How to perform sizing for Alta SaaS Protection

Description

ASP Sizing tool is a PowerShell script that connects to supported cloud services and collects the usage data for various workloads. The size of the data calculated by the script aligns with the data backed up by Veritas Alta SaaS Protection (ASP).  At the end of the script, all collected information is exported to a CSV file.
 
Sizing tool currently supports sizing of the following two cloud services.

• Microsoft 365 (Exchange Online, SharePoint Online, OneDrive, Teams Chat)
• Google Workspace (Gmail, Google Drive)

 
To download the latest version of this script, click HERE. 

Microsoft 365 Sizing

Pre-requisites

The system running this script should have the following PowerShell modules installed. If any unsupported version of any PowerShell module is found on the system, the environment check will fail. Users must make sure that the installed modules align with the requirements.

To get the installed modules with all versions, run the following PowerShell command.

PS> Get-InstalledModule -Name <module> -AllVersions

To check the latest version of the script, the system running the script should have access to the script download location.

Authentication Modes: 

This script uses the following two modes of authentication:

1. Login with admin user credentials (UserLogin)
   • Multi-factor authentication should be disabled for the user logged in to the script. If MFA is enabled for the user, then non-interactive authentication for M365 fails. In this case, the Exchange connection script will prompt for interactive login, but the SharePoint data collection might fail.
   • This mode will require user credentials with admin access to connect to Exchange Online and SharePoint Online. If authentication fails, the script will use interactive login.
2. Azure AD app-only authentication (Application created by script)
   • User logged into the script should have global admin access to create an Application Registration. An Azure AD application will be created with the following permissions. Admin consent should be granted manually to this app.
   • Following permissions are required for reading storage usage reports.
     • Microsoft Graph > Reports.Read.All (Application)
     • Microsoft Graph > User.Read.All (Application)
   • Following permissions are required for reading SharePoint Online site storage usage. (See reference)
     • SharePoint > Sites.FullControl.All (Application)
     • SharePoint > User.Read.All (Application)
   • Following permissions are required for reading mailbox usage.
     • Office 365 Exchange Online > Exchange.ManageAsApp (Application)
     • Application should be assigned the Exchange Administrator role.
3. Azure AD app-only authentication (Application created by user)
   • To use Exchange Online PowerShell with application authentication, the application should use certificate-based authentication. (See reference)
   • Create an application with permissions mentioned in Application authentication mode. 
   • Create a new self-signed certificate using the following command. 
     New-SelfSignedCertificate -CertStoreLocation "cert:\CurrentUser\My" -Subject "CN=ASPSizingTool" -KeySpec Signature -KeyExportPolicy Exportable
   • Note down the THUMBPRINT created for the certificate. 
   • Upload this certificate to your already created application.(See reference)
   • If you already have the certificate file (.cer) created for the application, then install the certificate on the computer where you're running the script in the user certificate store (cert:\CurrentUser\My)
      

Steps to run the script:

1. Run PowerShell as an administrator.
2. Disable PowerShell QuickEdit Mode. Right click on PowerShell windows title and select Properties. Uncheck QuickEdit Mode checkbox.
   
3. Start the script from the PowerShell console.
4. If the script being run is not the latest version, then it will prompt you to download the latest version. Select "Yes" to download the latest version.
5. Run the latest version of the script from the path mentioned on the screen. 
   
