Search <book_title>...

Arctera Data Insight

Last Published: 2025-01-30

Product(s): Veritas Alta Data Insight (1.0)

Configuring application without user impersonation for Office 365

Setting DisableCustomAppAuthentication property for the tenant

To set the property DisableCustomAppAuthentication,

Install Module Pnp.Powershell using command in PowerShell Install-Module -Name PnP.PowerShell on the same machine where you have registered Data Insight with Microsoft in the earlier section.
Run the command Register-PnPManagementShellAccess and provide credentials of Global Administrator Account
Note:
This step is done to provide PnP PowerShell Authentication with Service Principal. If we do not do this then we will get error : Connect-PnPOnline : AADSTS65001: The user or administrator has not consented to use the application with ID'31359c7f-bd7e-475c-86db-fdb8c937548e' named 'PnP Management Shell'. Send an interactive authorization request for this user and resource

Copy the following script in Notepad and save it as DisableCustomAppAuthentication.ps1 file.

param (
	[parameter(Mandatory=$true)]
    [string]$Organization)

Import-Module PnP.PowerShell
$url = 'https://'+$Organization+'-admin.sharepoint.com'
Write-Output $url
$userCredential = Get-Credential
Connect-PnPOnline -Url $url -Credential $userCredential
get-PnPTenant
Set-PnPTenant -DisableCustomAppAuthentication $false

Note:

This is required for normal functioning of fetching of Advanced Permission, classification of data and scanning local user for SharePoint Online and OneDrive.

Run the script using .\DisableCustomAppAuthentication.ps1
When prompted, provide organization name.
In the Windows Powershell Credential Request pop up, provide Global Administrator credentials and click Ok
In the list of output, verify if the CustomAppAuthentication property is set to False.

After configuring application, you need to add the created application to the lookup

To add created application to the lookup,

Copy the Client ID of the app created in the Azure portal App
Navigate to https://<organization-name>-admin.sharepoint.com/_layouts/15/appinv.aspx
Paste the Client ID copied from the Azure portal App in the App Id field
Click Lookup
Add localhost.com in the App Domain field
Add https://localhost.com/default.aspx in the Redirect URL field

Add following XML in the App's Permission Request XML

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest Scope="http://sharepoint/content/tenant"

Right="FullControl"/>

</AppPermissionRequests>

Click Create
Click Trust It

You will be redirected to the SharePoint admin center.

Configuring an administrator account for Data Insight

Data Insight uses a Global administrator account to discover the site collections and scan metadata and a SharePoint administrator account to fetch the access events from the configured SharePoint Online account. Global administrator accounts must have full control over the site collections that you want Data Insight to monitor. You must configure the Global administrator, as owner for team site collections, on the Office 365 interface and assign the administrative privileges for the target site collections.

To add a SharePoint administrator

Log on to Office 365 using the Global admin credentials.
On the SharePoint admin center page, click Users > Active users > Add a user.
The New User pop-up windows opens.
Enter the name of the user and other properties as appropriate.
In the Roles section, select Customized administrator > SharePoint administrator.
Click Add.

The SharePoint administrator account collects metadata about site collection content , and gathers audit data from SQL Server databases for SharePoint when it is assigned administrative privileges for the target site collections. It must also have full control permissions on the configured site collections and the site collections that are incrementally included to the SharePoint account. For team site collections, the SharePoint administrator should be an owner.

The Minimum Privilege user has access to all features in the Admin center and can perform all tasks in the Office 365 Admin center.

To assign owners for team site collections

On the SharePoint admin center page, go to Groups > Groups, and select the Group Name to which you want to assign owners.
In the Group details pane on the right-hand-side, click Edit for the Owners entry.
In the Edit pane, click Add owner and select a user having Minimum Privilege user credentials.
Click Save.