The Microsoft Information Protection (MIP) SDK is a set of native C++ libraries that expose Microsoft's labeling, classification, and protection services to your application. This site is the API reference for the C++ surface; for narrative documentation, samples, and quickstarts see the conceptual docs on Microsoft Learn.

Get started

1. Set up your dev environment

Set up and configure the MIP SDK — prerequisites, Entra ID app registration, and installing the SDK.
Version release history — supported versions, breaking changes, and the archived reference for every prior release.
Ask a question on Microsoft Q&A — the supported channel for developer questions.

2. Try a quickstart

Initialize a MIP C++ client — step-by-step client bring-up (auth delegate, observer, profile, engine).

3. Read a working sample

Runnable C++ samples, one per API surface:

File API — Azure-Samples/MipSDK-File-Cpp-Basic — list sensitivity labels, apply a label, and read a label from a file.
Protection API — Azure-Samples/mipsdk-protectionapi-cpp-sample-basic — obtain a publishing license, encrypt and decrypt a buffer.
Policy API — Azure-Samples/MipSDK-Policy-Cpp-Sample — enumerate labels, compute actions, apply policy decisions.

API by area

This page is curated; the Classes tab has the full alphabetical class list and the Files tab indexes every header.

Profiles, Engines & Context

The profile/engine pair is your starting point for each API. A profile loads once per process; an engine is per-identity.

Class	What it does
MipContext	Process-wide state shared by every profile.
MipConfiguration	Configure logging, telemetry, storage, and feature flags.
FileProfile / FileEngine	Entry points for the File API.
ProtectionProfile / ProtectionEngine	Entry points for the Protection API.
PolicyProfile / PolicyEngine	Entry points for the Policy / labeling API.

File API — `mip/file/`

Apply, change, or query sensitivity labels and protection on files.

Class	What it does
FileHandler	Per-file operations (get/set label, commit, inspect).
FileInspector	Inspect file format and metadata without modification.
MsgInspector	Inspect MSG (Outlook) files.
FileStatus	Quick label/protection status for a file.
LabelingOptions	Options used when applying a label.
ProtectionSettings	Encryption settings used at commit time.

Protection API — `mip/protection/`

Encrypt, decrypt, and manage Use Licenses directly.

Class	What it does
ProtectionHandler	Encrypt/decrypt a buffer or stream; manage rights and licenses.
ProtectionDescriptor / ProtectionDescriptorBuilder	Describe protection (template, ad‑hoc, do‑not‑forward).
TemplateDescriptor	Information about an RMS template.
TenantInformation	Tenant-level metadata.
UserRights / UserRoles	Per-user rights and role assignments. The string constants for individual rights/roles live in the `mip::rights` and `mip::roles` sub-namespaces.
ParsedPublishingLicense / DelegationLicense	Inspect and request licenses.

Labels & Policy — `mip/upe/`

Drive the labeling experience: discover labels, decide which actions to take, and respond to user choices.

Class	What it does
PolicyHandler	Per-document policy decisions and execute-state lifecycle.
Label	A sensitivity label and its metadata.
ContentLabel	The label currently applied to content.
ExecutionState	Inputs you supply when asking the policy engine to compute actions.
ClassificationRequest / ClassificationResult	Classification engine inputs and outputs.

Actions

PolicyHandler returns a list of Action subclasses describing what your app should do. Common ones:

Action	When emitted
ApplyLabelAction	Apply or change a label.
JustifyAction	Prompt the user for justification.
MetadataAction	Add or remove document metadata.
ProtectByTemplateAction / ProtectAdhocAction / ProtectDoNotForwardAction	Apply protection.
AddWatermarkAction / AddContentHeaderAction / AddContentFooterAction	Apply visual marking.
RemoveProtectionAction	Remove existing protection.
CustomAction	Tenant-defined custom action.

The full list is in the Classes tab — search for Action.

Delegates & callbacks

Implement these to extend or override MIP behavior. Pass instances through MipConfiguration.

Delegate	Customizes
AuthDelegate	Authentication / token acquisition.
HttpDelegate	HTTP transport.
LoggerDelegate	Log routing.
StorageDelegate	On-disk state storage.
TelemetryDelegate	Telemetry emission.
AuditDelegate	Audit event emission.
TaskDispatcherDelegate	Background task scheduling.
ConsentDelegate	User consent prompts.
CloudDiscoveryDelegate	Cloud endpoint discovery.
JsonDelegate / xml::XmlDelegate	JSON/XML parsing.
DiagnosticDelegate	Diagnostic events.

Errors & exceptions

All MIP exceptions derive from Error. Notable types:

Class	Meaning
AccessDeniedError	The caller lacks rights.
BadInputError	An argument was invalid.
NetworkError / ProxyAuthenticationError	Transport failed.
NoAuthTokenError	The auth delegate returned no token.
JustificationRequiredError	A label change requires justification.
ConsentDeniedError	The user (or consent delegate) denied consent.
TemplateNotFoundError / TemplateArchivedError	Template lookup failed.
OperationCancelledError	Async operation cancelled.
DelegateResponseError	A delegate threw or failed.

Streams, HTTP & I/O

Class	Purpose
Stream / EditableStream	Byte streams used throughout the SDK.
HttpRequest / HttpResponse / HttpOperation	HTTP delegate types.
JsonDocument / JsonValue	JSON delegate types.
xml::XmlDocument / xml::XmlNode / xml::XmlReader	XML delegate types.

Common types

AuditEvent, TelemetryEvent, Event, EventProperty, DynamicWatermark, FlightingFeature, DiagnosticConfiguration, LogMessageData. See the Classes tab for the rest.

Generated by Doxygen from the SDK headers. To edit this overview, change doxygen/mainpage-cpp.md in the mip-sdk-docs-gen repo.