Search <book_title>...

Veritas Data Insight 6.1 Administrator's Guide

Last Published: 2017-09-03

Product(s): Data Insight (6.1)

About configuring OneDrive monitoring

Data Insight monitors Microsoft OneDrive cloud accounts to provide information about who owns the data, who is performing activity on the data, and what data should it be archived or deleted. OneDrive uses the Open Authorization 2 (OAuth2) protocol to permit access to a third-party application.

Data Insight scans the OneDrive account for metadata such as path of the file or folder, created by, modified by, modified date, and also fetches audit events for the OneDrive user accounts. Note that Data Insight does not fetch permissions for OneDrive accounts.

In the Data Insight configuration, the OneDrive tenant account (your organization's OneDrive account) corresponds to a file server and the individual user accounts correspond to shares on a filer. To scan the OneDrive tenant account and the underlying user accounts, Data Insight uses the access token provided by the OneDrive app. To get the access token from the app, you must provide the credentials of an Office 365 global administrator privileges on the redirect URL page.

Prerequisites for configuring OneDrive account monitoring

Before you configure OneDrive monitoring in Data Insight, complete the following prerequisites:

Create an app and register it with Microsoft to enable communication between Data Insight and the OneDrive account.
See Registering Data Insight with Microsoft to enable OneDrive account monitoring.
Enable auditing in Office 365 Admin Center.
To enable auditing, in Office 365 Admin Center navigate to Security and Compliance > Search and investigation > Audit log search. Click Start recording user and admin activities.
Note that it takes 24 hours for the audit logs to start appearing on the Audit log search page.
Create a role with View-only audit log privilege. This user credentials are used by Data Insight to collect OneDrive audit logs.
Do the following:
- In the Office 365 Admin Center, navigate to Security and Compliance > Add role.
  Note:
  Only an Office 365 Global administrator can log in to the Security and Compliance view.
  Provide View-Only Audit Logs privilege to the role , and add the user with role SharePoint administrator role to newly-created role.
- In the Office 365 Admin Center, navigate to Exchange > Permissions > Add admin role.
  Ensure that you use the same user credentials with role as SharePoint administrator.
For more information, see https://support.office.com/en-us/article/Turn-off-audit-log-search-in-Office-365.
On the Windows Server, ensure that the execution policy is set to RemoteSigned. This permits running of PowerShell scripts for device discovery and audit data collection. To configure the policy, start Windows PowerShell as administrator, and run the following commands:
To view the configured execution policy:
Get-ExecutionP
olicy
To configure the execution policy to RemoteSigned:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine
The SharePoint Online Management PowerShell installer is installed on the machine with the role as Collector. You can download the installable from the following location:
https://www.microsoft.com/en-in/download/details.aspx?id=35588
The SharePoint Online Client Components SDK is installed on the Collector. You can download the installable from the following location:
https://www.microsoft.com/en-in/download/details.aspx?id=42038
The DataInsightOneDrive service is configured and running on the Collector node. This service is responsible for collecting metadata the audit events for OneDrive accounts.

Limitations for OneDrive monitoring in Data Insight

The following Data Insight limitations apply when monitoring OneDrive accounts:

The ability to add OneDrive tenant accounts and user accounts in bulk using CSV is not supported.
Data Insight does not fetch permissions for OneDrive accounts. The Workspace > Expand Profile > Permissions tab will be disabled for OneDrive paths (share equivalent and folders).
For this reason, you will also not be able to select configured OneDrive paths when creating Permissions reports and Entitlement Review workflows.
Scan and audit exclude rules are not supported.
Scan errors are not reported on the Scanning dashboard for OneDrive scan failures. However, the onedrive_connector_service and commd logs will contain information about these errors and exceptions.
You cannot create Data Loss Prevention (DLP) Incident Remediation workflows and the Records Classification workflows for OneDrive paths.
Archive and classify actions for OneDrive paths from the Workspace and Reports tabs are not supported.
The pause window in the scan schedule does not apply when scanning cloud data sources. On the Settings > Scan Status page, the ability to pause or cancel an in-progress scan job is not available.
Certain audit events such as folder create, folder modified, and folder copies are not fetched for OneDrive accounts. This limitation is observed because Microsoft Office 365 does not support these event types.