Search <book_title>...

Veritas Data Insight Administrator's Guide

Last Published: 2023-09-04

Product(s): Data Insight (6.6)

Platform: Windows

Section I. Getting started
1. Introduction to Veritas Data Insight administration
  1. About Veritas Data Insight administration
    1. Operation icons on the Management Console
    2. Data Insight administration tasks
2. Configuring Data Insight global settings
Section II. Configuring Data Insight
Section III. Configuring native file systems in Data Insight
Section IV. Configuring SharePoint data sources
1. Configuring monitoring of SharePoint web applications
2. Configuring monitoring of SharePoint Online accounts
Section V. Configuring cloud data sources
Section VI. Configuring Object Storage Sources
1. Amazon S3
Section VII. Health and monitoring
1. Using Veritas Data Insight dashboards
2. Monitoring Data Insight
Section VIII. Alerts and policies
1. Configuring policies
Section IX. Remediation
1. Configuring remediation settings
Section X. Reference

Configuring application without user impersonation for Office 365

Setting DisableCustomAppAuthentication property for the tenant

To set the property DisableCustomAppAuthentication,

Install Module Pnp.Powershell using command in PowerShell Install-Module -Name PnP.PowerShell
Run the command Register-PnPManagementShellAccess and provide credentials of Global Administrator Account
Note:
This step is done to provide PnP PowerShell Authentication with Service Principal. If we do not do this then we will get error : Connect-PnPOnline : AADSTS65001: The user or administrator has not consented to use the application with ID'31359c7f-bd7e-475c-86db-fdb8c937548e' named 'PnP Management Shell'. Send an interactive authorization request for this user and resource
Copy the following script in Notepad and save it as DisableCustomAppAuthentication.ps1 file.
```
param (
	[parameter(Mandatory=$true)]
    [string]$Organization)

Import-Module PnP.PowerShell
$url = 'https://'+$Organization+'-admin.sharepoint.com'
Write-Output $url
$userCredential = Get-Credential
Connect-PnPOnline -Url $url -Credential $userCredential
get-PnPTenant
Set-PnPTenant -DisableCustomAppAuthentication $false
```
Note:
Application permissions scope will be used instead of Delegated permissions scope for authentication and authorization. Custom app authentication is disabled by default.
If DisableCustomAppAuthentication is set to false, Custom app authentication is enabled.
Run the script using .\DisableCustomAppAuthentication.ps1
When prompted, provide organization name.
In the Windows Powershell Credential Request pop up, provide Global Administrator credentials and click Ok
In the list of output, verify if the CustomAppAuthentication property is set to False.

After configuring application, you need to add the created application to the lookup

To add created application to the lookup,

Copy the Client ID of the app created in the Azure portal App
Navigate to https://<organization-name>-admin.sharepoint.com/_layouts/15/appinv.aspx
Paste the Client ID copied from the Azure portal App in the App Id field
Click Lookup
Add localhost.com in the App Domain field
Add https://localhost.com/default.aspx in the Redirect URL field

Add following XML in the App's Permission Request XML

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest Scope="http://sharepoint/content/tenant"

Right="FullControl"/>

</AppPermissionRequests>

Click Create
Click Trust It

You will be redirected to the SharePoint admin center.

Configuring an administrator account for Data Insight

Data Insight uses a Global administrator account to discover the site collections and scan metadata and a SharePoint administrator account to fetch the access events from the configured SharePoint Online account. Global administrator accounts must have full control over the site collections that you want Data Insight to monitor. You must configure the Global administrator, as owner for team site collections, on the Office 365 interface and assign the administrative privileges for the target site collections.

Note:

Please procure Data Insight Plus Cloud Storage license to monitor cloud storage resources. Reach out to your contact in Veritas for procuring the same.

To add a SharePoint administrator

Log on to Office 365 using the Global admin credentials.
On the SharePoint admin center page, click Users > Active users > Add a user.
The New User pop-up windows opens.
Enter the name of the user and other properties as appropriate.
In the Roles section, select Customized administrator > SharePoint administrator.
Click Add.

The SharePoint administrator account collects metadata about site collection content , and gathers audit data from SQL Server databases for SharePoint when it is assigned administrative privileges for the target site collections. It must also have full control permissions on the configured site collections and the site collections that are incrementally included to the SharePoint account. For team site collections, the SharePoint administrator should be an owner.

The Minimum Privilege user has access to all features in the Admin center and can perform all tasks in the Office 365 Admin center.

To assign owners for team site collections

On the SharePoint admin center page, go to Groups > Groups, and select the Group Name to which you want to assign owners.
In the Group details pane on the right-hand-side, click Edit for the Owners entry.
In the Edit pane, click Add owner and select a user having Minimum Privilege user credentials.
Click Save.

Adding SharePoint Online accounts

Data Insight discovers and scans the data residing in the SharePoint Online accounts that are configured on the Management Console.

Note:

Data Insight disables addition of SharePoint Online accounts if you do not have a valid cloud license or if your license has expired. Also, Data Insight will not discover new accounts that have been added after the expiry of the license.

To add a SharePoint Online account

In the Console, click Settings > SharePoint Sources.
The SharePoint page displays the list of configured web applications and Online accounts.
Click Add SharePoint Source > SharePoint Online Account.
On the Add New SharePoint Online Account page, specify the URL of the account you want to add and enter the properties.
Click Save.

