Search <book_title>...

Arctera Data Insight

Last Published: 2025-01-30

Product(s): Veritas Alta Data Insight (1.0)

Registering Data Insight with Microsoft to enable OneDrive account monitoring

To authorize Arctera Data Insight to access the Microsoft OneDrive account, you must create an application and register it with Microsoft Azure Active Directory. This step involves associating a set of credentials with the application and providing the application with the required permissions, which enables communication between Data Insight and Microsoft.

Prerequisite

An Office 365 user with the Microsoft Global administrator role or with a role which has lesser admin privileges than the Global administrator can create and register an application with Microsoft. However, the user must be granted the following four roles at the minimum:

Application Administrator : To create a Microsoft application
User Administrator: To get the access to OneDrive account of all the users in tenant
SharePoint Administrator: To fetch the data in OneDrive and SharePoint Online
Privileged Role Administrator: To give admin consent to Azure Application
A custom role (View-Only Audit Logs) in the Exchange Admin Center

Note:

To assign the first three roles, refer to the Azure documentation and to create a custom role (View-Only Audit Logs), access Azure Portal with Global Administrator credentials and create a custom role (View-Only Audit Logs) and assign it to the created user .

To create and register an application with Microsoft

Login as a global admin user or minimum privilege user to https://portal.azure.com/#home and search App Registrations.
On the Register an application page, enter a desired name for the app.
In Supported account types select Accounts in this organizational directory only (<organization-name> only - Single tenant)
On the Register an application page, click Register to register the app. (Redirect URI can be provided later.)
Your new application is created and the app Overview page is displayed.
Copy-save the Application (Client ID) and Directory (Tenant) ID. You will be required to provide it later while adding an account in Arctera Data Insight.
Copy-save the . You will be required to provide it later while adding an account in Arctera Data Insight.
On the left sidebar of your app dashboard, click Certificates and Secrets.
In the Client secrets section, click New client secrets to generate the access token required for calling the required APIs
Set the expiry to Never and click Add.
Copy the Client Secret Value is generated. You will be required to provide it later while adding an account in Arctera Data Insight.
Then you need to grant permissions to the app to use the Microsoft Graph and Office 365 APIs.
On the left sidebar of your app, click API permissions, and then click Add a permission.
Then click Grant admin consent for.., and confirm.

On the Request API permissions panel that opens, select Microsoft Graph and Office 365 respectively, click Application permissions and grant the permissions as per the table given below:

API	Permission name
Microsoft Graph	Files.Read.All
	Group.Read.All
	RoleManagement.Read.Directory
	Sites.Read.All
	User.Read.All
Office 365 Management APIs	ActivityFeed.Read
	ActivityFeed.ReadDlp
SharePoint	Sites.FullControl.All

Note:

As per Microsoft guidelines, while using minimum permissions application, few advanced permissions like limited access permissions given to Limited Access System Group for the folder, permissions of sites, accounts, Document Library will not be visible. To fetch those permission, add Sites.FullControl.All scope to MS Application

Now add the redirect URI.
Go to the Overview page of the app and click Add redirect URI. The Authentication page opens
Click Add a platform
On the Configure platforms panel that opens, click Web
Click Configure to save it.

Once the app is created, anybody in the organization can access the app. As per Microsoft recommendation, restrict the access to specific users.

For information on how to require the user assignment for an app via the Azure portal, refer to Configure an application to require user assignment Azure documentation

For information on how to assign users or groups to an app via the Azure portal, refer to Assign users to an app Azure documentation