Search <book_title>...

Arctera Data Insight Administrator's Guide

Last Published: 2025-01-21

Product(s): Data Insight (7.1)

Platform: Windows

Section I. Getting started
1. Introduction to Arctera Data Insight administration
  1. About Arctera Data Insight administration
    1. Operation icons on the Management Console
    2. Data Insight administration tasks
2. Configuring Data Insight global settings
Section II. Configuring Data Insight
Section III. Configuring native file systems in Data Insight
Section IV. Configuring SharePoint data sources
1. Configuring monitoring of SharePoint web applications
2. Configuring monitoring of SharePoint Online accounts
Section V. Configuring cloud data sources
Section VI. Configuring Object Storage Sources
1. Amazon S3
Section VII. Health and monitoring
1. Using Arctera Data Insight dashboards
2. Monitoring Data Insight
Section VIII. Alerts and policies
1. Configuring policies
Section IX. Remediation
1. Configuring remediation settings
Section X. Reference

About configuring OneDrive monitoring

Data Insight monitors Microsoft OneDrive cloud accounts to provide information about who owns the data, who is performing activity on the data, and what data should it be archived or deleted. OneDrive uses the Open Authorization 2 (OAuth2) protocol to permit access to a third-party application.

Data Insight scans the OneDrive account for metadata such as path of the file or folder, created by, modified by, modified date, and also fetches audit events for the OneDrive user accounts.

In the Data Insight configuration, the OneDrive tenant account (your organization's OneDrive account) corresponds to a file server and the individual user accounts correspond to shares on a filer. To scan the OneDrive tenant account and the underlying user accounts, Data Insight uses the access token provided by the Microsoft app. To get the access token from the app, you must provide the credentials of an Office 365 Minimum Privilege user on the redirect URL page.

Prerequisites for configuring OneDrive account monitoring

Before you configure OneDrive monitoring in Data Insight, complete the following prerequisites:

Table:

Prerequisite	How to
Network connectivity	Ensure you have sufficient network connectivity for configuration, especially on Management Server, which is required for authorization.
Create an app and register it with Microsoft to enable communication between Data Insight and the OneDrive account.
Create credentials in Office 365 Admin Center that Data Insight uses to monitor access events on the OneDrive accounts.	Do the following: Log in to Microsoft Office365 Admin Center using global Administrator credentials. Navigate to Office365 > Admin Center > Users. Create a new user with the following four roles to configure the account: Application Administrator : To create a Microsoft application User Administrator: To get the access to OneDrive account of all the users in tenant SharePoint Administrator: To fetch the data in OneDrive and SharePoint Online A custom role (View-Only Audit Logs) in the Exchange Admin Center
Enable auditing in Office 365 Admin Center.	In the Office 365 Admin Center, navigate to Security and Compliance >Search and investigation > Audit log search. On left-hand panel of the Security & Compliance wizard, expand Search & Investigation, and click Start recording user and admin activities. Clicking on this link will start recording user and admin activities. Note that it takes 24 hours for the audit logs to start appearing on the Audit log search page. For more information, see https://support.office.com/en-us/article/Turn-off-audit-log-search-in-Office-365.
Create a role with View-only audit log privilege. These user credentials are used by Data Insight to collect OneDrive audit logs.	Do the following: In the Office 365 Admin Center, navigate to Security and Compliance > Permissions > Add role. Note: Only an Office 365 Global administrator can log in to the Security and Compliance view. Provide View-Only Audit Logs privilege to the role, and add the user with the SharePoint administrator role to newly-created role. In the Office 365 Admin Center, navigate to Exchange > Permissions > Add admin role. Ensure that you use the same user credentials with role as SharePoint administrator.
Grant permissions to Data Insight to scan a user's OneDrive account.
The DataInsightOneDrive service is configured and running on the Collector node. This service is responsible for collecting metadata the audit events for OneDrive accounts.	See Configuring Data Insight services.
If your organization requires internet connections to pass through a proxy server, edit the `proxy_server.properties` file to update the proxy settings.	Do the following: The `proxy_server.properties` file contains the proxy settings to connect to your OneDrive account. It is located in the `<InstallDir>\connectors\onedrive` folder. Open the properties file in a text editor, and edit the following details: Username or domain\username Proxy password Hostname or IP address of the proxy server Port of the proxy server Note: Password should always be encrypted using the Data Insight Hash Utility. For more information about encrypting password, See Data Insight Hash Utility. After completing the steps, add the following properties and restart the DataInsightOneDrive service. APP_CONFIG_PROXY_HOST= <Hostname/ip of the proxy> APP_CONFIG_PROXY_PORT=<Port of the proxy> APP_CONFIG_PROXY_SCHEME=<Schema = http> APP_CONFIG_PROXY_AUTH_TYPE=<proxy credentials are NTLM/Basic/empty> APP_CONFIG_PROXY_PASSWORD= <Proxy credentials: Password> APP_CONFIG_PROXY_USER= <Proxy credentials: User name >
Configure the proxy server in your LAN settings.	In the Windows Control Panel, click Internet Options > Connections > Local Area Network (LAN) Settings. Select Use a proxy server for your LAN and enter the IP of your proxy server. Run the following command to verify if the proxy settings have already been configured: netsh winhttp show proxy If a proxy server is not configured, you must import the settings. To import the proxy settings from Internet Explorer (IE), run the following command: netsh winhttp import proxy source=ie
Ensure that the following URLs are allowed by your organization's proxy server and firewall settings:	https://login.microsoftonline.com/ https://graph.microsoft.com/ https://manage.office.com/ https://outlook.office365.com https://<domain>-my.sharepoint.com https://<domain>.sharepoint.com
Ensure that the incoming and outgoing traffic is routed through a single IP and port. Usually systems with multiple NICs have mismatch in incoming and outgoing IP/Port used. This is important because the login request response from Microsoft has to be routed through the IP/Port configured in the redirect URL. In this scenario, Data Insight will not be able to fetch any audit data.

Limitations for OneDrive monitoring in Data Insight

The following Data Insight limitations apply when monitoring OneDrive accounts:

The ability to add OneDrive tenant accounts and user accounts in bulk using CSV is not supported.
Audit exclude rules are not supported.
Scan errors are not reported on the Scanning dashboard for OneDrive scan failures. However, the onedrive_connector_service and commd logs will contain information about these errors and exceptions.
You cannot create Data Loss Prevention (DLP) Incident Remediation workflows and the Records Classification workflows for OneDrive paths.
On the Settings > Scan Status page, ability to pause or cancel an in-progress scan job is not available. The jobs that are in the queues can be paused or canceled.
Certain audit events such as folder create, folder modified, and folder copies are not fetched for OneDrive accounts. This limitation is observed because Microsoft Office 365 does not support these event types.
Move Audit events are not supported.

More Information

Add/Edit OneDrive account

Add/edit OneDrive user accounts