# SailPoint Data Access Security Connector Documentation > SailPoint Data Access Security Connector Documentation # SailPoint Data Access Security Connector Documentation # SailPoint Data Access Security Connectors The sources on the left are available in our new online format for SailPoint Data Access Security. ## Terminology **Connector** - The collection of features, components, and capabilities that comprise Data Access Security support for an integration with a managed application or endpoint. **Collector** - The component or service performing the Data Classification operations, or the Resource Discovery, Permission Collection, or Activity Monitoring operations for On-Premises applications. **Identity Collector** - A logical component used to fetch Accounts, Entitlements and Identities information from sources and identity stores, leveraging SailPoint Human Fabric sources. # Data Access Security Connector Matrix | | | | | | | | ---------------------------------------- | ------------------------------- | ---------------------- | ----------------------- | ----------------------- | ----------------------- | | **Target System** | **Product** | **Resource Discovery** | **Permission Analysis** | **Data Classification** | **Activity Monitoring** | | O365 File Storage | Microsoft OneDrive for Business | ✓ | ✓ | ✓\* | ✓ | | Microsoft SharePoint Online (Office 365) | ✓ | ✓ | ✓\* | ✓ | | | Microsoft Exchange Online (Office 365) | ✓ | ✓ | - | ✓ | | | Cloud Storage | Box | ✓ | ✓ | ✓\* | ✓ | | Databricks | ✓ | ✓ | ✓ | - | | | Dropbox | ✓ | ✓ | ✓\* | ✓ | | | Google Drive | ✓ | ✓ | ✓\* | ✓ | | | AWS S3 | ✓ | ✓ | ✓\* | - | | | Snowflake | ✓ | ✓ | ✓ | - | | | On-Prem Connectivity | Active Directory | ✓\* | ✓\* | - | - | | SharePoint | ✓\* | ✓\* | ✓\* | - | | | NetApp | ✓\* | ✓\* | ✓\* | ✓\* | | | Powerscale | ✓\* | ✓\* | ✓\* | ✓\* | | | SMB | ✓ | ✓ | ✓ | - | | | Unity SMB | ✓\* | ✓\* | ✓\* | ✓\* | | | Windows Server | ✓\* | ✓\* | ✓\* | ✓\* | | \* Indicates the feature requires a Virtual Appliance. # Cloud Storage - [AWS](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/aws_direct/index.html) - [BigQuery](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/bigquery/index.html) - [Atlassian Confluence](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/index.html) - [Box](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/box/index.html) - [Databricks](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/databricks/index.html) - [Dropbox](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/dropbox/index.html) - [Google Drive](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/index.html) - [Snowflake](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/snowflake/index.html) ## Collecting Data Stored in a Managed Application The list below describes the high-level installation process required to collect and analyze data from an external application. Most of these should already be set up in your Data Access Security installation. 1. Create an Application in Data Access Security. 1. Create a [Virtual Appliance cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) if utilizing Data Classification. # Atlassian Confluence Connector Overview This connector enables you to use Data Access Security to access and analyze data stored in Atlassian Confluence and do the following: - Analyze the structure of your stored data (resource discovery / crawl). - Classify the data being stored. - Integrate with SailPoint Human Fabric Source — connect to a SailPoint Human Fabric Source to gather accounts and entitlements. Refer to the [Data Access Security documentation](https://documentation.sailpoint.com/das/help/index.html) for a full description. ## Installation Flow Overview 1. Set up the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/prerequisites.html) (Atlassian account and API token). 1. Add [SailPoint Human Fabric Atlassian Suite Cloud source](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/prerequisites.html#adding-an-identity-security-cloud-atlassian-suite-cloud-source) and an [Identity Collector](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/prerequisites.html#adding-an-identity-collector). 1. Add a new Atlassian Confluence application to Data Access Security. 1. Configure and schedule [resource discovery (crawler)](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/add/atlassian_confluence_crawl.html). 1. Configure and schedule [data classification](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/add/atlassian_confluence_data_class.html). ## Atlassian Confluence Connector Operation Principles - Data Access Security connects to Atlassian Confluence using the Confluence Cloud REST API v2 (with attachment download via the documented download link / Media redirect). - Authentication uses HTTP Basic Auth with an Atlassian account email and an API token. See: - The connector discovers spaces and content hierarchy (pages, live docs, folders, databases, whiteboards, smart links / embeds). - Data classification reads page body storage HTML and attachment bytes for eligible crawled resources. ## Resource Discovery Operation Principles The crawler discovers Confluence business resources and builds the resource tree used by Data Access Security. - Top-level virtual containers: Shared Spaces and Personal Spaces. - Under each container: spaces, then content under each space (pages, live docs, folders, databases, whiteboards, smart links). - Resource paths use the Confluence wiki web URL shape (for example https://.atlassian.net/wiki/spaces//...). - Attachments are not discovered as crawl resources, rather they are listed and read only during data classification. - Blog posts are not collected in this release. - Crawl scope is not supported in this release — the crawler discovers all spaces and content visible to the configured account. # Atlassian Confluence Connector Prerequisites You need the following to connect Atlassian Confluence to Data Access Security: - An Atlassian Confluence Cloud site (for example ). - An Atlassian account that can access the spaces you intend to govern. - An API token *without* scopes for that account, created at . ## Creating an API Token 1. Sign in to Atlassian with the account you will use for Data Access Security. 1. Open API tokens: 1. Select **Create an API token** and provide a label (for example, SailPoint DAS Confluence). 1. Copy the token and store it in a secure location. You will enter it for the Site Admin API Token when [adding the application](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/add/index.html#connection-details). ## Adding a SailPoint Human Fabric Atlassian Suite Cloud Source Creating a new separate Confluence source for SailPoint Human Fabric is recommended when using the Data Access Security Identity Collector. For information on how to add a Confluence source in SailPoint Human Fabric, refer to the applicable SailPoint Human Fabric connector documentation. ## Adding an Identity Collector Perform the following steps to add an identity collector: 1. Go to **Admin > Identity Collectors**. 1. Select **Create New** on the top right corner to open the wizard. In General details: - Type - Atlassian Confluence - Name - logical name for the Identity Collector (Example: Atlassian Suite IDC) In Connection Details, select the created SailPoint Human Fabric Atlassian Suite Cloud source. 1. User and Group Dynamic Fields Mappings are optional. 1. Select **Save**. Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. # Verifying the Atlassian Confluence Connector Installation You can verify your Atlassian Confluence connector installation by checking your resource discovery and data classification results. # Adding an Atlassian Confluence Application In order to integrate with Atlassian Confluence, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## General Details 1. Review and edit the application's general details: - Application Type - Atlassian Confluence - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. - Identity Collector - (Mandatory) Select the Atlassian Confluence Identity Collector type. The Atlassian Confluence type is associated with the Atlassian Suite Cloud SailPoint Human Fabric source. - You can create identity collectors on the **Admin > Identity Collectors** page. - Ensure you run the Identity Collector Aggregation task before running the Crawler Task. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Complete the Connection Details: - Atlassian Confluence Site URL - The base URL of your Atlassian Confluence instance. Example: `https://your-domain.atlassian.net`. - Admin Email - Atlassian account email used for basic authentication. - Site Admin API Token - API token created in prerequisites. 1. Select **Next**. You can now configure and schedule resource discovery. # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. 1. Navigate to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler** settings page. The actual entry fields vary according to the application type. 1. [Schedule a task](#scheduling-a-task). ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting an explicit list of resources to include and / or exclude spaces from the scan. Example: `https://YOUR-NAME.atlassian.net/wiki/spaces/SPACE_KEY` - Creating a regex to define resources to exclude. ## What the Crawler Collects The following are the items that will be collected when running the crawler: - Shared Spaces / Personal Spaces (virtual containers) - Spaces - Pages and live docs - Folders - Databases - Whiteboards - Smart links (embeds) Note Attachments and blog posts are not collected in a crawl. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Once - Single execution task runs. - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. # Selecting and Scheduling the Data Classification Settings Data classification for Atlassian Confluence is internal. Data Access Security lists and reads content from Confluence for scanning. - Page / live doc bodies are retrieved as Confluence storage-format HTML and scanned as HTML. - Attachments on pages / live docs are listed and downloaded (including follow of Atlassian Media redirects). Tip Run a successful crawl before data classification so business resources exist for classification. To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Data Classification** on. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This cluster is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. If a central data classification service is selected, you can schedule a task. 1. Select **Next** or **Done**. # AWS Connector Overview This connector enables you to use Data Access Security to access and analyze data stored in AWS S3 and do the following: - Analyze the structure of your stored data. - Verify user permissions on the resources, and compare them against requirements. - Identity collector – collect IAM users, groups and roles and the connections between them. ## Installation Flow Overview 1. Configure the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/aws_direct/aws_prereqs.html). 1. [Add](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/aws_direct/add/index.html) a new AWS S3 application to Data Access Security. ## Identity Collection The AWS identities will be collected by the permission collector at the beginning of the task. The following identities are collected: - AWS Accounts (root users) - IAM Users - IAM Groups - IAM Roles The AWS predefined groups are represented as the following groups: - **** - “Anonymous” with type "Everyone or Authenticated Users, or contains it" - **** - “AwsAuthenticatedUsers” with type "Everyone or Authenticated Users, or contains it" - **** - “S3LogDelivery” with type “Local Group”. From each IAM Role, Data Access Security collects its trusted entities as members of the role. The AWS entities will be mapped to the following types: - IAM Users – will be saved as DAS “Local User” type. - IAM Groups – will be saved as DAS “Local Group” type. - IAM Roles – will be saved as DAS “Local Role” type. - AWS Account – will be saved as DAS “AWS Account” type. - AWS Service – will be saved as DAS “AWS Service” type. All other types, including “Federated”, will be saved as DAS “AWS External Account” type. Notes - IAM Role trusted Identity of type `*` is represented as "Anonymous" with type "Everyone, Authenticated Users, or contains it". - Principal: `*` in bucket policy is represented as “Anonymous” with type "Everyone, Authenticated Users, or contains it". For each Collected identity, the primary ID will be their ARN and Alternative IDs will also be collected: - For AWS Accounts – ID, root user ARN ("arn:aws:iam::{iamRootUser.Id}:root") and canonical ID. - For other identities – ID. Additional information that is collected: - Name - Display Name - Description - Domain – will be the AccountName(#AccountId) - Email (Only for AWS Account) - LastLogin (Only for IAM Users) ## Cross-Account Access To achieve cross-account access and allow an AWS IAM Identity from Account A to access AWS resources in Account B (S3 resource in our case), two conditions must be met: 1. The IAM Identity owner account A should give permission X on the S3 resource in account B. In Data Access Security this permission will appear as **X-ByTrustedCrossAccount** 1. The S3 resource owner account B should give permission X on the resource to the IAM Identity from account A. In Data Access Security this permission will appear as **X-ByTrustingCrossAccount**. Permission X will be effective only if both permissions are granted to the user/group on the resource. Otherwise, the user/group will not be allowed to perform X on this resource. In the above example, the user “DASAdminUser1” from account “FA-QA1” has both “GetBucketLocation-ByTrustingCrossAccount” and “GetBucketLocation-ByTrustedCrossAccount” permissions on bucket “bucket1-DAS-qa2-user1adminpriv” from account “DAS-QA2”. ### Cross Account by Assume Roles This scenario requires 4 conditions for user USER_A from Account A to have permission X on resource RESOURCE_B from Account B through role ASSUME_ROLE_B: 1. ASSUME_ROLE_B is defined in account B. 1. ASSUME_ROLE_B is attached to policy that gives permission **X** on RESOURCE_B. 1. USER_A should be a member of ASSUME_ROLE - a trusted entity of the role. 1. USER_A should have, in Account A, permission to assume ASSUME_ROLE_B in Account B. In the above example, the role “DASConnectorRole” allows “GetBucketPolicy” on bucket “DAS-dev-public-bucket1”. The role and the bucket, both belong to account “DAS-Dev-Public”. The role has a member user (trusted entity) “AmirTestUser1” from account “DAS-Org”. If, in account DAS-Org, “AmirTestUser1” has a policy that allows them to assume the role “DASConnectorRole” in account “DAS-Dev-Public", the permission will be active. ## Block Public Access The Amazon S3 Block Public Access feature provides settings for buckets and accounts to help manage public access to Amazon S3 resources. By default, new buckets and objects don't allow public access, however, users can modify bucket policies or object permissions to allow public access. S3 Block Public Access settings override these policies and permissions and enable to limit public access to these resources. There are 4 settings both on the bucket level, and the account level, If the PublicAccessBlock settings are different between the bucket and the account, Amazon S3 uses the most restrictive combination of the bucket-level and account-level settings. In Data Access Security these permissions appear with the suffix “Account-Disabled” for the account level settings and “Bucket-Disabled” for the bucket level settings. If one of these settings is turned off, the Permission Forensics view shows these permissions as “Allow”. Go to **Resources > Permissions > Simple View** to view warnings. ## Crawler The crawler analyzes the structure of the organization and builds the hierarchy tree: - Organization Root container - Organization Units (OUs) - AWS Accounts - S3 Buckets - S3 Folders ## Permission Collector The Permission collection will retrieve and analyze the following permissions: - ACLs of buckets. If **Analyze ACLs** is checked, ACLs will be collected for the objects retrieved in the crawl. - Bucket policies for the buckets and their objects. - IAM policies which are relevant for the S3 buckets and Objects. - Account and bucket level PublicAccessBlock configurations. - Cross-account permissions Permission Collection Limitations Permission collection has the following limitations or unsupported features: - Permissions are analyzed for buckets and objects, not for folders since they are not an actual object in S3 - Permissions Boundary - Policies Conditions - Policies Variables - Policies elements - NotPrincipal, NotAction, NotResource - Only S3-related permissions are analyzed - Access points and Jobs permissions are not analyzed **Analyze Permissions on Files** If checked, the crawler will also get the S3 Objects (files) under the buckets and the permission collector will analyze their permissions. # Active Directory Integration with AWS Active Directory can be integrated with AWS environments to allow users to use their existing login credentials, manage their user identities outside of AWS, and give these external user identities permissions to use AWS resources in their account. When integrating Active Directory to AWS, the AWS S3 permissions needs to be mapped to the Active Directory users and groups by using an Identity Provider (IdP). We support AWS SAML and OpenID Connect IdPs in case this is done in the following way: - Using Active Directory group naming configuration. This method is ideal in case the client's IDP supports it and if the client created these groups. **Example:** Active Directory group name – `ad-aws-int-test1#Okta_IDP_Role_2#832879285990` This is the Active Directory group name template: [some name]#[role name]#[account id]. The user configures (in Data Access Security) the regular expression (regex). **Example:** S+#(?