Veritas Data Insight Administrator's Guide

To create and assign the View-Only Audit Logs role to a non-Global admin user

1. Login to Microsoft Admin Portal with the Global Administrator role, navigate to Exchange Admin Center and click Classic Exchange Admin Center in the left pane.
   
2. Click Permissions > Admin roles and click the + icon to create a new role.

   The Role Group pop-up opens.

3. In the Role Group pop-up, enter a desired role name (ex. AuditReadRole).
4. In the Roles section, click + and select the role "View-Only Audit Logs" and click OK.
   
5. In the Members section, click + and select the member that you want to assign the minimum privilege role.
   
6. After selecting the member, click OK and then click Save.

To create and register an application with Microsoft

1. Login as a global admin user or minimum privilege user to https://portal.azure.com/#home and click App Registrations.
2. On the Register an application page, enter a desired name for the app.
3. In Supported account types select Accounts in any organizational directory (Any Azure AD directory - Multitenant)
4. Then go to the Azure Active Directory > Properties for the tenant.
5. Set Access management for Azure resources to No, and click Save at the top of the page.
6. On the Register an application page, click Register to register the app. (Redirect URI can be provided later.)

   Your new application is created and the app Overview page is displayed.

7. Copy-save the Application (Client ID). You will be required to provide it later while adding a SharePoint Online account in Data Insight.
8. On the left sidebar of your app dashboard, click Certificates and Secrets.
9. In the Client secrets section, click New client secrets to generate the access token required for calling the required APIs
10. Set the expiry to Never and click Add.
11. Copy the Client Secret that is generated. You will be required to provide it later while adding a SharePoint Online account in Data Insight.
12. Then you need to grant permissions to the app to use the Microsoft Graph and Office 365 APIs.

    On the left sidebar of your app, click API permissions, and then click Add a permission.

13. On the Request API permissions panel that opens, select Microsoft Graph and Office 365 respectively, click Delegated permissions and grant the following permissions at the minimum:
    

    Note:

    As per Microsoft guidelines, while using minimum permissions application, few advanced permissions like limited access permissions given to Limited Access System Group for the folder, permissions of sites, Site collections, Document Library will not be visible. To fetch those permission, add Sites.FullControl.All scope to MS Application

14. Then click Grant admin consent for.., and confirm.
15. Now add the redirect URI.

    Go to the Overview page of the app and click Add redirect URI. The Authentication page opens

16. Click Add a platform
17. On the Configure platforms panel that opens, click Web
18. Provide the Data Insight Management Server IP address, as a redirect URI in the following format: https://<Management Server IP address>/spOnline

    Refer to https://docs.microsoft.com/en-us/azure/active-directory/develop/reply-url.

19. Click Configure to save it.
20. On the same page, set theSupported account types to Accounts in any organizational directory (Any Azure AD directory - Multitenant).