6. Select M365 to start sizing for M365 services.
7. Select M365 services for which you need a usage report.
8. When prompted, enter the SharePoint Online admin URL. Usually, it is in the following format:
   https://<tenant>-admin.sharepoint.com
9. Choose the option to limit the scope of Exchange Online and OneDrive to users that are part of a specific AD group. 
10. If the AD group option is selected in the above step, then on the next prompt provide the display name of the AD group. For multiple AD groups, enter the group display names separated by comma. 
11. Select authentication mode. (Check Authentication section above for details.)
12. As per selected options, the environment check will run and notify if the system meets the requirements.
13. For Application authentication, an app will be created. This app should be given admin consent. (See reference)
14. For Exchange Online statistics, the app will require an Exchange Administrator role assigned in Azure AD. (See reference) 
15. If you have selected the ‘UserLogin’ authentication mode, the login window to connect to Microsoft Graph will open. Login here with admin credentials.
16. If you have selected the ‘Application’ authentication mode, the script will use the application credentials created in step above for connecting to Microsoft Graph.
17. If you have selected the 'CustomApp' authentication mode, then the script will prompt for tenant id, organization name, application id and thumbprint of the certificate.
18. The report will be exported in CSV format at the same location where the script is run. The CSV file is generated in the following format:
    ASP-Sizing-YYYYMMDD-HHMMSS.csv
19. The script will disconnect all the sessions created while collecting usage data.
20. An information message will appear on the screen mentioning that the usage data collection is completed, and application registration is created while running the script which can be safely removed.

Logs:

The logs are created at the same location where the script is running from. Logs are created in the format: ASP-Sizing-Tool-YYYYMMDD-HHMMSS.log. 

Important Notes:

For Exchange Online, the total number of mailboxes, item count, and total size includes:

• User mailboxes
• Archive mailboxes
• Shared mailboxes
• Soft-Deleted Mailboxes (soft-deleted mailboxes where IsInactiveMailbox property is set to True.)
• Group mailboxes
• Public folder mailboxes
• Other mailboxes. Such as room mailboxes and equipment mailboxes etc.

For the AD Group option, the script supports the following group types as input.

• M365 groups
• Distribution Lists
• Security groups

For OneDrive, the total number of OneDrive sites and total size includes:

• All personal sites for active users.
• Sites not associated with a licensed user account. (Stale sites)

The final output in the CSV includes combined data size. For individual numbers for different items, please refer to the logs created at the script location which are s running from. 

Output:

This tool creates output in CSV format. The following table shows the sample output of this tool.

Exchange Online

By default, Alta SaaS Protection backs up the following types of mailboxes: 

• User Active Mailboxes
• Group Active Mailboxes
• Public Folders

Optionally, Alta SaaS Protection also supports backup of: 

• Recoverable Items
• Soft Deleted Mailboxes
• Archive Mailboxes

There are two rows for Exchange Online total output. 

• Total Mailboxes with Default Options Only - This row contains statistics with only default options. i.e., User Active Mailboxes, Group Active Mailboxes and Public Folders.
• Total Mailboxes with All Options Enabled - This row contains statistics with all options, including the options which are not enabled by default, i.e., Recoverable Items, Soft-Deleted Mailboxes and Archive Mailboxes.

Each row in Exchange Online output represents a type of mailbox.

• Item Count and Item Size columns represent items from all the folders in the mailbox.
• Recoverable Item Count and Recoverable Item Size columns represent soft-deleted items.
• Total Item Count column contains the total of Item Count and Recoverable Item Count
• Total Item Size column contains the total of Item Size and Recoverable Item Size
• Effective Size in ASP for Exchange Online is the size required to store the data once it is backed up using Alta SaaS Protection. A multiplication factor of 1.29495 is used to calculate the effective size in ASP for Exchange Online.
• Growth rate is calculated separately using graph APIs by getting Exchange usage statistics over the last 180 days. This only includes the user mailboxes.

SharePoint Online & OneDrive for Business

• Total Site in SharePoint Online output is the total of SharePoint Sites and Team Sites.
• Effective Size in ASP for SharePoint Online and OneDrive is the same as the actual total size.
• Growth rate is calculated separately using graph APIs by getting Site/OneDrive usage statistics over the last 180 days.