[\\w-]+)#(?\\d+)$. We then know to use this expression to extract the IAM Role name and the AWS account ID from the Active Directory group name and do the mapping. # Prerequisites for AWS To use the Data Access Security AWS connector, you must have sufficient permissions in AWS to [create a dedicated IAM user](#creating-dedicated-iam-users). Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. ## Creating Dedicated IAM Users To configure the connector, you will create dedicated IAM users with the policies and roles needed to allow Data Access Security to access your AWS objects. 1. Sign into your organization’s management account. 1. Use the [SailPoint_DataAccessSecurity_AssumeRolePolicy.json](#assume_role_policy_script) script to create a policy titled "DataAccessSecurity_AssumeRolePolicy” so the Data Access Security user created in the next step can assume the roles created in each account. 1. Create an IAM User for Data Access Security and select **Programmatic** access. This access requires an access key and secret key. 1. Attach the "SailPoint_DataAccessSecurity_AssumeRolePolicy" policy [created above](#assume_role_policy) to the new user. Important Save the generated Access Key and Secret Key in a secure place. 1. On each organization account the connector should analyze, including the management account, use the [SailPoint_DataAccessSecurity_S3IAMReadOnlyAccessPolicy.json](#s3_iam_script) script to create a policy titled “SailPoint_DataAccessSecurity_S3IAMReadOnlyAccessPolicy” with the required permissions for the connector. 1. Create a new role titled “SailPoint_DataAccessSecurityRole”, which the Data Access Security user will assume on each organization account the connector should analyze. Select **Another AWS Account** to enter the user account ID. 1. Attach the "SailPoint_DataAccessSecurity_S3IAMReadOnlyAccessPolicy" policy you [created above](#s3_access_policy). 1. Enter the role name **SailPoint_DataAccessSecurityRole**. Important This name cannot be changed. 1. Edit the trust relationship of the new role. 1. Edit the JSON file. Use the [DataAccessSecurity.json (Dedicated User)](#user_creation_script) script and replace `root` in the Principal section with `user/{DAS IAM User username}` where `DAS IAM User username` is the user [created above](#create_iam_user). ### Appendix: AWS JSON Scripts Copy or download the following scripts to create the roles and policies required to connect AWS and Data Access Security. Important Do not change the file names. **Assume Role Policy** [Download](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/aws_direct/aws_json_scripts/DataAccessSecurity_AssumeRolePolicy.json) or copy the SailPoint_DataAccessSecurity_AssumeRolePolicy.json to create a policy defining the roles the IAM user can assume in each account. ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/SailPoint_DataAccessSecurityRole" } ] } ``` **S3 IAM Read-Only Access Policy** [Download](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/aws_direct/aws_json_scripts/DataAccessSecurity_S3IAMReadOnlyAccessPolicy.json) or copy the SailPoint_DataAccessSecurity_S3IAMReadOnlyAccessPolicy.json to create a policy with read-only access to your S3 objects. ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:GetObject", "s3:GetObjectAcl", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListUserPolicies", "iam:ListUsers", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy", "iam:GetUserPolicy", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent", "organizations:DescribeAccount", "ec2:DescribeRegions" ], "Resource": "*" } ] } ``` **Dedicated IAM User-Creation Policy** [Download](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/aws_direct/aws_json_scripts/DataAccessSecurity.json) or copy the DataAccessSecurity.json (Dedicated User) script to set the dedicated IAM user who can use the roles and policies you've configured. ```json {   "Version": "2012-10-17",   "Statement": [     {       "Effect": "Allow",       "Principal": {         "AWS": [           "arn:aws:iam::{The user account ID}:user/{DAS IAM User username}"         ]       },       "Action": "sts:AssumeRole"     }   ] } ``` # Mapping Extractions from IDPs This section provide the steps to extract mappings from the following IDPs: - Okta - ADFS - Azure - Ping ## Okta In Okta, use the Okta API [Reference Overview: Okta Developer](https://developer.okta.com/docs/reference/), to get the Active Directory identities - AWS identities mappings. 1. Get the AWS application and extract the Account ID from the `identityProviderArn` property. Refer to the [Okta Developer documentation](https://developer.okta.com/docs/reference/api/apps/) for more information. **Request Example** - `https://{yourOktaDomain}/api/v1/apps/{applicationId}` Response Example ```text {     "id": "0oapruvo3xnNEuI12345",     "name": "amazon_aws",     "label": "AWS Account Federation",     "status": "ACTIVE",     "lastUpdated": "2021-08-02T14:51:07.000Z",     "created": "2021-07-22T11:00:28.000Z",     "accessibility": {         "selfService": false,         "errorRedirectUrl": null,         "loginRedirectUrl": null     },     "visibility": {         "autoLaunch": false,         "autoSubmitToolbar": true,         "hide": {             "iOS": false,             "web": false         },         "appLinks": {             "login": true         }     },     "features": [         "PUSH_NEW_USERS",         "PUSH_PROFILE_UPDATES"     ],     "signOnMode": "SAML_2_0",     "credentials": {         "userNameTemplate": {             "template": "${source.login}",             "type": "BUILT_IN"         },         "signing": {             "kid": "BNfWuNclhWcvmRpgv2C8MoP1A34vLbDMNQ2odOK97VY"         }     },     "settings": {         "app": {             "appFilter": "okta",             "groupFilter": "aws_(?{{accountid}}\\d+)_(?{{role}}[a-zA-Z0-9+=,.@\\-_]+)",             "secretKey": null,             "useGroupMapping": true,             "joinAllRoles": true,             "identityProviderArn": "arn:aws:iam::832879212345:saml-provider/okta2",             "overrideAcsURL": null,             "sessionDuration": 3600,             "roleValuePattern": "arn:aws:iam::${accountid}:saml-provider/okta2, arn:aws:iam::${accountid}:role/${role}",             "awsEnvironmentType": "aws.amazon",             "accessKey": null,             "loginURL": "https://console.aws.amazon.com/ec2/home",             "secretKeyEnc": null         },         "notifications": {             "vpn": {                 "network": {                     "connection": "DISABLED"                 },                 "message": null,                 "helpUrl": null             }         },         "notes": {             "admin": null,             "enduser": null         },         "signOn": {             "defaultRelayState": null,             "ssoAcsUrlOverride": null,             "audienceOverride": null,             "recipientOverride": null,             "destinationOverride": null,             "attributeStatements": []         }     },     "_links": {         "help": {             "href": "https://sailpointamirmono-admin.okta.com/app/amazon_aws/0oapruvo3xnNEuI12345/setup/help/SAML_2_0/external-doc",             "type": "text/html"         },         "metadata": {             "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/sso/saml/metadata",             "type": "application/xml"         },         "uploadLogo": {             "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/logo",             "hints": {                 "allow": [                     "POST"                 ]             }         },         "appLinks": [             {                 "name": "login",                 "href": "https://sailpointamirmono.okta.com/home/amazon_aws/0oapruvo3xnNEuI12345/272",                 "type": "text/html"             }         ],         "groups": {             "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/groups"         },         "logo": [             {                 "name": "medium",                 "href": "https://ok14static.oktacdn.com/fs/bcg/4/gfs1f2p5y2qNcK02w1d8",                 "type": "image/png"             }         ],         "users": {             "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/users"         },         "deactivate": {             "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/lifecycle/deactivate"         }     } } ``` 1. Get the applications users and groups and extract the role names from profile > role. 1. Build the role ARN from the Account ID and Role Name and get the [user](https://developer.okta.com/docs/reference/api/users/) and [group](https://developer.okta.com/docs/reference/api/groups/) Okta ID. **Request Examples** ```text https://{yourOktaDomain}/api/v1/apps/{applicationId}/users https://{yourOktaDomain}/api/v1/apps/{applicationId}/groups ``` Response Example ```text [     {         "id": "00gpsbh7o3OJOfoeV695",         "lastUpdated": "2021-08-22T14:32:44.000Z",         "priority": 0,         "profile": {             "role": "AWSServiceRoleForCloudTrail",             "samlRoles": [                 "Okta_IDP_Role_2"             ]         },         "_links": {             "app": {                 "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345"             },             "self": {                 "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/groups/00gpsbh7o3OJOfo12345"             },             "group": {                 "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gpsbh7o3OJOfo12345"             }         }     },     {         "id": "00gymrmrGOkWUyKGf695",         "lastUpdated": "2021-08-22T14:35:17.000Z",         "priority": 1,         "profile": {             "role": "AWSServiceRoleForCloudTrail",             "samlRoles": [                 "Okta_IDP_Role"             ]         },         "_links": {             "app": {                 "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345"             },             "self": {                 "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/groups/00gymrmrGOkWUyK12345"             },             "group": {                 "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gymrmrGOkWUyK12345"             }         }     } ] ``` 1. List all the groups and users and get the [groups](https://developer.okta.com/docs/reference/api/groups/) and [user](https://developer.okta.com/docs/reference/api/users/) names by the ID. **Request Examples** ```text https://{yourOktaDomain}/api/v1/groups https://{yourOktaDomain}/api/v1/users ``` Response Example ```text [     {         "id": "00gymrmrGOkWUyK12345",         "created": "2021-07-29T10:40:08.000Z",         "lastUpdated": "2021-07-29T10:40:08.000Z",         "lastMembershipUpdated": "2021-07-29T10:41:25.000Z",         "objectClass": [             "okta:user_group"         ],         "type": "OKTA_GROUP",         "profile": {             "name": "aws_832879285990_Okta_IDP_Role_2",             "description": null         },         "_links": {             "logo": [                 {                     "name": "medium",                     "href": "https://ok14static.oktacdn.com/assets/img/logos/groups/odyssey/okta-medium.1a5ebe44c4244fb796c235d86b47e3bb.png",                     "type": "image/png"                 },                 {                     "name": "large",                     "href": "https://ok14static.oktacdn.com/assets/img/logos/groups/odyssey/okta-large.d9cfbd8a00a4feac1aa5612ba02e99c0.png",                     "type": "image/png"                 }             ],             "users": {                 "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gymrmrGOkWUyK12345/users"             },             "apps": {                 "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gymrmrGOkWUyK12345/apps"             }         }     },     {         "id": "00gpsbh7o3OJOfo12345",         "created": "2021-07-22T09:26:50.000Z",         "lastUpdated": "2021-07-22T09:26:50.000Z",         "lastMembershipUpdated": "2021-07-29T10:41:25.000Z",         "objectClass": [             "okta:user_group"         ],         "type": "BUILT_IN",         "profile": {             "name": "Everyone",             "description": "All users in your organization"         },         "_links": {             "logo": [                 {                     "name": "medium",                     "href": "https://ok14static.oktacdn.com/assets/img/logos/groups/odyssey/okta-medium.1a5ebe44c4244fb796c235d86b47e3bb.png",                     "type": "image/png"                 },                 {                     "name": "large",                     "href": "https://ok14static.oktacdn.com/assets/img/logos/groups/odyssey/okta-large.d9cfbd8a00a4feac1aa5612ba02e99c0.png",                     "type": "image/png"                 }             ],             "users": {                 "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gpsbh7o3OJOfo12345/users"             },             "apps": {                 "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gpsbh7o3OJOfo12345/apps"             }         }     } ] ``` ## ADFS In ADFS, the Active Directory identities-AWS identities mapping is done on an Active Directory identity attribute. For more information, refer to **Configure an AD User's Account** in [Establish Federated Access to AWS Resources by Using AD User Attributes](https://aws.amazon.com/blogs/security/how-to-establish-federated-access-to-your-aws-resources-by-using-active-directory-user-attributes/). Filter all the users and groups with the specific attribute and export it to a CSV or Excel file. **PS Example** `Get-ADUser -Filter 'url -like "*AWS*"' -properties "url" | Export-Csv c:\file.csv` **Response Example** ```text #TYPE Microsoft.ActiveDirectory.Management.ADUser,,,,,,,,,, DistinguishedName,Enabled,GivenName,Name,ObjectClass,ObjectGUID,SamAccountName,SID,Surname,url,UserPrincipalName "CN=Adiel,CN=Users,DC=office,DC=whitebox,DC=forest",TRUE,Adiel,Adiel,user,e3fe35c1-0daf-4379-a379-73364ec12345,Adiel,S-1-5-21-3335839157-1594281566-240188981-12345,Moshed,Microsoft.ActiveDirectory.Management.ADPropertyValueCollection,Adiel@office.whitebox.forest ``` Note The response will be exported to a CSV or Excel file. ## Azure AD In Azure AD, it is possible to get the AD identities-AWS identities mapping by using Microsoft Graph. 