Content.Process.All

Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the Content.Process.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	5ad511bf-571c-4ef6-8c3c-85b94b85df98	7e2467d1-f874-46bb-828e-24cb06b29d3f
DisplayText	Process content for data security, governance and compliance	Process content for data security, governance and compliance
Description	Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope.	Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	POST /me/dataSecurityAndGovernance/processContent
	POST /security/dataSecurityAndGovernance/processContentAsync

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	POST /me/dataSecurityAndGovernance/processContent
	POST /security/dataSecurityAndGovernance/processContent
	POST /security/dataSecurityAndGovernance/processContentAsync

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Invoke-MgProcessSecurityDataSecurityAndGovernanceContentAsync

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Invoke-MgBetaProcessSecurityDataSecurityAndGovernanceContent
	Invoke-MgBetaProcessSecurityDataSecurityAndGovernanceContentAsync

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: currentLabel

Property	Type	Description
applicationMode	applicationMode	The application mode associated with the sensitivity label. The possible values are: `manual`, `automatic`, `recommended`, `unknownFutureValue`.
id	String	The GUID that identifies the sensitivity label.

Graph reference: policyLocationAgent

Property	Type	Description
agentMetadata	agentMetadata	Metadata used for agent policy scoping and evaluation. Optional.
value	String	The Microsoft Entra application ID or other primary identifier of the agent. Inherited from policyLocation. Required.

Graph reference: processContentBatchRequest

Property	Type	Description
contentToProcess	processContentRequest	The actual content processing request details, including content metadata, activity, device, and app info.
requestId	String	A unique identifier provided by the client to correlate this specific request item within the batch.
userId	String	The unique identifier (Object ID or UPN) of the user in whose context the content should be processed.

Graph reference: processContentRequest

Property	Type	Description
activityMetadata	microsoft.graph.activityMetadata	Metadata about the user activity (like upload, download) and location (URL). Required.
contentEntries	Collection(microsoft.graph.processContentMetadataBase)	A collection of content entries to be processed. Each entry contains the content itself and its metadata. Use conversation metadata for content like prompts and responses and file metadata for files. Required.
deviceMetadata	microsoft.graph.deviceMetadata	Metadata about the device from which the content originates. Required.
integratedAppMetadata	microsoft.graph.integratedApplicationMetadata	Metadata about the integrated application making the request. Required.
protectedAppMetadata	microsoft.graph.protectedApplicationMetadata	Metadata about the protected application making the request. Required.

Graph reference: processContentResponse

Property	Type	Description
policyActions	Collection(microsoft.graph.dlpActionInfo)	A collection of policy actions (like DLP actions) triggered by the processed content. NOTE: Currently, the only policy action supported in for this resource type is `restrictAccess`.
processingErrors	Collection(microsoft.graph.processingError)	A collection of errors encountered during the content processing.
protectionScopeState	microsoft.graph.security.protectionScopeState	Indicates if the applicable protection scope (policies) has changed since the last known state for the context. Possible values are `modified` and `notModified`.

Graph reference: processContentResponses

Property	Type	Description
requestId	String	The unique identifier that matches the `requestId` provided in the corresponding `processContentBatchRequest`.
results	microsoft.graph.processContentResponse	The outcome of processing the content associated with this `requestId`. Required.

Graph reference: processFileMetadata

Property	Type	Description
content	contentBase	Represents the actual content, either as text (`textContent`) or binary data (`binaryContent`). Optional if metadata alone is sufficient for policy evaluation. Do not use for contentActivities. Inherited from processContentMetadataBase.
correlationId	String	An identifier used to group multiple related content entries (for example, different parts of the same file upload, messages in a conversation). Inherited from processContentMetadataBase.
createdDateTime	DateTimeOffset	Required. Timestamp indicating when the original content was created (for example, file creation time, message sent time). Inherited from processContentMetadataBase.
customProperties	customMetadataDictionary	A dictionary containing custom metadata associated with the file, potentially extracted by the calling application.
identifier	String	Required. A unique identifier for this specific content entry within the context of the calling application or enforcement plane (for example, message ID, file path/URL). Inherited from processContentMetadataBase.
isTruncated	Boolean	Required. Indicates if the provided `content` has been truncated from its original form (for example, due to size limits). Inherited from processContentMetadataBase.
length	Int64	The length of the original content in bytes. Inherited from processContentMetadataBase.
modifiedDateTime	DateTimeOffset	Required. Timestamp indicating when the original content was last modified. For ephemeral content like messages, this might be the same as `createdDateTime`. Inherited from processContentMetadataBase.
name	String	Required. A descriptive name for the content (for example, file name, web page title, `Chat Message`). Inherited from processContentMetadataBase.
ownerId	String	The unique identifier (for example, Entra User ID or UPN) of the owner of the file.
sequenceNumber	Int64	A sequence number indicating the order in which content was generated or should be processed, required when `correlationId` is used. Inherited from processContentMetadataBase.

Table of Contents

Content.Process.All

Graph Methods

Resources