Note:

For verification of the permission for the newly added SharePoint account, wait till the account's next incremental or full scan, triggered after Local User Scan. By default, LocalUserScanJob runs at 12.30a.m every day on the Collector node. You can manually run the job by navigating to Settings >> Data Insight Servers >> Server >> Jobs >> Select LocalUserScanJob >> Actions >> Run

Add/Edit SharePoint Online account options

Use this dialog box to add a new SharePoint Online account to Veritas Data Insight or to edit the configuration of an existing account.

Table: Add/Edit SharePoint Online account options

Field	Description
SharePoint Online Account URL	Enter the URL of the SharePoint Online URL that you want Data Insight to monitor. For example, `https://myaccount.sharepoint.com`
Collector	Do the following: Click Select Collector. The Select Collector pop-up displays the configured Collectors that are available for selection. Review the performance parameters such as disk and CPU utilization and backlog of files accumulating on the configured nodes. It is recommended that you assign a node on which the resource utilization is low. Click Select to assign the Collector to the filer. Data Insight connects to the SharePoint server from the Collector node. It is recommended to choose the Collector worker node that is close in proximity to the SharePoint Online account server.
Indexer	Do the following: Click Select Indexer. The Select Indexer pop-up displays the configured indexers that are available for selection. Review the performance parameters such as disk and CPU utilization and backlog of files accumulating on the configured nodes. You can also view the number of devices, shares or site collections assigned to each configured node. It is recommended that you assign a node on which the resource utilization is low. Click Select to assign the Indexer to the filer. Events and metadata that are collected from the site collections are processed and stored on the Indexer node.
Client ID Client Secret Key Tenant ID	The client ID is the unique application ID assigned when you create and register an app with Microsoft. You can add up to 5 client IDs. Client Secret Key: In the SharePoint App, navigate to the Certificates & secrets page. There is a code in the Value column under the Client secret section. You need to use that code as a Client Secret Key while configuring a SharePoint account in Data Insight. Tenant ID: This is an unique ID assigned to an organization If you have missed copying the code, go back to the Certificates & secrets page in the SharePoint app and click + New client secret. Copy the code in the Value column and use it as a Client Secret Key in Data Insight. You can add up to 5 client secret keys. Follow the procedure described in the following topic to get these details: Note: Microsoft servers might briefly block certain client credentials for initiating frequent requests. In such scenarios, Data Insight fails to retrieve data from the Microsoft servers. To eliminate such delay, you can add up to 5 client credentials to the SharePoint Online account. If one client credential is blocked by Microsoft, another client credential will be used to fetch data. Add one client ID, Client Secret Key, authorize the app and click Add More Apps to add another set of client credentials.
Authorize access	Do the following: Click Authorize. This invokes the application authorized to access the SharePoint Online account. Note: Ensure that you use the credentials of a Office 365 user with Microsoft Global administrator role for authorizing Data Insight. This step creates an authorization token that is stored as a named credential in the Data Insight configuration. You will be redirected to the Data Insight console to complete the rest of the configuration. Data Insight can now access the user, folder and file metadata and the information about the activities performed on these files and folders. Note: After authorization, do not update the same set of client and secret key.
Automatically discover and add site collections in this SharePoint Online account	This check box is selected by default. This option allows you to automatically include all site collections in the selected SharePoint Online account for the purpose of monitoring. Clear the check box to add site collections manually. You can do this from the SharePoint Online account details page. Discovery of site collections takes place as soon as you add a SharePoint Online account and then twice each day at 2:00 A.M. and 2:00 P.M.
Exclude following site collections from discovery	Enter the details of the site collections which should not be included during discovery. This option is available when you select Automatically discover and add site collections in the added SharePoint Online Accounts. Specify comma separated patterns that you want to ignore. Patterns can have 0 or more wildcard * characters. For example, https://onlineaccount1/sites/test* ignores site collections https://onlineaccount1/sites/testsite1 and https://onlineaccount1/sites/testsite2.
Monitor SharePoint accesses to this SharePoint Online account	By default, Microsoft SharePoint Online Event Monitoring is enabled. If disabled, select this check box to enable event monitoring on the SharePoint Online account. You must manually enable auditing in the Office 365 Admin Center to enable Data Insight to collect audit logs for the SharePoint Online account.
Enable Scanning for this SharePoint Online account	Select the check box to enable SharePoint Online account scanning according to the specified schedule.
Scanning schedule (for full scans)	Select one of the following to define a scanning schedule for the SharePoint Online account: Use the Collector's scanning schedule. Define custom schedule. From the drop-down, select the appropriate frequency. Veritas Data Insight periodically scans site collections to obtain file metadata. Each Collector worker node by default initiates a full scan of the SharePoint device at 11:00 P.M. each night. Note: You can also customize the schedule for each site collection using the Add/Edit Site Collection dialog box.
Scan newly added site collections immediately	Select this option to scan newly added site collections immediately instead of waiting for the regular scan schedule. Scanning will still proceed only when scanning is permitted on the Collector node.
Fetch Microsoft Labels	Check the box if you want to fetch Azure Information Protection (AIP) and Microsoft Sensitive labels for this SharePoint Online account. AIP label is a functionality that enables organizations to classify documents and emails in Office 365.