1. Get all the AWS account’s roles by the `AWS Single-Account Access` Object ID (one account per request). 1. Acquire the roles ARNs. **Request Example** - `https://graph.microsoft.com/beta/servicePrincipals/{AWS Single-Account Access object id}` Response Example ```text {     "@odata.context": "https://graph.microsoft.com/beta/$metadata#servicePrincipals/$entity",     "@odata.id": "https://graph.microsoft.com/v2/154dccc9-b44e-4883-860c-12345/directoryObjects/726e2abf-b192-462d-a977-12345/Microsoft.DirectoryServices.ServicePrincipal",     "id": "726e2abf-b192-462d-a977-12345",     "deletedDateTime": null,     "accountEnabled": true,     "alternativeNames": [],     "createdDateTime": "2021-09-05T11:27:45Z",     "deviceManagementAppType": null,     "appDescription": null,     "appDisplayName": "AWS Single-Account Access",     "appId": "944b9a2c-51dd-41eb-a018-12345",     "applicationTemplateId": "8b1025e4-1dd2-430b-a150-12345",     "appOwnerOrganizationId": "154dccc9-b44e-4883-860c-12345",     "appRoleAssignmentRequired": true,     "description": null,     "disabledByMicrosoftStatus": null,     "displayName": "AWS Single-Account Access",     "errorUrl": null,     "homepage": "https://signin.aws.amazon.com/saml?metadata=aws|ISV9.1|primary|z",     "isAuthorizationServiceEnabled": false,     "isManagementRestricted": null,     "loginUrl": null,     "logoutUrl": null,     "notes": null,     "notificationEmailAddresses": [         "admin@501.sailpointtechnologies.com"     ],     "preferredSingleSignOnMode": "saml",     "preferredTokenSigningKeyEndDateTime": null,     "preferredTokenSigningKeyThumbprint": null,     "publisherName": "SailPoint Technologies, Inc.",     "replyUrls": [         "https://signin.aws.amazon.com/saml"     ],     "samlMetadataUrl": null,     "servicePrincipalNames": [         "944b9a2c-51dd-41eb-a018-12345"     ],     "servicePrincipalType": "Application",     "signInAudience": "AzureADMyOrg",     "tags": [         "WindowsAzureActiveDirectoryIntegratedApp"     ],     "tokenEncryptionKeyId": null,     "samlSingleSignOnSettings": null,     "verifiedPublisher": {         "displayName": null,         "verifiedPublisherId": null,         "addedDateTime": null     },     "addIns": [],     "api": {         "resourceSpecificApplicationPermissions": []     },     "appRoles": [         {             "allowedMemberTypes": [                 "User"             ],             "description": "msiam_access",             "displayName": "msiam_access",             "id": "7dfd756e-8c27-4472-b2b7-12345",             "isEnabled": true,             "origin": "Application",             "value": null         },         {             "allowedMemberTypes": [                 "User"             ],             "description": "ChessPlayersRole",             "displayName": "ChessPlayersRole,Okta1",             "id": "2d9e11e2-14c9-4f34-bf19-12345",             "isEnabled": true,             "origin": "ServicePrincipal",             "value": "arn:aws:iam::832879212345:role/ChessPlayersRole,arn:aws:iam::832879212345:saml-provider/Okta1"         },         {             "allowedMemberTypes": [                 "User"             ],             "description": "DOMAIN_ALIAS_RID_ADMIN-AWS",             "displayName": "DOMAIN_ALIAS_RID_ADMIN-AWS,Azure_test1",             "id": "ad3d751a-b615-4bf7-930b-c06a62712345",             "isEnabled": true,             "origin": "ServicePrincipal",             "value": "arn:aws:iam::832879212345:role/DOMAIN_ALIAS_RID_ADMIN-AWS,arn:aws:iam::832879212345:saml-provider/Azure_test1"         }     ],     "info": {         "termsOfServiceUrl": null,         "supportUrl": null,         "privacyStatementUrl": null,         "marketingUrl": null,         "logoUrl": null     },     "keyCredentials": [],     "publishedPermissionScopes": [         {             "adminConsentDescription": "Allow the application to access AWS Single-Account Access on behalf of the signed-in user.",             "adminConsentDisplayName": "Access AWS Single-Account Access",             "id": "419e3996-3684-4265-890a-12345",             "isEnabled": true,             "type": "User",             "userConsentDescription": "Allow the application to access AWS Single-Account Access on your behalf.",             "userConsentDisplayName": "Access AWS Single-Account Access",             "value": "user_impersonation"         }     ],     "passwordCredentials": [],     "resourceSpecificApplicationPermissions": [] } ``` 1. Get the users and groups which are assigned to the AWS roles. 1. Acquire the users and groups details. **Request Example** - `https://graph.microsoft.com/beta/servicePrincipals/{AWS Single-Account Access object id}/appRoleAssignedTo` Response Example ```text {     "@odata.context": "https://graph.microsoft.com/beta/$metadata#appRoleAssignments",     "value": [         {             "@odata.id": "https://graph.microsoft.com/v2/154dccc9-b44e-4883-860c-12345/directoryObjects/$/Microsoft.DirectoryServices.ServicePrincipal('726e2abf-b192-462d-a977-12345')/appRoleAssignedTo/v9raS1IPQkuV98HJH2Uqhsg4ilzG80ZOi0OMy-8m5iw",             "id": "v9raS1IPQkuV98HJH2Uqhsg4ilzG80ZOi0OMy-8m5iw",             "creationTimestamp": "2021-09-09T11:45:26.3084935Z",             "appRoleId": "d3a9b01b-1736-4f1b-ac5f-12345",             "principalDisplayName": "anatoly_azure_gr1",             "principalId": "4bdadabf-0f52-4b42-95f7-12345",             "principalType": "Group",             "resourceDisplayName": "AWS Single-Account Access",             "resourceId": "726e2abf-b192-462d-a977-12345"         },         {             "@odata.id": "https://graph.microsoft.com/v2/154dccc9-b44e-4883-860c-12345/directoryObjects/$/Microsoft.DirectoryServices.ServicePrincipal('726e2abf-b192-462d-a977-12345')/appRoleAssignedTo/CF0PHVm9hka00WBTgEPxaoZKebW4inxCsBpqIGxRwFI",             "id": "CF0PHVm9hka00WBTgEPxaoZKebW4inxCsBpqIGxRwFI",             "creationTimestamp": "2021-09-09T11:45:26.3302622Z",             "appRoleId": "d3a9b01b-1736-4f1b-ac5f-12345",             "principalDisplayName": "anatoly_azure_group3",             "principalId": "1d0f5d08-bd59-4686-b4d1-12345",             "principalType": "Group",             "resourceDisplayName": "AWS Single-Account Access",             "resourceId": "726e2abf-b192-462d-a977-12345"         },         {             "@odata.id": "https://graph.microsoft.com/v2/154dccc9-b44e-4883-860c-12345/directoryObjects/$/Microsoft.DirectoryServices.ServicePrincipal('726e2abf-b192-462d-a977-12345')/appRoleAssignedTo/INRoSKbmpUaZrnYaVRU3XMRgM8C1kZ9GjHjSB9vW1e4",             "id": "INRoSKbmpUaZrnYaVRU3XMRgM8C1kZ9GjHjSB9vW1e4",             "creationTimestamp": "2021-09-09T11:32:47.4228653Z",             "appRoleId": "277f83e1-4903-4b06-baf7-12345",             "principalDisplayName": "Adiel",             "principalId": "4868d420-e6a6-46a5-99ae-12345",             "principalType": "User",             "resourceDisplayName": "AWS Single-Account Access",             "resourceId": "726e2abf-b192-462d-a977-12345"         }     ] } ``` # Adding an AWS S3 Application In order to integrate with AWS S3, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details 1. Review and edit the application's general details: - Application Type - AWS S3 - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name and press **Enter** to create a tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. - Identity Collector - Select AWS for the Identity Collector type. - You can create identity collectors on the **Admin > Identity Collectors** page. - Ensure you run the Identity Collector Aggregation task before running the Permission Collection Task. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Fill in the connection details: - Management Account ID - The account ID of the AWS management account. This is required for collecting user details and permissions from different accounts. - Access Key ID - The IAM user programmatic username of the Data Access Security user that was created in the prerequisites. - Secret Access Key - The IAM user programmatic password. 1. Select **Next**. You can now [configure and schedule permissions collection and resource discovery](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/aws_direct/add/aws_permissions_collection.html). # Configuring and Scheduling the AWS Crawl To configure the crawl: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. 1. Check the **Exclude Resources' Size** option to exclude CloudTrail logs from being crawled and analyzed. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ### Crawler Regex Exclusion Examples The following are examples of crawler Regex exclusions: **Exclude all bucket folders which start with one or more folder names:** Example: All Starting with folderName under path Regex: `^Root\/[account_name]\(#[AccountID]\)\/s3.[region].[bucket_name]\/folder_name` Real Example: Path: Root/my-account(#1234567890)/s3.ap-south-1.bucket1/myFolder Regex: `^Root\/my-account\(#1234567890\)\/s3.ap-south-1.bucket1\/myFolder` Example: All starting with folderName of otherFolderName under path Regex: `^Root\/[account_name]\(#[AccountID]\)\/s3.[region].[bucket_name]\/(folderName|otherFolderName)` **Include ONLY bucket folders that start with one or more folder names** Example: Starting with folderName under path Regex: `^(?!Root($|\/[account_name]\(#[AccountID]\)($|\/s3.[region].[bucket_name]($|\/folder_name($|/.*))))).*` Real Example: Path: Root/DAS_Test(#1234567890)/s3.us-west-1.service/logs/logs_01 Path: Root/DAS_Test(#1234567890)/s3.us-west-1.service/logs/logs_02 Path: Root/DAS_Test(#1234567890)/s3.us-west-1.service/logs/logs_03 Regex: `^(?!Root\/DAS_Test($|\(#1234567890\)($|\/s3.us-west-1.service($|\/logs($|/.*))))).*` Example: Starting with folderName of otherFolderName under path Regex: `^(?!Root($|\/[account_name]\(#[AccountID]\)($|\/s3.[region].[bucket_name]($|\/folder_Name|other_Folder_Name)($|/.*))))).*` ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Selecting and Scheduling the AWS Data Classification Settings Note If files are placed into cold storage but are also scoped within the crawl, data classification will rehydrate them. Data Access Security cannot gather sensitive information without directly accessing the file. To exclude these resources from data classification in order to avoid rehydration, go to to **Compliance > Data Classification > Application Scope > [select application] > Edit > Toggle Exclude from Classification > [select resources]**. To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Data Classification** on. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This cluster is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. If a central data classification service is selected, you can schedule a task. 1. Select **Next** or **Done**. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. ## Configuring the Permission Collection The permission collector is a software component responsible for analyzing the permissions in an application. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collection** settings page. 1. To analyze permissions on file, select the **Analyze Permissions on Files** option. 1. To analyze ACL-type permissions, select the **Analyze ACL Permissions** options. Note The entry fields vary by application type. You have the option to enter [Active Directory Group Regex](#active-directory-group-regex). If matching an Active Directory group to an AWS IAM role is done by the Active Directory group naming convention, enter a regex. This will enable extracting the AWS account ID and name role from the group. The regex must include these exact named groups in this exact format: - `` - `` 1. You can now schedule a task. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select **Next**. # Google BigQuery Connector Overview Google Google BigQuery is a fully managed, cloud-based data warehouse that stores data in datasets and tables. Data Access Security is a solution for discovering, classifying, and controlling access to sensitive data across your data sources. This connector enables Data Access Security to do the following: - Analyze the structure of your stored data (datasets, tables and other assets). - Import data classification from Google BigQuery if data profiling is enabled. - Verify user permissions on the resources. ## Installation Flow Overview To install the Google BigQuery connector: 1. Configure the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/bigquery/prereqs/index.md). 1. [Add](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/bigquery/add/index.html) a new Google BigQuery application. 1. Verify proper installation using the Test Connection task. # Google BigQuery Prerequisites Before configuring Google BigQuery: 1. [Create](https://documentation.sailpoint.com/connectors/saas/googleworkspace/help/saas_connectivity/google_workspace/prereqs_for_oauth_2_0.html#Service) or use an existing service account or client credentials in your GCP environment. Tip It is highly recommended to use a service account for easier integration. 1. Grant organization-level permissions. When connecting to SailPoint using an organization ID, the service account requires permissions at the Organization level to browse the resource hierarchy. 1. Switch to Organization Context. 1. Select the **Project/Resource** dropdown at the top of the GCP Console. 1. Select your organization (e.g., `sptechdev.com`) instead of a specific project. 1. Add a principal. 1. In the left menu, go to **IAM & Admin > IAM**. 1. Select **Grant Access** (or **Add**). 1. In the **New principals** field, paste the full email address of your Service Account (e.g., `name@project-id.iam.gserviceaccount.com`). 1. Select a browser role. 1. Under **Assign Roles**, select **Browser** (`roles/browser`). This grants read-only access to browse the GCP resource hierarchy (organizations, folders, and projects). 1. Select **Save**. 1. Add [Google Workspace SaaS](https://documentation.sailpoint.com/connectors/g_suite/help/integrating_g_suite/introduction.html) as a SailPoint Human Fabric source where your deployment requires it, using the above configuration. 1. If you are using a service account, verify the following APIs are enabled: 1. Google BigQuery 1. Cloud Assess 1. DLP 1. Cloud Resource Manager 1. IAM 1. Dataform 1. For client credentials, verify the same scopes are enabled. ## Adding an Identity Collector Perform the following steps to add an identity collector: 1. Go to **Admin > Identity Collectors**. 1. Select **Create New** on the top right corner to open wizard. In General details: - Type - Google Drive - Name - Logical name for the Identity Collector (Example: Google BigQuery IDC) In Connection Details, select the SailPoint Human Fabric created Google Workspace SaaS source. 1. User and Group Dynamic Fields Mappings are optional. 1. Select **Save**. Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. ## Google BigQuery Permissions To enable Data Access Security to interact with Google Apps, you must: 1. Enable the required APIs 1. Google BigQuery 1. Cloud Assest 1. DLP 1. Cloud Resource Manager 1. For Client credentials, enabling the required Scopes is done when creating the credentials. 