Search <book_title>...

Veritas Data Insight Administrator's Guide

Last Published: 2020-07-14

Product(s): Data Insight (6.1.5)

About configuring OneDrive monitoring

Data Insight monitors Microsoft OneDrive cloud accounts to provide information about who owns the data, who is performing activity on the data, and what data should it be archived or deleted. OneDrive uses the Open Authorization 2 (OAuth2) protocol to permit access to a third-party application.

Data Insight scans the OneDrive account for metadata such as path of the file or folder, created by, modified by, modified date, and also fetches audit events for the OneDrive user accounts. Note that Data Insight does not fetch permissions for OneDrive accounts.

In the Data Insight configuration, the OneDrive tenant account (your organization's OneDrive account) corresponds to a file server and the individual user accounts correspond to shares on a filer. To scan the OneDrive tenant account and the underlying user accounts, Data Insight uses the access token provided by the OneDrive app. To get the access token from the app, you must provide the credentials of an Office 365 global administrator privileges on the redirect URL page.

Prerequisites for configuring OneDrive account monitoring

Before you configure OneDrive monitoring in Data Insight, complete the following prerequisites:

Table:

Prerequisite	How to
Create an app and register it with Microsoft to enable communication between Data Insight and the OneDrive account.	See Registering Data Insight with Microsoft to enable OneDrive account monitoring.
Create credentials in Office 365 Admin Center that Data Insight uses to monitor access events on the OneDrive accounts.	Do the following: Log in to Microsoft Office365 Admin Center using global Administrator credentials. Navigate to Office365 > Admin Center > Users. Create a new user with role SharePoint Administrator.
Enable auditing in Office 365 Admin Center.	In the Office 365 Admin Center, navigate to Security and Compliance >Search and investigation > Audit log search. On left-hand panel of the Security & Compliance wizard, expand Search & Investigation, and click Start recording user and admin activities. Clicking on this link will start recording user and admin activities. Note that it takes 24 hours for the audit logs to start appearing on the Audit log search page. For more information, see https://support.office.com/en-us/article/Turn-off-audit-log-search-in-Office-365.
Create a role with View-only audit log privilege. These user credentials are used by Data Insight to collect OneDrive audit logs.	Do the following: In the Office 365 Admin Center, navigate to Security and Compliance > Permissions > Add role. Note: Only an Office 365 Global administrator can log in to the Security and Compliance view. Provide View-Only Audit Logs privilege to the role, and add the user with the SharePoint administrator role to newly-created role. In the Office 365 Admin Center, navigate to Exchange > Permissions > Add admin role. Ensure that you use the same user credentials with role as SharePoint administrator.
Grant permissions to Data Insight to scan a user's OneDrive account.	See Configuring user impersonation in Office 365.
The DataInsightOneDrive service is configured and running on the Collector node. This service is responsible for collecting metadata the audit events for OneDrive accounts.	See Configuring Data Insight services.
If your organization requires internet connections to pass through a proxy server, edit the `proxy_server.properties` file to update the proxy settings.	Do the following: The `proxy_server.properties` file contains the proxy settings to connect to your OneDrive account. It is located in the `<InstallDir>\connectors\onedrive` folder. Open the properties file in a text editor, and edit the following details: Username or domain\username Proxy password Hostname or IP address of the proxy server Port of the proxy server
Configure the proxy server in your LAN settings.	In the Windows Control Panel, click Internet Options > Connections > Local Area Network (LAN) Settings. Select Use a proxy server for your LAN and enter the IP of your proxy server. Run the following command to verify if the proxy settings have already been configured: netsh winhttp show proxy If a proxy server is not configured, you must import the settings. To import the proxy settings from Internet Explorer (IE), run the following command: netsh winhttp import proxy source=ie
Ensure that the following URLs are allowed by your organization's proxy server and firewall settings: https://graph.microsoft.com/ https://login.microsoftonline.com https://outlook.office365.com	-
Ensure that the incoming and outgoing traffic is routed through a single IP and port. Usually systems with multiple NICs have mismatch in incoming and outgoing IP/Port used. This is important because the login request response from Microsoft has to be routed through the IP/Port configured in the redirect URL. In this scenario, Data Insight will not be able to fetch any audit data.	Review the commd, sponline, and onedrive logs in the `<InstallDir>/logs` folder to troubleshoot the issue.

Limitations for OneDrive monitoring in Data Insight

The following Data Insight limitations apply when monitoring OneDrive accounts:

The ability to add OneDrive tenant accounts and user accounts in bulk using CSV is not supported.
Data Insight does not fetch permissions for OneDrive accounts. The Workspace > Expand Profile > Permissions tab will be disabled for OneDrive paths (share equivalent and folders).
For this reason, you will also not be able to select configured OneDrive paths when creating Permissions reports and Entitlement Review workflows.
Scan and audit exclude rules are not supported.
Scan errors are not reported on the Scanning dashboard for OneDrive scan failures. However, the onedrive_connector_service and commd logs will contain information about these errors and exceptions.
You cannot create Data Loss Prevention (DLP) Incident Remediation workflows and the Records Classification workflows for OneDrive paths.
Archive and classify actions for OneDrive paths are not supported.
The pause window in the scan schedule does not apply when scanning cloud data sources. On the Settings > Scan Status page, the ability to pause or cancel an in-progress scan job is not available.
Certain audit events such as folder create, folder modified, and folder copies are not fetched for OneDrive accounts. This limitation is observed because Microsoft Office 365 does not support these event types.
Audit of OneDrive accounts is not supported on Microsoft 2016 because the Powershell version supported by Data Insight is not compatible with the version supported by Microsoft 2016.