Issue setting up AIP Scanner for using Application token.

Question

Setting up AIP on-premises scanner and utilizing an application registered within the Entra ID and the set-aipauthentication to run the scanner utilizing the application token vs. resetting it every 90 days. However when setting it up and running the set-aipauthentication command for some reason it is not giving us the results of Acquired application access token, but still saying acquired access token.

How can I validate that it is running under the application token? And is there a way to see what within the set-aipauthentication command is preventing the application access token utilization?

Thank you

Answer 1

Hi @Steve l ,

Thanks for reaching out.

This is expected behavior when you run the command Set-AIPAuthentication which will allow AIP scanner service account to authenticate AIP service. Token sets and stores credentials for the delegated user to authenticate to Azure Information Protection.

There is no direct way to validate that token has been acquired or prevent the access utilization, but your on-prem service account need to be in synchronized to Microsoft Entra ID to download and execute the scanner's policy.

Reference- https://learn.microsoft.com/en-us/purview/deploy-scanner-prereqs#service-account-requirements

I would suggest you post this idea at the Azure Feedback Portal, which is monitored by the product team for feature enhancements.

Hope this will help.

Thanks,

Shweta

---