1. For more details refer to the [Google Workspace Prerequisites](https://documentation.sailpoint.com/connectors/g_suite/help/integrating_g_suite/prerequisites.html). # Verifying the Google BigQuery Installation You can verify your Google BigQuery connector installation by checking your application configuration and validations. # Adding a Google BigQuery Application In order to integrate with Google BigQuery, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details 1. Review and edit the application's general details: - Application Type - Google BigQuery - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or enter a new name. Select **Enter** to create a tag. - Identity Collector - (Mandatory) Select the BigQuery type of Identity Collector. - You can create identity collectors on the **Admin > Identity Collectors** page. - Ensure you run the Identity Collector Aggregation task before running the Permission Collection Task. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Fill in the connection details: - Organization ID - Enter the 10-digit Organization ID. - In the **Grant Type** menu, select **Service Account** (recommended) or **Client Credentials**. - Service Account Email - The email address of the service account user. - Private Key - Enter the encrypted private key as generated in [Generating OAuth 2.0 Authentication Credentials](https://documentation.sailpoint.com/connectors/g_suite/help/integrating_g_suite/prereqs_for_oauth_2_0.html). - Private Key Password - Enter the private key password as generated in [Generating OAuth 2.0 Authentication Credentials](https://documentation.sailpoint.com/connectors/g_suite/help/integrating_g_suite/prereqs_for_oauth_2_0.html). 1. Select **Next**. You can now [configure and schedule resource discovery](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/bigquery/add/bigquery_crawl.html). # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler** settings page. The actual entry fields vary according to the application type. 1. [Schedule a task](#scheduling-a-task). ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and/or exclude from the scan. - Creating a regex to define resources to exclude. ## Crawler Regex Exclusion Examples - Name - `> ^Project.*` - Exclude Schema Name - `> ^Project\.Dataset.*` - Exclude Table or View Name - `> ^Project\.Dataset\.Table` ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. Note If utilizing Exclude Top Level Resources, what is available to exclude is based on the type of connector. See the various [connector guides](https://documentation.sailpoint.com/das-connectors/help/index.html) for more details. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save**. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Selecting and Scheduling the Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. Select **Next** or **Finish**. # Box Connector Overview This connector enables you to use Data Access Security to access and analyze data stored in Box and do the following: - Analyze the structure of your stored data. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Integration with SailPoint Human Fabric Source – Connect to a SailPoint Human Fabric Source to gather accounts and entitlements. Refer to the [Data Access Security documentation](https://documentation.sailpoint.com/das/help/index.html) for a full description. ## Installation Flow Overview 1. Setup the prerequisites. 1. Add a new Box application to Data Access Security. ## Box Connector Operation Principles - Data Access Security Connector for Box uses the Box Content API for permissions collection. - The Box Content API uses the OAuth 2.0 authorization protocol to authenticate and authorize API requests. - Data Access Security for Box Connector is a custom Box App, which requires a short authorization process. - After the initial authorization process, Data Access Security handles the OAuth token management automatically and refreshes the token if needed. ## Permissions Collection Operation Principles - Data Access Security Box Permissions Collection task uses a Box API to retrieve information from the Box application. Note Users will only display in the Box Resource Tree if they are an owner of a resource. - By default, permissions are analyzed on the folder level. In contrast to other application types, to improve performance, Box permissions are also fetched from the target application during the crawl task. You must rerun the crawl before rerunning a permission collection in order to pick up all permissions properly. The permissions will only display after the permission collection task has run, since they must be analyzed. If the crawler was unable to fetch the permissions, the permission collection task will fetch them. # Box Connector Prerequisites ## Dev Console Setup In order to monitor and manage user access and folder permissions, create a custom application within Box. This application will be configured with limited permissions, ensuring it only has access to the necessary data and functions. Generate a public/private key pair by running the following commends. These commands can be executed on both Windows and Linux systems. During the process of key creation, you are prompted to enter a passphrase or password. Use your password management tool to generate a secure passphrase. Remember to record this passphrase in a secure location for future reference. - `openssl genrsa -aes256 -out private_key.pem 2048` - `openssl rsa -pubout -in private_key.pem -out public_key.pem` Note Remember the password that is used while generating the private key. 1. Login into the Box Admin or Co-Admin account. 1. Select **Dev Console** at the bottom right. 1. Within My Apps, select **Custom App**. 1. Provide the following details: - App Name - Any name you choose - Purpose - Integration - Categories - Security & Compliance - Which external system are you integrating with? - SailPoint 1. Select **Next**. 1. Select **Server Authentication(with JWT)** and then select **Create App**. 1. It now takes you to the Configuration tab. 1. In the OAuth 2.0 Credentials section, copy **Client ID** and **Client Secret** for later use in the Console Authorization. 1. In the App Access Level section, select **App + Enterprise Access**. It will check boxes in Application Scope. 1. In the Application Scopes section, check the following options: - Write all filed and folders stored in Box - Manage Users - Manage Enterprise properties (only select this if you are using Activity Monitoring) 1. In the Advanced Features section, enable **Make API calls using the as-user header** and **Generate user access tokens**. 1. In the Add and Manage Public Keys section, select **Add a Public Key** and paste the text from public_key.pem that was generated in step 1. After a public key is added, Box will generate a public Key ID, note it down for later use. 1. Select **Save Changes**. Note If you have previously authorized the custom app after changing the custom app settings, go to Admin Console and re-authorize the app twice (You have to do this twice. This is a known Box bug). ## Box Admin Console Authorization 1. Log in as an admin or co-admin user. 1. Select **Admin Console** on the bottom right. Got to **Apps > Custom Apps Manager > Add App**. 1. Provide the Client ID from Dev Console Setup. 1. Authorize the app. ## Box User Permissions In order to create a Box application, you need to have either Administrator or Co-Administrator privileges in Box. For authentication of the Box application, server authentication is required. ## Adding a SailPoint Human Fabric Box Source Creating a new separate Box Custom App for SailPoint Human Fabric is recommended. For information on how to add a Box source in SailPoint Human Fabric, view [Integrating SailPoint with Box](https://documentation.sailpoint.com/connectors/box/help/integrating_box/introduction.html). ## Adding an Identity Collector Perform the following steps to add an identity collector: 1. Go to **Admin > Identity Collectors**. 1. Select **Create New** on the top right corner to open wizard. In General details: - Type - Box - Name - logical name for the Identity Collector (Example: Box IDC) In Connection Details, select the created SailPoint Human Fabric Box source. 1. User and Group Dynamic Fields Mappings are optional. 1. Select **Save**. Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. # Verifying the Box Connector Installation You can verify your Box connector installation by checking your application configuration and validations. ## Verifying Application Configuration After the configuration of the application is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common Box Validations - Verify connection with Box. - Verify access to Box enterprise name. - Verify access to Box users. - Verify access to Box folder items. - Verify Resource Crawler connection. - Verify Activity Monitoring connection. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks by going to **Settings > Task Management > Scheduled Tasks**. 1. Verify that: 1. The tasks completed successfully. 1. Business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). 1. Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a Box Application In order to integrate with Box, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## General Details 1. Review and edit the application's general details: - Application Type - Box - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. **Identity Collector** - (Mandatory) Select an Identity Collector of type Box. - You can create identity collectors on the **Admin > Identity Collectors** page. - Ensure you run the Identity Collector Aggregation task before running the Permission Collection Task. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Complete the Connection Details: - Enterprise ID - This comes from within **Admin Console > Account & Billing** - Public Key ID - Generated by Box after adding public key to Custom App. See step 12 in [Prerequisites](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/prerequisites.html) - Client ID - Refer to the [Prerequisites](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/prerequisites.html) section - Client Secret - Refer to the [Prerequisites](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/prerequisites.html) section - Private Key - Produces when performing a command as mentioned in [Prerequisites](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/prerequisites.html) - Private Key Password - Passphrase/password used when performing a command as mentioned [Prerequisites](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/atlassian_confluence/prerequisites.html) 1. Select **Next**. You can now [configure and schedule permissions collection and resource discovery](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/box/add/box_permission_collection.html). # Configuring Activity Monitoring 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Activity Monitoring** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Activity Monitoring** on. Note Verify auditing is enabled which was listed in the prerequisites. ## Activity Exclusions Note Activity Monitoring exclusions need to be manually added. Allows administrators to configure activities which are not desired to reduce unnecessary noise of activity data set. Activities which match exclusions will be discarded so they will not display in forensics or be held in any storage. To add an exclusion: 1. Type an exclusion into the relevant dropdown list (file extension, user, folder, actions). 1. Select the **+** icon to add it to the list. 1. Select to **Next** or **Cancel** to close the panel once the list is complete. To edit or remove an exclusion from the list: 1. Select the appropriate dropdown list. 1. On the desired extension that needs to be edited or removed, select either the edit or delete icon. 1. Select to **Next** or **Cancel** to close the panel. 1. Click **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., txt, exe. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., \\servername\\share1\\folder1. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. **Exclude Actions** - List of actions that are not monitored. e.g., copy file. ## Supported Event Types ### Admin Audit - Add_Device_Association - Add_Login_Activity_Device - Admin_Log - Change_Admin_Role - Copy - Copy_File - Collaboration_Accept - Collaboration_Expiration - Collaboration_Invite - Collaboration_Remove - Collaboration_Role_Change - Content_Workflow_Upload_Policy_Violation - Delete - Delete_File - Delete_User - Download - Download_File - Email_Alias_Add_Unconfirmed - Email_Alias_Confirm - Email_Alias_Primary - Email_Alias_Remove - Edit - Edit_File - Edit_User - Failed_Login - File_Marked_Malicious - Group_Add_File - Group_Add_Folder - Group_Add_Item - Group_Add_Item_File - Group_Add_User - Group_Admin_Created - Group_Admin_Deleted - Group_Creation - Group_Deletion - Group_Edited - Group_Remove_File - Group_Remove_Folder - Group_Remove_Item - Group_Remove_Item_File - Group_Remove_User - Item_Shared_Update - Item_Shared_Update_File - Item_Sync - Item_Sync_File - Item_Unsync - Item_Unsync_File - Lock - Lock_File - Login - Move - Move_File - New_User - Preview - Preview_File - Rename - Rename_File - Remove_Device_Association - Remove_Login_Activity_Device - Share - Share_Expiration - Share_Expiration_File - Share_File - Storage_Expiration - Storage_Expiration_File - Storage_Expiration_File - Terms_Of_Service_Agree - Terms_Of_Service_Reject - Undelete - Undelete_File - Unlock - Unlock_File - Unshare - Unshare_File - Update_Collaboration_Expiration - Update_Shared_Expiration - Update_Shared_Expiration_File - Upload_File - User_Authenticate_OAuth2_Access_Token_Create # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. 1. Navigate to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler** settings page. The actual entry fields vary according to the application type. 1. In the Calculate Resource Size field, determine when, or at what frequency, Data Access Security calculates the resources' size: - Never - Always - Second crawl and on (default) 1. [Schedule a task](#scheduling-a-task). ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. Note External resources are collected when crawling internal resources. When excluding internal resources the associated external resources will also be excluded. Crawling only external resources is not supported at this time. Exclusion of external resources is supported. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. 1. Navigate to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Click **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Click Include / Exclude Resources to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and click **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and click the *x* icon on the resource row. When creating exclusion lists, excludes take precedence over includes. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ### Crawler Regex Exclusion Examples The following are examples of crawler Regex exclusions: **Exclude all drives which start with one or more user names:** - Starting with John.Doe: `^Team Members\/John\.Doe@.*` - Starting with John.Doe or Jane.Doe: `^Team Members\/(John|Jane)\.Doe@.*` **Include ONLY drives which start with one or more user names:** - Starting with John.Doe: `^(?!Team Members\/John\.Doe@.*).*` - Starting with John.Doe or Jane.Doe: `^(?!Team Members\/(John|Jane)\.Doe@.*).*` **Narrow down the selection:** - Include only the C$ drive shares: `\\server_name\*C$:(?!\\\\server_name\\*C*\$($|\\.*)).*` - Include only one folder under a share: `\\server\share\*folderA*`: `^(?!\\\\server_name\\share\$($|\\*folderA*$|\\*folderA*\\.*)).*` - Include all administrative shares: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Selecting and Scheduling the Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Data Classification** on. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This cluster is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. If a central data classification service is selected, you can schedule a task. 1. Select **Next** or **Done**. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. Users should always run the crawl task before running a permission collection task. