Steps to Prepare for Veritas Alta SaaS Protection Deployment Hosted in Customer’s Azure Account

Description

While Veritas Alta SaaS Protection is a fully managed SaaS offering, deploying Veritas Alta SaaS Protection into your own Azure subscription requires the customer to complete a set of steps within Azure.  Steps 1-9 below is an overview of the process.  If at any time there are questions or if you would like assistance, please contact your Veritas technical contact.  

1. Create a dedicated Azure subscription for Veritas Alta SaaS Protection.
2. Create an 'Veritas Alta SaaS Protection' user in your default Azure Active Directory.
3. Assign the created 'Veritas Alta SaaS Protection user to have the required access to the new Azure subscription. This user does not require an O365 license or be mail-enabled. 
4. Create the Azure Active Directory 'Veritas Alta SaaS Protection COPS' application, to permit the Veritas Alta SaaS Protection provisioning system access to the new Azure subscription.
5. Create the Azure Active Directory 'Veritas Alta SaaS Protection Directory Provider' application to allow Veritas Alta SaaS Protection to sync your organization's Azure Active Directory.
6. Disable MFA for the user account.
7. Remove restrictions on user login to Azure.
8. Whitelist COPS IP addresses.
9. Disable any conditional policy.

Required Information Checklist

At the end of this process, there will be a section to enter the information below that you will send to your Veritas technical contact.  

1. The 'Veritas Alta SaaS Protection' user's 'SMTP address' and temporary 'password'.
2. The 'Application ID' for the 'Veritas Alta SaaS Protection COPS' Azure Active Directory application.
3. Optionally, the 'Application ID' and generated 'key' for the created 'Veritas Alta SaaS Protection Directory Provider' Azure Active Directory application.

Creating a dedicated Azure subscription for Veritas Alta SaaS Protection

Create a new dedicated Azure subscription for the exclusive use of Veritas Alta SaaS Protection. Care should be taken to ensure that only required users have access to this subscription, to prevent accidental deletion or modification of Veritas Alta SaaS Protection's underlying Azure resources.

Log in to the Azure portal, select the 'All Services' blade, then 'Subscriptions', then click the 'Add' action, and follow the normal steps to create a subscription.

Create an 'Veritas Alta SaaS Protection' user in your default Azure Active Directory

Log in to the Azure portal using a Global admin account to create an 'Veritas Alta SaaS Protection' user in your organization's default Azure Active directory. Veritas will use this account to manage your deployment.

1. Select the proper directory by referencing the top-right user widget.  If the default directory is not selected, click top-right user widget, select 'Switch directory', and select the default directory. 

1. Select the Azure Active Directory blade, then click 'Users', 'All Users', and the 'New user' action.

1. User name: Veritas Alta SaaS Protection@<your_azure_ad_domain> 
2. Name: Veritas Alta SaaS Protection 
3. Create a password
4. Click the 'Create' button 

1. Veritas will change the password during the provisioning process, and this user will be enrolled in Veritas Alta SaaS Protection's password management system, and have the password updated every 60 days.
2. Take note of the 'User name' and temporary 'Password' as this will be sent to your Veritas technical contact.  

Create the Azure Active Directory 'Veritas Alta SaaS Protection COPS' application

Access to the Windows Azure Service Management API must be granted for the Veritas Alta SaaS Protection Customer Operations System (COPS) to manage the subscription in an automated manner. Create an Azure Active Directory native application as follows:

1. Select the 'Azure Active Directory blade', then click 'App registrations', followed by 'New registration'.

 

Configure the application as follows:

1. Name: Veritas Alta SaaS Protection COPS
2. Support Account Types: Accounts in this organizational directory only 
3. Redirect URI (Optional): 
   1. Select Public client (mobile & desktop)
   2. Enter URL as: https://localhost
4. Click the 'Register' button.

 

 

The application blade will be automatically opened once the application is created.  

1. Take note of the 'Application (client) ID' for 'Veritas Alta SaaS Protection COPS' as this will also be provided to your Veritas technical contact. 
2. Click 'API Permissions'

 

 

1.         On the 'API Permissions' blade, select 'Add a permission.'

 

 

1.          Select the 'APIs my organization uses' tab, then type 'Windows' in the search field. Click the 'Windows Azure Service Management API' entry.

 

1. Check the 'user_impersonation Access Azure Service Management as organization users (preview)' option.
2. Click 'Add Permission.'

 

 

1. Click the 'Grant Permissions' button
2. Click 'Yes' when prompted.