Teams chat

• Estimated Metered Units for User Chats is directly proportional to number of messages sent by all users in private chat (one-on-one or group chats) in last 180 days.
• Estimated Metered Units for Teams Channel Conversations is directly proportional to the number of messages/posts/replies sent by all users in team channels in last 180 days.
• Total Estimated Metered Units (Last 180 Days) is total of user private chats units and teams conversation units in last 180 days. 
• Total Estimated Metered units (last 180 Days + Next 1 Year) is estimated units proportional to the number of messages sent by all users in last 180 days and next 365 days.

M365 Overall Statistics

• Licensed Users row represents the number of licensed users in the M365 tenant.
• Total Size row represents the total data size in the M365 tenant for Exchange Online, SharePoint Online, and OneDrive workloads. 

Google Workspace Sizing

Authentication Mode:

The sizing tool uses OAuth 2.0 client credentials for authentication with Google services. Please refer to the pre-requisites section for configuration of OAuth 2.0 client credentials for your Google service.

Pre-requisites:

1. Go to the Google developer console dashboard. 
2. Select an existing project from dropdown or create a new project. 
3. On the dashboard, click Enable APIs and Services.
4. In search, select and enable Admin SDK API and Google Drive API.
5. On the dashboard, click the OAuth consent screen tab.
6. If asked to select a User Type, select External, then click Create.
7. Enter the name of your application in the App name (e.g., SizingApp)
8. Enter the Google email address. Click Save and Continue.
9. Click Add or Remove Scopes, select the following scopes, and then click Update. 
   • ../auth/admin.reports.usage.readonly
   • ../auth/drive
   • ../auth/drive.readonly
10. Click Save and Continue.
11. Click Add Users, enter your Google email address, and click Add. Click Save and Continue.
12. On the dashboard, click the Credentials tab and click on Create Credentials. Select OAuth Client ID as credential type from dropdown.
13. On the Create OAuth client ID page, select from the dropdown Application type as Desktop App.
14. Enter the name of the application (e.g., SizingAppCredentials).
15. Note down the Client ID and Client secret for the created application.

Steps to run the script:

1. Run PowerShell as an administrator.
2. Disable PowerShell QuickEdit Mode. Right click on PowerShell windows title and select Properties. Uncheck QuickEdit Mode checkbox.
3. Start the script from PowerShell console.
4. Select Google to start sizing for Google services.
5. When prompted, enter the Client ID and Client secret created with the steps mentioned in the pre-requisite section.
6. An internet browser window will open. Login with your Google credentials which has valid access. 
7. On the next page, allow access to scopes required for the sizing tool. 
8. On the next page, copy the generated Authorization Code.
9. Go back to the script and enter the copied authorization code in the script. 
10. The script will continue from here and collect the information from Google services. 
11. The report will be exported in CSV format at the same location where the script is run. The CSV file is generated in the following format: ASP-Sizing-YYYYMMDD-HHMMSS.csv

Logs:

The logs are created at the same location where the script is running from. Logs are created in the format: ASP-Sizing-Tool-YYYYMMDD-HHMMSS.log. 

Important Notes:

While collecting the information from Google services, some report APIs might fail. These failures are because of the unavailability of Google reports for the latest dates. The sizing tool will check the availability of reports for previous dates and fetch the latest available report.

Output:

This tool creates output in CSV format. The following is the sample output of this tool.

Drive and Shared Drive

• The Drive row represents a number of users using the Google Drive service.
• The Shared Drive row represents a number of shared drives in the Google account.
• Total Item Size column contains the size of all drives. 
• Effective Size in ASP for user drives and shared drives is the same as the actual size.

Gmail

• The Gmail row represents the number of users using Gmail. 
• Effective Size in ASP for Gmail is the size required to store the data once it is backed up using Alta SaaS Protection. A multiplication factor of 3 is used to calculate the effective size in ASP for Gmail.

Total Customer Usage

• Report Date is the latest date on which Google report is available.
• Total Item Size and Effective Size in ASP is total of Drive, Gmail and Shared Drive workloads.
• Growth rate is calculated by comparing the usage report from 180 days before.