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Click the edit icon on the line of the application. 1. Select **Next** until you reach the **Permission Collector** settings page. Note The entry fields vary by application type. When entering this page in edit mode, navigate between the various configuration windows using the **Next** and **Back** buttons. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Once - Single execution task runs. - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. # Databricks Overview This connector enables you to use Data Access Security to govern Databricks data, including catalogs, schemas, tables, views, functions, and procedures. It does not govern workspace-only assets like jobs, notebooks, or clusters. Note For every one Data Access Security application, there is one Databricks metastore. The connector for Databricks can do the following: - Analyze the structure of your stored data. - Import data classification from Databricks if auto-classification is enabled. - Verify user permissions on the resources and compare them against requirements. - Integrate with SailPoint Human Fabric Source – Connect to a SailPoint Human Fabric Source to gather accounts and entitlements. # Prerequisites Complete the following prerequisites: 1. Add Databricks as a SailPoint Human Fabric source where your deployment requires it. 1. Before you can use Data Access Security to analyze your data in Databricks, make sure your Databricks account has a working environment (workspace) that's already linked to the data storage system (metastore) you want to govern. 1. Create a service principal (or reuse one that is aligned with your SailPoint Human Fabric Databricks source, if the policy allows) and an OAuth client secret (client ID and client secret). Save the client ID and client secret for later configuration. 1. Assign the [service principal](#service-principal-setup) to the target workspace as USER so that the Databricks APIs accept the connector token. 1. Grant the service principal the Databricks access needed to read metadata and permissions for each in-scope catalog. 1. In Data Access Security, you will configure the Cloud Type, Authentication Type, Grant Type, Client ID, Client Secret, Account ID, Metastore ID, and Workspace ID on the [connection details](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/databricks/add/index.html#connection-details) step. ## Authentication Data Access Security authenticates to Databricks using OAuth 2.0 client credentials and a service principal. For Azure, you can use Databricks M2M or Microsoft Entra Authentication. For AWS, use Databricks M2M. The Grant Type is Client Credentials. ### Service Principal Setup Complete the following steps to set up the service principal: 1. Configure a service principal for Data Access Security (or reuse the principal from your SailPoint Human Fabric Databricks source, if the policy allows). 1. In the Databricks account console, create or select the service principal and create an OAuth secret (client ID and client secret). 1. Select the service principal. 1. Open **Roles**. 1. Select **Assign** and then select **Account admin**. 1. Select **Save**. 1. Assign the service principal to the workspace attached to your metastore. 1. Grant the Databricks privileges so the principal can discover catalogs, schemas, and data objects you want governed, and read permissions on those securables for permission collection. Important Databricks is privilege-aware. This means the connector only sees metadata and grants for objects the principal can access. Catalogs or objects without sufficient privileges may be omitted from crawl results. "Metastore Admin" is not required for typical read-only inventory and permission collection. Run the following grants using the service principal Client ID (UUID) in backticks: ```sql GRANT USE CATALOG ON CATALOG system TO ``; GRANT USE SCHEMA ON SCHEMA system.information_schema TO ``; GRANT SELECT ON SCHEMA system.information_schema TO ``; GRANT SELECT ON TABLE system.data_classification.results TO ``; ``` For each in-scope catalog, grant: ```sql GRANT USE CATALOG ON CATALOG TO ``; GRANT USE SCHEMA ON CATALOG TO ``; GRANT MANAGE ON CATALOG TO ``; ``` # Verifying the Databricks Connector Installation You can verify your Databricks connector installation by checking your application configuration and validations. ## Verifying Application Configuration After the configuration of the application is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common Databricks Validations - Verify connectivity to Databricks - Check permissions to resources - Check permissions to classification results ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks by going to **Settings > Task Management > Scheduled Tasks**. 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a Databricks Application In order to integrate with Databricks, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select **Standard Application**. 1. Select **Next** to open the General Details page. ## General Details 1. Review and edit the application's general details: - Application Type - Databricks - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select Enter to create a tag. - Identity Collector - (Mandatory) Select an Identity Collector of type Databricks. You can create identity collectors on the **Admin > Identity Collectors** page or directly from the Source Configuration page. Ensure you run the Identity Collector Aggregation task before running the Permission Collection Task. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Complete the Connection Details: - Field Description Cloud Type - Azure or AWS - Authentication Type - Databricks M2M or Microsoft Entra Authentication when Azure is the Cloud Type - Grant Type - Client credentials - Tenant ID - Required only when Authentication Type is Microsoft Entra Authentication (Azure). Leave blank for Databricks M2M. - Client ID - Service principal application (client) ID - Client Secret - Service principal OAuth client secret - Account ID - Databricks account ID (GUID). Find it in the account console URL or account settings. - Metastore ID - Databricks metastore ID for the data you are governing - Workspace ID - Numeric workspace ID used for Databricks operations in this metastore Note The configuration wizard does not ask for a workspace URL, SQL warehouse ID, or personal access token. The platform resolves workspace connectivity from account, metastore, and workspace IDs. 1. Select **Next**. ## Service Principal Workspace Assignment Important For Databricks M2M, the service principal must be assigned to the workspace as USER. If it is not assigned, test connection and scheduled tasks may fail with OAuth or authorization errors. Assign the service principal using the Databricks account/workspace [administration documentation](https://documentation.sailpoint.com/connectors/saas/databricks/help/saas_connectivity/integrating_databricks/prerequisites.html). # Configuring the Crawl To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. Scroll through the list or use the filter to find the application. 1. Select the edit icon on the line of the application. 1. Select **Next** until you reach the Crawler settings page. The actual entry fields vary according to the application type. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the Crawler settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **X** icon on the resource row. 1. When creating exclusion lists, excludes take precedence over includes. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Crawler Regex Exclusion Examples Name - `> ^CATALOGS.*` Exclude Schema Name - `> ^CATALOG\.SCHEMA.*` Exclude Table or View Name - `> ^CATALOG\.SCHEMA\.TABLE$` # Configuring the Data Classification Important If classifications are enabled within Databricks, Data Access Security will ingest data classifications from Databricks. When the classification task is enabled for a Databricks application in Data Access Security, the Databricks classifications are imported as categories and correlated with the corresponding Databricks resources. To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the Data Classification settings page. Note The entry fields vary by application type. 1. Select the **Allow Data Classification** toggle to enable data classification. 1. To disable data classification, clear the **Allow Data Classification** toggle. Note You can also disable data classification by setting the scheduler to inactive, which is the default setting for data classification. 1. If a central data classification service is selected, schedule a task. 1. Select **Next** or **Done**. # Configuring and Scheduling the Permissions Collections Permissions can be analyzed to determine the application permissions of an application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. Users should always run the crawl task before running a permission collection task. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the Permission Collector settings page. Note The entry fields vary by application type. When entering this page in edit mode, navigate between the various configuration windows using the **Next** and **Back** buttons. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. # Dropbox Connector Overview Dropbox enhances Data Access Security's data discover, permission analysis, access review, and data classification capabilities. Dropbox allows administrators, business users, and data owners to gain visibility to the resources stored in the organization's Dropbox application, analyze who has access to this data, and how to access it. ## Permissions Collection Operation Principles Dropbox Permissions Collection task uses Dropbox Content API to retrieve information from the Dropbox application. Data Access Security creates a Dropbox Identity Collector automatically at the end of the “Add New Application” wizard, which collects the Users and Groups from Dropbox. # Dropbox Connector Prerequisites Make sure your system meets the prerequisites outlined in the [Dropbox Connector](https://documentation.sailpoint.com/connectors/dropbox/help/integrating_dropbox/prerequisites.html) guide. Note When setting up Dropbox, verify the events.read permission is enabled. If this was not enabled prior, you will need to create a new refresh token for the Data Access Security Dropbox application. ## Dropbox User Permissions During the OAuth authorization process, a Dropbox for Business Team DropAdmin user must grant the SailPoint Data Access Security Dropbox Application access to the data on Dropbox. ## Dropbox Administrator Permissions Applications created in Dropbox require the following permission, which has read and update rights: - Team member management – Team information, and the ability to add, edit, and delete team members Notes The default role for any user in the Dropbox source is Members_only and it cannot be deleted. ## Adding a SailPoint Human Fabric Dropbox Source Creating a new separate Dropbox Custom App for SailPoint Human Fabric is recommended. The following attributes are required: **Accounts (Identities)** - email - team_member_id - email - display_name - status Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. # Verifying Application Configuration After the configuration of one of the following applications is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common Dropbox Validations The following is a list of common validations that run when the test connection is run with a Dropbox application. - Ensure there is a valid app key and app secret. - Verify the refresh token has been configured. If this has to be validated, contact SailPoint support. - Verify the refresh token that was copied is only what is specified. - Verify the Dropbox connection. - Verify at least one team member has Admin privileges. - Verify the Permission Collection API account. - Verify the Data Classification API download. - Verify the Data Classification API export. - Verify the API permissions for folder items. - Verify the API permission for shared folders for members. - Verify the API permission for shared folders for metadata. - Verify the API permissions for shared links. - Verify the API permissions for team folders. - Verify the API permission for team information. - Verify the API permission for team members. - Verify the API permission for namespaces. - Verify the API permission for members by ID. - Verify the API permission for team log get events. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify: - the tasks completed successfully. - business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). - permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a Dropbox Application In order to integrate with Dropbox, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details 1. Review and edit the application's general details: - Application Type - Dropbox - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. **Identity Collector** - (Mandatory) Select an Identity Collector of type Dropbox. - You can create identity collectors on the **Admin > Identity Collectors** page. - Ensure you run the Identity Collector Aggregation task before running the Permission Collection Task. 1. Select **Next** to open the Connection Details page. ## Connection Details To connect your application, specify the required credentials to establish a secure connection. 1. Provide the following values for authentication: - Host URL - This is the endpoint to connect to the Dropbox managed system. For example: `https://api.dropbox.com`. - App Key - This is the application authentication key for the Dropbox managed system. - App Secret - This secret is associated with the App Key. - Refresh Token - A refresh token needs to be [generated](https://documentation.sailpoint.com/connectors/saas/dropbox/help/saas_connectivity/dropbox/prerequisites.html). Make sure the token has a long expiration date. You can now [configure and schedule permissions collection and resource discovery](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/dropbox/add/dropbox_permissions_collection.html). # Configuring Dropbox Activity Monitoring Monitored events are defined in the [Dropbox Business API specification](https://www.Dropbox.com/developers-v1/business/docs#log-get-events). This published event list is not comprehensive. Data Access Manager supports all event types. Some events are excluded by default. To modify which event types are excluded, edit the `excludedEventTypes` value in the `WBX.DropboxBAMHost.dll.config` file. 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Activity Monitoring** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Activity Monitoring** on. Note Verify auditing is enabled which was listed in the prerequisites. ## Activity Exclusions Note Activity Monitoring exclusions need to be manually added. Allows administrators to configure activities which are not desired to reduce unnecessary noise of activity data set. Activities which match exclusions will be discarded so they will not display in forensics or be held in any storage. To add an exclusion: 1. Type an exclusion into the relevant dropdown list (file extension, user, folder, actions). 1. Select the **+** icon to add it to the list. 1. Select to **Next** or **Cancel** to close the panel once the list is complete. To edit or remove an exclusion from the list: 1. Select the appropriate dropdown list. 1. On the desired extension that needs to be edited or removed, select either the edit or delete icon. 1. Select to **Next** or **Cancel** to close the panel. 1. Click **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., txt, exe. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., \\servername\\share1\\folder1. