Search <book_title>...

Veritas Data Insight Administrator's Guide

Last Published: 2022-01-28

Product(s): Data Insight (6.2)

Platform: Windows

Section I. Getting started
1. Introduction to Veritas Data Insight administration
  1. About Veritas Data Insight administration
    1. Operation icons on the Management Console
    2. Data Insight administration tasks
2. Configuring Data Insight global settings
Section II. Configuring Data Insight
Section III. Configuring native file systems in Data Insight
Section IV. Configuring SharePoint data sources
1. Configuring monitoring of SharePoint web applications
2. Configuring monitoring of SharePoint Online accounts
Section V. Configuring cloud data sources
Section VI. Configuring ECM data sources
1. Configuring Documentum data source
Section VII. Health and monitoring
1. Using Veritas Data Insight dashboards
2. Monitoring Data Insight
Section VIII. Alerts and policies
1. Configuring policies
Section IX. Remediation
1. Configuring remediation settings
Section X. Reference

Registering Data Insight with Microsoft to enable OneDrive account monitoring

To authorize Data Insight to access the Microsoft OneDrive account, you must create an application for every Data Insight installation and register it with Microsoft Azure Active Directory. This step involves associating a set of credentials with the application and providing the application with the required permissions, which enables communication between Data Insight and Microsoft. This step also creates an authorization token that is stored as a named credential in the Data Insight configuration.

Prerequisite

A Office 365 user with the Microsoft Global administrator role or with a role which has lesser admin privileges than the Global administrator can create and register an application with Microsoft. However, the user must be granted the following four roles at the minimum:

Application Administrator : To create a Microsoft application
User Administrator: To get the access to OneDrive account of all the users in tenant
SharePoint Administrator: To fetch the data in OneDrive and SharePoint Online
A custom role (View-Only Audit Logs) in the Exchange Admin Center

To assign the first three roles, refer to the Azure documentation.

To create and assign the View-Only Audit Logs role to a non-Global admin user

Login to Microsoft Admin Portal with the Global Administrator role, navigate to Exchange Admin Center and click Classic Exchange Admin Center in the left pane.
Click Permissions > Admin roles and click the + icon to create a new role.
The Role Group pop-up opens.
In the Role Group pop-up, enter a desired role name (ex. AuditReadRole).
In the Roles section, click + and select the role "View-Only Audit Logs" and click Save.
In the Members section, click + and select the member that you want to assign the minimum privilege role.
After selecting the member, click OK and then click Save.

To create and register an application with Microsoft

Login as a global admin user or minimum privilege user tohttps://portal.azure.com/#home and click App Registrations.
On the Register an application page, enter a desired name for the app.
In Supported account types select Accounts in any organizational directory (Any Azure AD directory - Multitenant)
Then go to the Azure Active Directory > Properties for the tenant.
Set Access management for Azure resources to No, and click Save at the top of the page.
On the Register an application page, click Register to register the app. (Redirect URI can be provided later.)
Your new application is created and the app Overview page is displayed.
Copy the Application (Client ID). You will be required to provide it later while adding a OneDrive account in Data Insight.
On the left sidebar of your app dashboard, click Certificates and Secrets.
In the Client secrets section, click New client secrets to generate the access token required for calling the required APIs
Set the expiry to Never and click Add.
Copy the Client Secret that is generated. You will be required to provide it later while adding a OneDrive account in Data Insight.
Then you need to grant permissions to the app to use the Microsoft Graph and Office 365 APIs.
On the left sidebar of your app, click API permissions, and then click Add a permission.
On the Request API permissions panel that opens, select Microsoft Graph and Office 365 respectively, click Delegated permissions and grant the following permissions at the minimum:
Then click Grant admin consent for.., and confirm.
Now add the redirect URI.
Go to the Overview page of the app and click Add redirect URI. The Authentication page opens
Click Add a platform
On the Configure platforms panel that opens, click Web
Provide the Data Insight Management Server IP address, as a redirect URI in the following format: https://<Management Server IP address>/oneDrive
Refer to https://docs.microsoft.com/en-us/azure/active-directory/develop/reply-url.
Click Configure to save it.
On the same page, set theSupported account types to Accounts in any organizational directory (Any Azure AD directory - Multitenant).

Once the app is created, anybody in the organization can access the app. As per Microsoft recommendation, restrict the access to specific users.

For information on how to require the user assignment for an app via the Azure portal, refer to Configure an application to require user assignment Azure documentation

For information on how to assign users or groups to an app via the Azure portal, refer to Assign users to an app Azure documentation

See About configuring OneDrive monitoring.