summary:

Description: The content associated with the case.

 

          Properties:

Name

Type

Summary

labels

array of (LabelsItem)

Content labels

The list of content labels associated with the case.

dlpSensitiveTypes

array of (DlpSensitiveTypesItem)

Sensitive info types

The list of DLP sensitive info types associated with the case.

spoSites

array of (SpoSitesItem)

SharePoint sites

The list of SharePoint sites associated with the case.

 

LabelsItem

Summary:

Description:

 

          Properties:

Name

Type

Summary

 

DlpSensitiveTypesItem

Summary:

Description:

 

          Properties:

Name

Type

Summary

 

SpoSitesItem

Summary:

Description:

 

          Properties:

Name

Type

Summary

 

ClosingNote

Summary:

Description: The closing note for this case.

 

          Properties:

Name

Type

Summary

closingStatus

string

Resolution reason

Resolution status when case closed.

actionTaken

string

Action taken

The action taken when case closed.

 

RiskyUser

Summary:

Description: The user associated with the case.

 

          Properties:

Name

Type

Summary

riskyUserId

string

User ID

The unique identifier user associated with the case.

userPrincipalName

string

User principal name

The UPN for the user associated with the case.

 

TeamInfo

Summary:

Description: The Teams information associated with the case.

 

          Properties:

Name

Type

Summary

id

string

Teams ID

The Teams ID associated with the case.

displayName

string

Teams name

Teams display name.

webUrl

string

Teams URL

URL for Teams.

status

string

Teams status

Status of Teams.

 


 

GetIrmRiskyUserResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

riskLevel

string

Risk level

The risk level associated with the user.

userPrincipalName

string

User principal name

The UPN of the user.

status

string

User status

The status of the user.

id

string

User ID

The unique identifier of the user.

assignedCase

AssignedCase

 

The case associated with the user

 

AssignedCase

Summary:

Description: The case associated with the user

 

          Properties:

Name

Type

Summary

caseId

string

Case ID

The unique identifier of the case associated with the user.

name

string

Case name

The name of the case associated with the user

status

string

Case status

The status of the case associated with the user

 


 

GetPrivacyCaseResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

name

string

Case name

The name of the case.

status

string

Case status

The status of the case.

privacyCaseType

string

Privacy case type

The type of the case.

dsrType

string

DSR type

The DSR Type of the case.

dsrSource

string

DSR source

The DSR source of the case.

dsrRegulation

string

DSR regulation

The DSR regulation of the case.

impactSummary

string

Case impact summary

The impact summary of the case.

severity

string

Case severity

The severity of the case.

createdBy

string

Created by

The identifier for the user who created the case.

id

string

Case ID

The unique identifier of the case.

tenantId

string

Tenant ID

The unique identifier of the organization.

createdDateTimeUtc

string

Case created date

The timestamp in UTC corresponding to the time when the case was created.

dueDateTimeUtc

string

Case due date

The timestamp in UTC corresponding to the time when the case is due.

closedDateTimeUTC

string

Case closed date

The timestamp in UTC corresponding to the time when the case was closed.

insight

Insight

 

Case insight

privacyAdmin

PrivacyAdmin

 

Privacy admin info of the case.

alertInformation

array of (AlertInformationItem)

Alert information

Alert information of the case.

stages

array of (StagesItem)

 

Stages of the case.

dataSubject

DataSubject

 

The data subject user associated with the case.

teamInfo

TeamInfo

 

The Teams information associated with the case.

 

Insight

Summary:

Description: Case insight

 

          Properties:

Name

Type

Summary

filesCount

integer(int32)

Files count

Files count insight.

fileLocations

integer(int32)

File locations count

File locations count insight.

filesSize

integer(int32)

Files size

Files size insight.

needReview

integer(int32)

File need review count

File need review count insight.

lastUpdateTimeUtc

string

Last update time

The timestamp in UTC corresponding to the time when the case was last updated.

documentSourceCount

array of (DocumentSourceCountItem)

 

 

conflictTypeCount

array of (ConflictTypeCountItem)

 

 

reviewStatusCount

array of (ReviewStatusCountItem)

 

 

 

DocumentSourceCountItem

Summary:

Description: Document source count insight.

 

          Properties:

Name

Type

Summary

key

string

Document source count key

Document source count key.

value

integer(int32)

Document source count value

Document source count value.

 

ConflictTypeCountItem

Summary:

Description: Conflict type count insight.

 

          Properties:

Name

Type

Summary

key

string

Conflict type count key

Conflict type count key.

value

integer(int32)

Conflict type count value

Conflict type count value.