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. **Exclude Actions** - List of actions that are not monitored. e.g., copy file. ## Supported Event Types - Account Capture Change Policy - App Link Team - App Link User - App Unlink Team - App Unlink User - Camera Uploads Policy Changed - Capture Transcript Policy Changed - Classification Change Policy - Computer Backup Policy Changed - Content Administration Policy Changed - Data Placement Restriction Change Policy - Data Placement Restriction Satisfy Policy - Device Approvals Change Desktop Policy - Device Approvals Change Mobile Policy - Device Approvals Change Unlink Action - Device Delete On Unlink Fail - Device Delete On Unlink Success - Device Change Ip Mobile - Device Unlink - Dropbox Passwords Policy Changed - Email Ingest Policy Changed - Emm Change Policy - Extended Version History Change Policy - External Drive Backup Policy Changed - File Add - File Change Comment Subscription - File Comments Change Policy - File Copy - File Delete - File Locking Policy Changed - File Move - File Provider Migration Policy Changed - File Rename - File Request Receive File - File Requests Change Policy - File Transfers Policy Changed - Folder Link Restriction Policy Changed - Google Sso Change Policy - Governance Policy Add Folder Failed - Governance Policy Add Folders - Governance Policy Content Disposed - Governance Policy Create - Governance Policy Delete - Governance Policy Edit Details - Governance Policy Edit Duration - Governance Policy Export Created - Governance Policy Export Removed - Governance Policy Remove Folders - Governance Policy Report Created - Governance Policy Zip Part Downloaded - Group Create - Group Add Member - Group Change External Id - Group Change Management Type - Group Change Member Role - Group Rename - Group Join Policy Updated - Group User Management Change Policy - Integration Policy Changed - Invite Acceptance Email Policy Changed - Login Fail - Logout - Member Change Admin Role - Member Change Email - Member Change Name - Member Change Status - Member Permanently Delete Account Contents - Member Send Invite Policy Changed - Member Space Limits Change Caps Type Policy - Member Space Limits Change Policy - Member Suggest - Member Suggestions Change Policy - Member Transfer Account Contents - Member Requests Change Policy - Microsoft Office Addin Change Policy - Network Control Change Policy - Paper Change Deployment Policy - Paper Change Member Link Policy - Paper Change Member Policy - Paper Change Policy - Paper Default Folder Policy Changed - Paper Desktop Policy Changed - Paper Doc Change Sharing Policy - Password Change - Password Reset - Password Strength Requirements Change Policy - Permanent Delete Change Policy - Reseller Support Change Policy - Rewind Policy Changed - Secondary Mails Policy Changed - Send For Signature Policy Changed - Shared Content Copy - Shared Content Unshare - Shared Content Remove Invitees - Shared Content Download - Shared Content Change Invitee Role - Shared Content Change Member Role - Shared Content Change Viewer Info Policy - Shared Folder Change Link Policy - Shared Folder Change Members Inheritance Policy - Shared Folder Change Members Management Policy - Shared Folder Change Members Policy - Shared Folder Create - Shared Folder Mount - Shared Folder Transfer Ownership - Shared Link Add Expiry - Shared Link Change Expiry - Shared Link Change Visibility - Shared Link Create - Shared Link Disable - Shared Link Remove Expiry - Shared Link Settings Add Expiration - Shared Link Settings Add Password - Shared Link Settings Allow Download Disabled - Shared Link Settings Allow Download Enabled - Shared Link Settings Change Audience - Shared Link Settings Change Expiration - Shared Link Settings Remove Expiration - Shared Link Settings Remove Password - Shared Link Share - Shared Link View - Sharing Change Folder Join Policy - Sharing Change Link Allow Change Expiration Policy - Sharing Change Link Default Expiration Policy - Sharing Change Link Enforce Password Policy - Sharing Change Link Policy - Sharing Change Member Policy - Showcase Change Download Policy - Showcase Change Enabled Policy - Showcase Change External Sharing Policy - Sign In As Session Start - Smarter Smart Sync Policy Changed - Smart Sync Change Policy - Sso Change Policy - Team Activity Create Report - Team Branding Policy Changed - Team Extensions Policy Changed - Team Folder Create - Team Folder Change Status - Team Folder Rename - Team Profile Change Name - Team Selective Sync Policy Changed - Tfa Change Policy - Tfa Change Status - Two Account Change Policy - Viewer Info Policy Changed - Watermarking Policy Changed - Web Sessions Change Fixed Length Policy - Web Sessions Change Idle Length Policy - Team Folder Create - Team Folder Change Status - Team Folder Rename - Team Profile Change Name - Tfa Change Status # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. 1. Navigate to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler** settings page. The actual entry fields vary according to the application type. 1. In the Calculate Resource Size field, determine when, or at what frequency, Data Access Security calculates the resources' size: - Never - Always - Second crawl and on (default) 1. [Schedule a task](#scheduling-a-task). ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Crawler Regex Exclusion Examples The following are examples of crawler Regex exclusions: **Exclude all drives which start with one or more user names:** - Starting with John.Doe: `^Team Members\/John\.Doe@.*` - Starting with John.Doe or Jane.Doe: `^Team Members\/(John|Jane)\.Doe@.*` **Include ONLY drives which start with one or more user names:** - Starting with John.Doe: `^(?!Team Members\/John\.Doe@.*).*` - Starting with John.Doe or Jane.Doe: `^(?!Team Members\/(John|Jane)\.Doe@.*).*` **Narrow down the selection:** - Include only the C$ drive shares: `\\server_name\*C$:(?!\\\\server_name\\*C*\$($|\\.*)).*` - Include only one folder under a share: `\\server\share\*folderA*`: `^(?!\\\\server_name\\share\$($|\\*folderA*$|\\*folderA*\\.*)).*` - Include all administrative shares: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Selecting and Scheduling the Dropbox Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This service is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. If a central data classification service is selected, you can schedule a task. 1. Select **Next** or **Finish**. # Configuring and Scheduling the Dropbox Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. ## Configuring the Permission Collection The permission collector is a software component responsible for analyzing the permissions in an application. Dropbox Permissions Collection task uses Dropbox Content API to retrieve information from the Dropbox application. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collection** settings page. Note The entry fields vary by application type. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. # Google Drive Connector Overview This connector enables you to use Data Access Security to access and analyze data stored in Google Drive and do the following: - Analyze the structure of your stored data. - Classify the data being stored. - Verify user permissions on the resources, including internal user folders, shared folders, and folders shared by external users to the organizational user. ## Installation Flow Overview To install the Google Drive connector: 1. Configure the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/prereqs/index.html). 1. [Add](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/add/index.html) a new Google Drive application. ## Permissions Collection Operation Principles The Data Access Security Google Drive Permissions Collection task uses Google Drive APIs to retrieve information from Google Drive. ### Google APIs Data Access Security for Google Drive uses the following Google APIs: - Google Drive API for resource crawling and permissions collection - Google Admin SDK (Directory API) for domain identities (users, groups, and so on) Google APIs are accessed via a Service Account, defined within the scope of the customer’s Google Apps Domain. The Service Account has Domain-wide delegation permission so that it can impersonate domain users and access their Google Drive files, folders, users, permissions, and data. # Google Drive Mapping Conversion to a Business Resources Tree Google Drive mappings are converted to a business resources tree in the following ways: - Google Drive represents files and folders in a graph (a.k.a. map) data structure so that every node may have multiple parent and children nodes. In a tree structure, however, every node can have only one parent. For example, a folder shared by two users actually has two different parents - one in each of the user’s personal drives. - To maintain a recognizable structure for Google Drive resources, Data Access Security displays business resources in a tree, exactly as they are arranged from the user’s perspective. - When users share folders, flattening the graph structure into a tree results in duplicate resources, which are maintained to keep the structure recognizable. - If external users (external to the company’s Google Apps domain) share folders with domain users, a separate “External” tree root represents those resources. - If shared drives exist in the domain and have members assigned to them, a separate "Shared Drives" tree root represents those resources. ## Sample Schematic The following is a sample schematic of the Data Access Security Google Drive resource tree: ```text * External * private@gmail.com * sharedFolder1 * Shared Drives * Shared Drive 1 * sharedDriveFolder1 * sharedDriveFolder2 * Users * u1@my-company.com * Folder1 * Folder2 * u2@my-company.com * u3@my-company.com ``` # Verifying the Google Drive Connector Installation ## Verifying Application Configuration After the configuration is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common Google Drive Validations The following is a list of common validations that run when the test connection is run with a Google Drive application. - Verifying connectivity to Google Drive - Verifying the Google Admin API is enabled - Verifying the Google Drive API is enabled - Verifying the Google Drive Activity API is enabled ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify that: - The tasks completed successfully - Business resources were created in the resource explorer (**Admin > Applications > [application column] > Manage Resources**) - Permissions display in the Permission Forensics page (**Forensics > Permissions**) # Adding a Google Drive Application In order to integrate with Google Drive, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details 1. Review and edit the application's general details: - Application Type - Google Drive - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. **Identity Collector** - (Mandatory) Select an Identity Collector of type Google Drive. - You can create identity collectors on the **Admin > Identity Collectors** page. - Ensure you run the Identity Collector Aggregation task before running the Permission Collection Task. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Fill in the connection details: - Domain Admin User - The full user name of an admin user in your Google domain. Write the username as a UPN: `User@Domain.com`. - Domain Name - Your Google primary domain name. - Service Account - The full name of the [service account](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/prereqs/google_drive_permissions.html#creating-a-service-account-and-assigning-it-domain-wide-delegation), such as `@-123.iam.gserviceaccount.com` - Certificate File - The [certificate file](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/prereqs/google_drive_permissions.html#certificate-file) created when configuring Google Drive. Upload a certificate by dragging it onto the certificate field or selecting to open a file manager dialog. - Certificate Password - The password for the [certificate file](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/prereqs/google_drive_permissions.html#certificate-file). Notes - If a new certificate is uploaded when editing this application, the former password cannot be used. The user must provide a new password. - The user, domain, and service account name are case sensitive. 1. Select **Next**. You can now [configure and schedule permissions collection and resource discovery](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/add/google_drive_permissions_collection.html). # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. 1. Navigate to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler** settings page. The actual entry fields vary according to the application type. **Calculate Resource Size** Determine when, or at what frequency, Data Access Security calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (This is the default) **Create a Schedule** Click to open the schedule panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Crawler Regex Exclusion Examples **Exclude all drives which start with one or more user names:** - Exclude drives starting with John.Doe: `^Personal\/John\.Doe@.*` - Exclude drives starting with John.Doe or Jane.Doe: `^Personal\/(John|Jane)\.Doe@.*` **Include ONLY drives which start with one or more user names:** - Include only drives starting with John.Doe: `^(?!Personal\/John\.Doe@.*).*` - Include only drives starting with John.Doe or Jane.Doe: `^(?!Personal\/(John|Jane)\.Doe@.*).*` **Narrow down the selection:** - Include only the C$ drive shares: \\server_name\\C$: `^(?!\\\\server_name\\*C*\$($|\\.*)).*` - Include only one folder under a share: \\server\\share\\folderA: `^(?!\\\\server_name\\share\$($|\\*folderA*$|\\*folderA*\\.*)).*` - Include only administrative shares: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. Note If utilizing Exclude Top Level Resources, what is available to exclude is based on the type of connector. See the various [connector guides](https://documentation.sailpoint.com/das-connectors/help/index.html) for more details. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Configuring Google Drive Activity Monitoring 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Activity Monitoring** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Activity Monitoring** on. Note Verify auditing is enabled which was listed in the prerequisites. ## Activity Exclusions Note Activity Monitoring exclusions need to be manually added. Allows administrators to configure activities which are not desired to reduce unnecessary noise of activity data set. Activities which match exclusions will be discarded so they will not display in forensics or be held in any storage. To add an exclusion: 1. Type an exclusion into the relevant dropdown list (file extension, user, folder, actions). 1. Select the **+** icon to add it to the list. 1. Select to **Next** or **Cancel** to close the panel once the list is complete. To edit or remove an exclusion from the list: 1. Select the appropriate dropdown list. 1. On the desired extension that needs to be edited or removed, select either the edit or delete icon. 1. Select to **Next** or **Cancel** to close the panel. 1. Click **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., txt, exe. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., \\servername\\share1\\folder1. