page_type	sample
languages	cpp csharp
products	m365 office-365
description	This sample application illustrates using the MIP File API to list labels, apply a label, then read the label. All SDK actions are implemented in action.cpp.
urlFragment	MipSDK-File-Cpp-Basic

MipSDK-File-Cpp-Basic

This sample illustrates basic SDK functionality where it:

• Obtains the list of labels for the user
• Prompts to input one of the label IDs
• Prompts for a file path of a file to label
• Applies the label
• Reads the label from the document and displays metadata

Summary

This sample application illustrates using the MIP File API to list labels, apply a label, then read the label. All SDK actions are implemented in action.cpp.

Getting Started

Prerequisites

• Visual Studio 2022 or later with Visual C++ development features installed
• .NET 8 runtime

Sample Setup

In Visual Studio 2022:

1. Select the x64 solution platform.
2. Right-click the project and select Manage NuGet Packages
3. On the Browse tab, search for Microsoft.InformationProtection.File
4. Select version 1.18.124 (or latest 1.18.x), then click Install

Create a Microsoft Entra ID App Registration

Authentication against the Microsoft Entra ID tenant requires creating a native application registration. The client ID created in this step is used in a later step to generate an OAuth2 token.

Skip this step if you've already created a registration for previous sample. You may continue to use that client ID.

1. Sign in to the Microsoft Entra admin center as at least an Application Developer.

   If app registration is restricted in your tenant, a custom role can also grant the required microsoft.directory/applications/createAsOwner or microsoft.directory/applications/create permission. See Custom role permissions for app registration for details.

2. Select Entra ID, then App registrations on the left side menu.
3. Select New registration
4. For name, enter MipSdk-Sample-Apps
5. Under Supported account types set Accounts in this organizational directory only

   Optionally, set this to Accounts in any organizational directory.

6. Select Register

The Application registration screen should now be displaying your new application.

Add API Permissions

1. Select API Permissions
2. Select Add a permission
3. Select Azure Rights Management Services
4. Select Delegated permissions
5. Check user_impersonation and select Add permissions at the bottom of the screen.
6. Select Add a permission
7. Select APIs my organization uses
8. In the search box, type Microsoft Information Protection Sync Service then select the service.
9. Select Delegated permissions
10. Check UnifiedPolicy.User.Read then select Add permissions
11. In the API permissions menu, select Grant admin consent for and confirm.

Set Redirect URI

1. Select Authentication.
2. Select Add a platform.
3. Select Mobile and desktop applications
4. Add the default native client redirect URI http://localhost.
5. Under Settings set Allow public client flows to Enabled.
6. Click Save.

Update Client ID and Username

1. Open up main.cpp.
2. Replace YOUR CLIENT ID with the client ID copied from the app registration.
3. Replace YOUR USER UPN with a test user identifier. This value is used as the engine identity and as an MSAL login hint.

Run the Sample

Press F5 to run the sample. The console application will start and after a brief moment displays the labels available for the user.

• Copy a label ID to the clipboard.
• Paste the label in to the input prompt.
• Next, the app asks for a path to a file. Enter the path to an Office document or PDF file.
• Finally, the app will display the name of the applied label.
• Attempt to open the file in a viewer that supports labeling or protection (Office or Adobe Reader)

Authentication runs in-process through the framework-dependent MipAuth.Managed .NET 8 component. The native executable hosts .NET once through the official nethost/hostfxr APIs. MSAL first checks its in-process account cache for an account matching the configured username, then opens the system browser when interactive authentication is required. Claims challenges from the MIP SDK are forwarded to both silent and interactive acquisition.

The auth delegate passes authority/resource/claims values through from the MIP SDK OAuth challenge instead of hard-coding endpoints. The managed component normalizes the resource into a /.default MSAL scope and uses MSAL silent acquisition first, then interactive browser sign-in when needed.

Troubleshooting

If authentication fails, ensure that:

• the .NET 8 runtime is installed.
• MipAuth.Managed.dll, its .deps.json/.runtimeconfig.json, managed dependencies, and nethost.dll are beside the native executable. The solution build copies these files automatically.
• the app registration is configured as a public client with the native redirect URI shown above.

Resources

• Microsoft Information Protection Docs