 

ReviewStatusCountItem

Summary:

Description: Review status count insight.

 

          Properties:

Name

Type

Summary

key

string

Review status count key

Review status count key.

value

integer(int32)

Review status count value

Review status count value.

 

PrivacyAdmin

Summary:

Description: Privacy admin info of the case.

 

          Properties:

Name

Type

Summary

userObjectId

string

Privacy admin user ID

The unique identifier of the privacy admin user.

userPrincipalName

string

Privacy admin user UPN

The User Principal Name of the privacy admin user.

 

AlertInformationItem

Summary:

Description:

 

          Properties:

Name

Type

Summary

 

StagesItem

Summary:

Description:

 

          Properties:

Name

Type

Summary

id

string

Case stage ID

The unique identifier of the case stage.

status

string

Case stage status

The case stage status.

 

DataSubject

Summary:

Description: The data subject user associated with the case.

 

          Properties:

Name

Type

Summary

id

string

Data subject ID

The unique identifier the data subject.

lastName

string

Data subject last name

The last name of the data subject.

firstName

string

Data subject first name

The first name of the data subject.

residency

string

Data subject residency

The residency of the data subject.

email

string

Data subject email

The email of the data subject.

address

string

Data subject address

The address of the data subject.

additionalInfo

AdditionalInfo

Data subject additional info

The additional info of the data subject.

existingDataSubject

boolean

Is existing data subject

Is an existing data subject.

 

AdditionalInfo

Summary: Data subject additional info

Description: The additional info of the data subject.

 

          Properties:

Name

Type

Summary

 

TeamInfo

Summary:

Description: The Teams information associated with the case.

 

          Properties:

Name

Type

Summary

id

string

Teams ID

The Teams ID associated with the case.

displayName

string

Teams name

Teams display name.

webUrl

string

Teams URL

URL for Teams.

status

string

Teams status

Status of Teams.

 


 

GetTaggedFilesResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

value

array of (ValueItem)

 

 

 

ValueItem

Summary:

Description: File properties value.

 

          Properties:

Name

Type

Summary

id

string

File ID

The unique identifier of an tagged file.

immutableId

string

Immutable ID

The immutable id of an tagged file.

workload

string

File workload

The workload of the tagged file.

size

integer(int32)

File size

The size of the tagged file.

fileName

string

File name

The name of the tagged file.

fileType

string

File type

The file type of the tagged file.

title

string

Title

The title of the tagged file.

subjectTitle

string

Subject title

The subject title of the tagged file.

nativeSize

integer(int32)

Native size

The native size of the tagged file.

documentUrl

string

Document Url

The document Url of the tagged file.

fileClass

string

File class

The file class of the tagged .

extractedContentType

string

Extracted content type

The extracted content type of the tagged file.

filePath

string

File path

The file path of the tagged file.

itemUrl

string

File item Url

The item Url of the tagged file.

docActions

string

Recorded doc actions

DocAction for the file.

remediationActions

string

Remediation actions

RemediationActions for the file.

annotations

string

Annotations

Annotations for the file.

createdDateTimeUtc

string

File created date

The timestamp in UTC corresponding to the time when the file was created.

lastModifiedDateTimeUtc

string

File last modify date

The timestamp in UTC corresponding to the time when the file was last modified.

author

array of (string)

 

Author of the file.

sitePropertyPath

string

Site property path

The file path in site property.

 


 

GetViolationMetadataResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

id

string

 

The unique identifier for remediation action

policyName

string

 

The name for the policy which capture the items

violationTime

string

 

The time when the item happened

violationSource

string

 

The source through which the item was sent

violatedUserEmail

string

 

User email address who sent this item


 

OnCCItemSelectedResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

caseId

string

 

The unique identifier of the case

workingsetId

string

 

The unique identifier of the workingset

itemId

string

 

The unique identifier of the item

flowName

string

 

The name of flow which is run


 

OnIRMCaseSelectedResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

caseId

string

Case ID

The unique identifier of the case.

caseUrl

string

Case URL

Link to insider risk case.


 

OnIRMItemSelectedResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

caseId

string

Case ID

The unique identifier of the case

itemId

string

Item ID

The unique identifier of the item


 

OnIRMRiskyUserSelectedResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

riskyUserId

string

User ID

The unique identifier of the risky user


 

OnPrivacyCaseSelectedResponse

Summary:

Description:

 

          Properties:

Name

Type

Summary

caseId

string

Case ID

The unique identifier of the case.

caseUrl

string

Case URL

Link to privacy case.