REST Action Failed: Tag Assigned to Content Action Failed

Products

• CASB Securlet SAAS With DLP-CDS
• Data Loss Prevention Cloud Detection Service for REST

Issue/Introduction

You have configured REST Action following the guidance in Create a DLP Enforce Policy with Custom Payload for MPIP Remediation. as below:

{"labelName":"Classification", "parentLabelName":"Confidential", "justificationText":"The Document contains confidential Information."}

It fails with the error "REST Action Failed: Tag Assigned to Content Action Failed".

Cause

CASB backend logs show API the label failed with error code 403. Office365 Securlet does not have the required permission

Resolution

Office365 Securlet needs to be reactivated  to fetch new API permissions.

Additional Information

Please refer to Remediation with Microsoft Purview Information Protection Labels

1. You must reactivate the Office 365 Securlet in your CloudSOC tenant to enable the use of the new InformationProtectionPolicy.Read.All API permission
2. The priority of the tagging data-at-rest (DAR) action should match the MPIP sensitivity label priority.