Arctera Data Insight Administrator's Guide

To create and assign the View-Only Audit Logs role to a non-Global admin user

1. Login to Microsoft Admin Portal with the Minimum privilege user role, navigate to Exchange Admin Center and click Classic Exchange Admin Center in the left pane.
   
2. Click Permissions > Admin roles and click the + icon to create a new role.

   The Role Group pop-up opens.

3. In the Role Group pop-up, enter a desired role name (ex. AuditReadRole).
4. In the Roles section, click + and select the role "View-Only Audit Logs" and click OK.
   
5. In the Members section, click + and select the member that you want to assign the minimum privilege role.
   
6. After selecting the member, click OK and then click Save.

To create and register an application with Microsoft

1. Login as a global admin user or minimum privilege user to https://portal.azure.com/#home and search App Registrations.
2. On the Register an application page, enter a desired name for the app.
3. In Supported account types select Accounts in this organizational directory only (<organization-name> only - Single tenant)
4. On the Register an application page, click Register to register the app. (Redirect URI can be provided later.)

   Your new application is created and the app Overview page is displayed.

5. Copy-save the Application (Client ID) and Directory (Tenant) ID. You will be required to provide it later while adding an account in Data Insight.
6. Copy-save the . You will be required to provide it later while adding an account in Data Insight.
7. On the left sidebar of your app dashboard, click Certificates and Secrets.
8. In the Client secrets section, click New client secrets to generate the access token required for calling the required APIs
9. Set the expiry to Never and click Add.
10. Copy the Client Secret Value is generated. You will be required to provide it later while adding an account in Data Insight.
11. Then you need to grant permissions to the app to use the Microsoft Graph and Office 365 APIs.

    On the left sidebar of your app, click API permissions, and then click Add a permission.

12. On the Request API permissions panel that opens, select Microsoft Graph and Office 365 respectively, click Application permissions and grant the permissions as per the table given below:

    API	Permission name
    Microsoft Graph	Files.Read.All
    	Group.Read.All
    	RoleManagement.Read.Directory
    	Sites.Read.All
    	User.Read.All
    Office 365 Management APIs	ActivityFeed.Read
    	ActivityFeed.ReadDlp
    SharePoint	Sites.FullControl.All

    Note:

    As per Microsoft guidelines, while using minimum permissions application, few advanced permissions like limited access permissions given to Limited Access System Group for the folder, permissions of sites, Site collections, Document Library will not be visible. To fetch those permission, add Sites.FullControl.All scope to MS Application

13. Then click Grant admin consent for.., and confirm.
14. Now add the redirect URI.

    Go to the Overview page of the app and click Add redirect URI. The Authentication page opens

15. Click Add a platform
16. On the Configure platforms panel that opens, click Web
17. Provide the Data Insight Management Server IP address, as a redirect URI in the following format: https://datainsight.us3.archive.veritas.com/api/DirectoryServices/azureADRedirect

    For more details, refer https://docs.microsoft.com/en-us/azure/active-directory/develop/reply-url.

    You can authenticate using FQDN in the redirect URL by setting node Level property.

    To set the node Level property,

    • Navigate to Settings > Servers and click the configured Management Server and then click Advance Settings tab.

    • In the Advance Settings tab, clickSet custom properties

    • In the Property Name box, add node.azure.ad.auth.via.fqdn

    • In the Property Value box, add true

    • Click Save and Close.

      Note:

      Property value should be set to true for authenticating via FQDN and false for authenticating via IP.

    If you want to modified any existing property value,

    • change the redirect URI in the Azure App accordingly.

    • Delete the cookie from <DATA_DIR>\connectors\sponline\cookie\dataStore on the collector node.

    • Re-authorize the application.

18. Click Configure to save it.
19. On the same page, set theSupported account types to Accounts in any organizational directory (Any Azure AD directory - Multitenant).