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. **Exclude Actions** - List of actions that are not monitored. e.g., copy file. ## Supported Event Types ### Admin Audit - Add_Group_Member - Add_Privilege - Assign_Role - Bulk_Upload - Change_Group_Name - Change_Password - Create_Group - Create_Role - Create_User - Delete_Group - Delete_Role - Delete_User - Gmail_Reset_User - Grant_Admin_Privilege - Grant_Delegates_Admin_Privileges - Remove_Group_Member - Remove_Privilege - Rename_User - Revoke_Admin_Privilege - Suspend_User - Unassign_Role - Unsuspend_User - UserFirstNameChanged - UserLastNameChanged ### Drive - AddedLinkAccess - AddedLinkAccessFile - AddedLinkVisibility - AddedLinkVisibilityFile - AddedPermission - AddedPermissionFile - AddedSharedDriveAccess - Comment - CommentFile - Create - CreateFile - DownloadFile - Edit - EditFile - EmptyTrash - EmptyTrashFile - LinkAccessChange - LinkVisibilityChange - Moved - MovedFile - PermissionChange - RemovedLinkAccess - RemovedLinkAccessFile - RemovedLinkVisibility - RemovedLinkVisibilityFile - RemovedPermission - RemovedPermissionFile - RemovedSharedDriveAccess - Rename - RenameFile - SharedDriveAccessChange - SharedDriveSettingsChange - Trash - TrashFile - Untrash - UntrashFile - Upload - UploadFile # Selecting and Scheduling the Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This service is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. If a central data classification service is selected, you can schedule a task. 1. Select **Next** or **Finish**. # Configuring and Scheduling the Google Drive Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. ## Configuring the Permission Collection The permission collector is a software component responsible for analyzing the permissions in an application. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collection** settings page. Note The entry fields vary by application type. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. # Google Drive Prerequisites Before installing Google Drive: 1. Set up your Google Drive [permissions](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/prereqs/google_drive_permissions.html). 1. [Create and grant permissions](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/prereqs/limiting_permissions.html) to a Data Access Security Google Administrator account. When you have completed the prerequisites, you will [add a Google Drive application](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/add/index.html). ## Adding a SailPoint Human Fabric Google Drive Source Creating a new separate Google Drive Custom App for SailPoint Human Fabric is recommended. For information on how to add a Google Source source in SailPoint Human Fabric, view [Integrating SailPoint with Google Drive](https://documentation.sailpoint.com/connectors/g_suite/help/integrating_g_suite/introduction.html). The following attributes are required: **Accounts (Identities)** - primaryEmail - ObjectID - givenName - familyName - suspended **Groups (Entitlements)** - Email ## Adding an Identity Collector Perform the following steps to add an identity collector: 1. Go to **Admin > Identity Collectors**. 1. Select **Create New** on the top right corner to open wizard. In General details: - Type - Google Drive - Name - logical name for the Identity Collector (Example: Google Drive IDC) In Connection Details, select the SailPoint Human Fabric created G Suite source. 1. User and Group Dynamic Fields Mappings are optional. 1. Select **Save**. Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. # Google Drive Permissions To enable Data Access Security to interact with Google Apps, you must: 1. Enable Google SDKs (Google Drive API, Drive Activity API, Admin SDK API). 1. Create a service account and assign it domain-wide delegation. 1. Delegate domain-wide authority to the service account. ## Enabling Google SDKs You must enable the Google Drive, Drive Activity, Admin SDK APIs. ### Creating a Project 1. Log in to your Google Apps [developer console](https://console.developers.google.com) using an administrative account for your Google Apps domain. 1. Select the **Project** dropdown list from the top bar and select **New Project**. 1. Name the project (e.g., Data Access Security) and select **Create**. 1. Wait for the project to be created and then select **Select Project** from the notification, or [identify the project](https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects) from the Dashboard page. 1. Using the previous dropdown list, ensure the new project is selected, otherwise you may default to the previous project. Refer to the Google Cloud [Creating and managing projects](https://cloud.google.com/resource-manager/docs/creating-managing-projects) documentation for more information. ### Enabling Google APIs [Enable and add](https://support.google.com/googleapi/answer/6158841?hl=en#) the following APIs: - Google Drive API - Drive Activity API - Admin SDK API ## Creating a Service Account and Assigning it Domain-Wide Delegation 1. In the top-left menu, choose **APIs & Services > Credentials**. Important This is an important step, failure to do so will mean you will create Credentials just for the last API you were in. 1. Select **Create Credentials**. 1. Select **Service account**. 1. Enter a name for the new service account in "Service account name" (e.g. "svc_das"). Note The user, domain, and service account name are all case sensitive. 1. Select **Create** then **Done**. 1. Verify that the new account is listed under within Credentials, under the **Service Accounts** heading. 1. Select on newly created account, or select the Edit icon. 1. Select the **Show Domain-wide Delegation** dropdown list. 1. Select **Enable G Suite Domain-wide Delegation**. If you get a message "To change domain wide delegation, a product name for the OAuth consent screen must be configured…", follow the prompts and create the Consent as instructed. 1. Select **Add Key > Create new key**. 1. Select **P12** under Key type. 1. Choose **Project Owner** as the role for this service account. 1. Select **Create**. 1. A certificate file (.p12) is downloaded to your computer. This file is required when [creating](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/add/index.html) the Google Drive application. 1. A popup window appears showing the password to the .p12 file. Save this password for future use when [adding](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/google_drive/add/index.html) Google Drive to Data Access Security. Note This popup is displayed only once. Copy the password, or you will have to define a new service account. 1. Copy the svc account email address `@-123.iam.gserviceaccount.com`. This will be needed when authorizing the service account. 1. Select **Show Domain-wide delegation** and then **Enable G Suite Domain wide delegation**. 1. Assign a Product Name as prompted, such as "DAS". 1. Copy the Unique ID number (the Client ID) to use when delegating domain-wide authority to the service account. 1. Select **Save**. ## Delegating Domain-Wide Authority to the Service Account 1. Go to [Google administrative console](https://admin.google.com). 1. Select **Security**. If it is not listed, select the **More controls** button at the bottom of the screen. 1. Select **API Controls**. 1. Choose **Domain Wide Delegation**. 1. Select **Add new**. 1. Under **Client ID**, paste the “Unique ID” (this is the same as the Client ID) of the service account you created in the previous step. 1. Under **Oath scopes (comma-delimited)**, paste the following in its entirety: , , , , , , 1. Select **Authorize**. # Limiting Data Access Security Permissions During the Application setup, you must provide a Domain Admin User for Data Access Security to collect data on the Google Drive domain. You can provide the Super Admin, or create a dedicated Data Access Security Google account with fewer permissions. ## Required Permissions The Data Access Security Google account requires the following permissions: **On the desired OU (Organizational Unit) level** - Organizational Units -> Read - Users -> Read **Domain-wide** - Groups -> Read - Reports You will also need the following permissions for crawling, permissions collections, and activities: **Crawling** The resource tree contains only OU users and folders for which a Data Access Security user has permissions. **Permissions Collection** Data Access Security only analyzes resources for permissions under scoped OUs. Since groups are defined on a domain-wide basis, rather than by OU, Data Access Security collects all domain groups. If users from OUs (for which a Data Access Security user lacks permission) have permissions on resources under the analyzed OU, those users are considered Data Access Security External Accounts, since Data Access Security cannot collect information on those users. **Data Classification** Data Access Security only indexes and classifies resources collected during a crawl (only resources to which a Data Access Security user has permissions). ## Granting Google Admin Account Permissions To create and grant permissions to a Data Access Security Google Administrator account, perform the following steps: 1. Sign in to the Google Administrator console (admin.google.com) using the Super Admin account (or any account that can create and grant Administrator roles and create users). 1. Select **Users**. If the User option is not displayed, select the More Controls bar at the bottom of the screen. 1. Choose an OU to create a Data Access Security account by hovering over the plus (+) sign at the bottom right corner of the screen. 1. Select **Add User**. 1. Fill in a name and primary email address and password for the user. Ensure you note the password for future reference. (For example, DAS_reader). 1. Select **Create**. 1. Select **Admin Roles** on the Google Admin console. 1. Select **Create a New Role**. (This will be the OU targeted role). 1. Type a role name and description. 1. Select **Create**. 1. Navigate to **Privileges** tab > **Admin Console Privileges** and select the following checkboxes: - *Organizational Units* > *Read* - *Users* > *Read* 1. Select **Save**. 1. Select the newly created role, and select Assign Admins under the Admins tab. 1. Select the desired OU from the drop-down list and type the name of the Data Access Security account. 1. Select **Confirm Assignment**. The role applies to the OU and all its descendants. You can assign the role to the same user on another OU later. 1. Select **Create a New Role**. (This will be a domain-wide role.) 1. Type a role name and description (for example, Data Access Security Domain Reader). 1. Select **Create**. 1. Navigate to **Privileges** tab > **Admin Console Privileges** and select the **Reports** checkbox. 1. Navigate to **Privileges** tab > **Admin API Privileges** to verify Groups is set to **Read**. 1. Select **Save**. 1. Select the newly created role, and select **Assign Admins** under the Admins tab. 1. Type the Data Access Security account. 1. Select **Confirm Assignment**. # Snowflake Overview The connector enables you to use Data Access Security to access and analyze data stored in Snowflake and do the following: - Analyze the structure of your stored data. - Retrieve classification results from data being stored. - Verify user permissions on the resources and compare them against requirements. - Integration with SailPoint Human Fabric Source – Connect to a SailPoint Human Fabric Source to gather accounts and entitlements. # Prerequisites Important Snowflake needs to be added as a SailPoint Human Fabric source. To connect to Snowflake, you must have a public and private key or you must generate them. The keys are generated in the PEM format. For more information, refer to Generating Keys. Note SailPoint only supports the encrypted private key for connecting to Snowflake to ensure maximum security. By default, Windows systems do not support OpenSSL. You may need to download and install the OpenSSL libraries to generate your keys. Apple systems support OpenSSL by default. Go to OpenSSL to download OpenSSL for Windows. ## Generating Keys To connect to Snowflake, you must have a public and private key or you must generate them. The keys are generated in the PEM format. Note - SailPoint only supports the encrypted private key for connecting to Snowflake to ensure maximum security. - By default, Windows systems do not support OpenSSL. You may need to download and install the OpenSSL libraries to generate your keys. Apple systems support OpenSSL by default. Go to OpenSSL to download [OpenSSL](https://openssl-library.org/source/) for Windows. - The generated private key is required as an input on the Connection Settings page. To generate the private and public keys, complete the following: 1. On your system, open a command prompt, terminal, or emulator and use the following command to generate an encrypted version of the private key: `openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8` The command to generate an encrypted key prompts you to enter a passphrase to regulate access to the key. SailPoint recommends storing the passphrase in a secure location. 1. Use the following command to generate an encrypted version of the public key: `openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub` 1. Copy the public and private key files to a local directory for storage. Record the path to the files. Note The private key is stored using the PKCS#8 (Public Key Cryptography Standards) format and is encrypted using the passphrase you specified in the first step. The file should still be protected from unauthorized access using the file permission mechanism provided by your operating system, however. It is your responsibility to secure the file when it is not being used. ## Required Permissions Complete the following to set up a Snowflake administrative account with the minimum required permissions for the listed operation: 1. Login to snowflake with ACCOUNTADMIN role and execute the following command: `CREATE USER "UserName";` 1. Generate the public key. The public key is in the PEM format. For more information on generating the public key, refer to Generating Keys. The following is an example of the public key in PEM format: `-----BEGIN PUBLIC KEY-----` `MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy+Fw2qv4Roud3l6tjPH4` `zxybHjmZ5rhtCz9jppCV8UTWvEXxa88IGRIHbJ/PwKW/mR8LXdfI7l/9vCMXX4mk` `...` `-----END PUBLIC KEY-----` 1. In the following command, replace PublicKey with the key you generated (do not include the BEGIN PUBLIC KEY and END PUBLIC KEY lines): `ALTER USER "UserName" SET RSA_PUBLIC_KEY='PublicKey';` For example: ```text ALTER USER MYUSER SET RSA_PUBLIC_KEY='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1hhZwJvU4+MiD92bLLmf zvdieU6TvuaSrjKJGtEndSWRR3p2pMFIzDWbbX1PHPqtt43C+meMtKtwMVl8JWEk IawC7ZnfjHROufWVhpb+8DwhHuH/r7GWXCNCyjJTH/Z+htdIYFM/pbSKW1Qdt5X0 Bf5TGINAe9XxL2Zp5kqo8pYMiPGudgUdYQlMGZ6y1AH0Rcb76KUkoHNrJQA/xRI8 LSDMNJQSJo6rPGARD1Rn9ns0Z3M1qnoH6LOOX0GX3T4GU+ERwPaMVcMjkweSA3a1 sqLhq+9hpC8piW+LaEv2clj1Sp73m70qh/0l8Cb2O4sq7Iov8G8Iahe0LGLVQX3+ uQIDAQAB'; ``` 1. Use the following command to verify the user's public key fingerprint: `DESCRIBE USER "UserName";` 1. Use the following command to create a role: `CREATE ROLE "Rolename";` 1. Snowflake recommends creating a hierarchy of custom roles, with the top-most custom role assigned to the system role SYSADMIN. For more information, refer to the Snowflake documentation. Use the following command to assign the SYSADMIN role: `GRANT ROLE "Rolename" TO ROLE SYSADMIN;` 1. Use the following command to grant a role to a user: `GRANT ROLE "Rolename" TO USER "UserName";` 1. Use the following command to set a user's default role: `ALTER USER "UserName" SET DEFAULT_ROLE = "Rolename";` 1. Create a new warehouse if no existing warehouse is present. `CREATE WAREHOUSE WAREHOUSENAME ;` 1. Use the following command to set default_warehouse to a user: `ALTER USER username SET DEFAULT_WAREHOUSE=WAREHOUSENAME` 1. Use the following command to provide warehouse usage on the role: `GRANT USAGE ON WAREHOUSE WAREHOUSENAME TO ROLE "RoleName";` 1. Ensure the below is already set. `ALTER USER username SET default_role="RoleName"` 1. Use the following commands to grant a database role to a role: `GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER TO ROLE "Rolename";` `GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE "Rolename";` 1. Use the following commands to have permission privileges: `GRANT USAGE ON DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT USAGE ON FUTURE SCHEMAS IN DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT USAGE ON ALL SCHEMAS IN DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT REFERENCES ON FUTURE TABLES IN DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT REFERENCES ON ALL TABLES IN DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT REFERENCES ON FUTURE VIEWS IN DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT REFERENCES ON ALL VIEWS IN DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT USAGE ON FUTURE FUNCTIONS IN DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT USAGE ON ALL FUNCTIONS IN DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT USAGE ON FUTURE PROCEDURES IN DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT USAGE ON ALL PROCEDURES IN DATABASE "DatabaseName" TO ROLE "Rolename";` `GRANT REFERENCES ON ALL MATERIALIZED VIEWS IN DATABASE "DatabaseName" TO ROLE "RoleName";` `GRANT REFERENCES ON FUTURE MATERIALIZED VIEWS IN DATABASE "DatabaseName" TO ROLE "RoleName";` Important The whole script needs to be repeated per database. 1. Use the following commands to have data classification privileges: `GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE "Rolename";` Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. # Verifying the Snowflake Connector Installation You can verify your Snowflake connector installation by checking your application configuration and validations. ## Verifying Application Configuration After the configuration of the application is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common Snowflake Validations - Verify connectivity to Snowflake - Verify permissions to account usages views - Verify permissions to classification results ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks by going to **Settings > Task Management > Scheduled Tasks**. 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a Snowflake Application In order to integrate with Snowflake, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select **Standard Application**. 1. Select **Next** to open the General Details page. ## General Details 1. Review and edit the application's general details: - Application Type - Snowflake - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select Enter to create a tag. - Identity Collector - (Mandatory) Select an Identity Collector of type Snowflake. You can create identity collectors on the Admin > Identity Collectors page. Ensure you run the Identity Collector Aggregation task before running the Permission Collection Task. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Complete the Connection Details: - Base URL - Connection URL to Snowflake. For example, https://-.snowflakecomputing.com. - Authentication Type - Key Pair Authentication - Organization - Your Snowflake organization name - Account - Snowflake account - User Name - Configured user to log into the Snowflake organization account - Private Key - used to authenticate with the Snowflake system. For more information on generating private keys, refer to [Generating Keys](https://documentation.sailpoint.com/das-connectors/help/cloud_file_storage/snowflake/snowflake_prereqs.html). Note When you enter the private key you must enter the whole private key, including the BEGIN PRIVATE KEY and END PRIVATE KEY lines. For example: -----BEGIN ENCRYPTED PRIVATE KEY----- *HASH VALUE* -----END ENCRYPTED PRIVATE KEY----- - Private Key Passphrase - To validate the private key. This was created when you generated the public and private keys. 1. Select **Next**. # Configuring the Crawl To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. 1. Navigate to **Admin > Applications**. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the Crawler settings page. The actual entry fields vary according to the application type. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. Note External resources are collected when crawling internal resources. When excluding internal resources the associated external resources will also be excluded. Crawling only external resources is not supported at this time. Exclusion of external resources is supported. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. 1. Navigate to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the Crawler settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select Advanced Crawl Scope Configuration to open the scope configuration panel. 1. Select Include / Exclude Resources to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and click + to add it to the list. 1. To remove a resource from a list, find the resource from the list, and click the x icon on the resource row. 1. When creating exclusion lists, excludes take precedence over includes. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Crawler Regex Exclusion Examples Name - `> ^DATABASE.*` Exclude Schema Name - `> ^DATABASE\.SCHEMA.*` Exclude Table or View Name - `> ^DATABASE\.SCHEMA\.TABLE$` # Selecting and Scheduling the Data Classification Settings Important If classifications are enabled within Snowflake, Data Access Security will ingest data classifications from Snowflake. Snowflake supports both built-in and custom classifiers. When the classification task is enabled for a Snowflake application in Data Access Security, the Snowflake classifications are imported as categories and correlated with the corresponding Snowflake resources. To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Toggle **Data Classification** on. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. If a central data classification service is selected, you can schedule a task. 1. Select **Next** or **Finish**. # Configuring and Scheduling the Permissions Collections Permissions can be analyzed to determine the application permissions of an application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. Users should always run the crawl task before running a permission collection task. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the edit icon on the line of the application. 1. Select **Next** until you reach the Permission Collector settings page. Note The entry fields vary by application type. When entering this page in edit mode, navigate between the various configuration windows using the **Next** and **Back** buttons. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. # NetApp Connector Overview This connector enables you to use Data Access Security to access and analyze data stored in NetApp and do the following: - Analyze the structure of your stored data. - Classify the data being stored. - Verify user permissions on the resources and compare them against requirements. - Identity collector – collect IAM users, groups, and roles and the connections between them. ## Installation Flow Overview 1. Setup the prerequisites. 1. Add a new NetApp application to Data Access Security. ## Collecting Data Stored in a Managed Application The list below describes the high-level installation process required to collect and analyze data from an external application. Most of these should already be set up in your Data Access Security installation. 1. Create an application in Data Access Security. 1. Create a [Virtual Appliance Cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) if utilizing Permission Collection, Crawler, Data Classification, or Activity Monitoring. # Activity Monitoring Disconnecting If the Activity Monitoring is disconnecting, verify all virtual appliances within the cluster are specified in the external engine configuration as primary servers, separated by commas. When a cluster with multiple virtual appliances is configured to work with a NetApp application, all virtual appliances in the cluster expect to receive requests from the NetApp Vserver. The virtual appliances will attempt to restart the policy for the applications they don’t receive messages for. # Verifying Application Configuration After the configuration is complete, verify NetApp was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ## Common NetApp Validations The following is a list of common validations that run when the test connection is run with a NetApp application. - Verifying the ability to list shares for the crawler - Verifying the ability to list shares for data classification - Verifying the membership to the Backup Operators group - Check access to NetApp ONTAP API - Check connection between Activity Monitor NetApp SMB - Check connection between FPolicy and Activity Monitor ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks by going to **Settings > Task Management > Scheduled Tasks**. 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer by going to **Admin > Applications > *[application column]* > Manage Resources**. - Permissions display in the Permission Forensics page by going to **Forensics > Permissions**. # Adding a NetApp Application In order to integrate with NetApp, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Navigate to **Admin > Applications**. 1. Click **Add New** to open the wizard. ## General Details 1. Review and edit the application's general details: - Application Type - NetApp - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. - Identity Collector - Select the appropriate type of Identity Collector. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Complete the connection details: - Filer Name - The CIFS server name to which users connect. - Domain Name, Username, and Password - User defined in the prerequisites. - **When working with NetApp Cluster-Mode**: - If communicating directly with the Vserver: - Management IP: The Vserver’s management IP. If it’s the same as the data access IP, leave empty. - Use Management IP for tunneling: Leave unchecked - If using Vserver Tunneling: - Management IP: The cluster management IP. - Use Management IP for tunneling: Checked - vFiler / Vserver Name: The target vFiler’s name in NetApp settings. - Vserver UUID - The UUID is a globally unique identifier assigned to each Vserver by NetApp. It helps the system differentiate between Vservers, even if they have similar names or reside in different environments. To retrieve the UUID for a specific Vserver, refer to the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/nas_file_storage/prereqs/index.html) section. - FPolicy SSL Setting - Pertains to Activity Monitoring. Should match the ssl-option setting chosen for the FPolicy external engine in the Prerequisites section. All NetApp Vservers that target the same virtual appliance need to have the *same* secure communication configuration to work properly. - No Auth - Default. Uses no encryption or authentication between the Vserver and the VA. - Server Auth - Encrypts the messages and authenticates the virtual appliance (the FPolicy server). Requires a pfx/p12 certificate for the FPolicy server. - Mutual Auth - Encrypts the messages and authenticates the both virtual appliance (the FPolicy server) and the Vserver. Requires a pfx/p12 certificate for the FPolicy server and a pem/cer certificate for the Vserver. 1. Select **Next**. # Configuring NetApp Activity Monitoring 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Activity Monitoring** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Activity Monitoring** on. 1. Associate the application with a Data Access Security Activity Monitoring Collection Cluster. This cluster is responsible for running the Activity Monitoring data collection tasks on dedicated virtual appliances. Note This connector requires the activity monitoring virtual appliance to accept incoming network connections on port 13000. SailPoint recommends restricting incoming network access to only the devices that generate the relevant audit events. Note Verify auditing is enabled which was listed in the prerequisites. ## Setting the Data Retention Period Setting a data retention period allows the user to specify how long activities will be stored offline. Activities are available on the [Activity Forensics](https://documentation.sailpoint.com/das/help/forensics/activity_forensics.html) screen for a default of 12 months. After the initial 12 months, the activity data is retained and available via a support ticket. You can set a retention period from between 1 month and 7 years. After the retention period is met, all activities will be deleted. **Example:** If the data retention period in the application configuration is set to 18 months, the activities will be available in Data Access Security for the initial 12 months and then available by a support ticket for the 18 additional months, making it a total of 30 months. Note If any configuration changes are made after activity monitoring is initially enabled, save the changes and wait for about 60 seconds, or restart the virtual appliance to allow the changes to take effect. Note If a password in the configuration changes, the old password is cached for activity monitoring for 24 hours. Restart the activity monitoring virtual appliance cluster to ensure the password update takes effect and prevent the use of the cached password within the next 24 hours. ## Activity Exclusions Note Activity Monitoring exclusions need to be manually added. Allows administrators to configure activities which are not desired to reduce unnecessary noise of activity data set. Activities which match exclusions will be discarded so they will not display in forensics or be held in any storage. To add an exclusion: 1. Type an exclusion into the relevant dropdown list (file extension, user, folder, actions). 1. Select the **+** icon to add it to the list. 1. Select to **Next** or **Cancel** to close the panel once the list is complete. To edit or remove an exclusion from the list: 1. Select the appropriate dropdown list. 1. On the desired extension that needs to be edited or removed, select either the edit or delete icon. 1. Select to **Next** or **Cancel** to close the panel. 1. Click **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., txt, exe. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., \\servername\\share1\\folder1. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. **Exclude Actions** - List of actions that are not monitored. e.g., copy file. ## Supported Event Types - Create File - Create Folder - Create from Move - Create from Rename - Delete File - Delete Folder - Move File - Move Folder - Permission Change File - Permission Change Folder - Read File - Rename File - Rename Folder - Write File # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. **Resource Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. 1. Set the Crawl Snapshot Folders accordingly if you want to crawl the snapshot folders. 1. In the Calculate Resource Size field, determine when, or at what frequency, Data Access Security calculates the resources' size: - Never - Always - Second crawl and on (default) 1. [Schedule a task](#scheduling-a-task). 1. Set the Crawl Scope by: - Setting an explicit [list of resources](#including-and-excluding-paths-by-list) to include or exclude from the scan. - [Creating a regex](#excluding-paths-by-regex) to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. Note The entry fields vary by application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, enter the full path to include or exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. Note The entry fields vary by application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Enter the paths to exclude by regex. Since the system does not collect Business Resources that match this regex, it also does not analyze them for permissions. ### Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: **Exclude all shares which start with one or more shares names:** - Starting with `\\server_name\shareName` Regex:`\\\\server_name\\shareName$` - Starting with `\\server_name\shareName or \\server_name\OtherShareName` Regex: `\\\\server_name\\(shareName|OtherShareName)$` **Include ONLY shares which start with one or more shares names:** - Starting with `\\server_name\shareName` Regex: `^(?!\\\\server_name\\shareName($|\\.*)).*` - Starting with `\\server_name\shareName or \\server_name\OtherShareName` Regex: `^(?!\\\\server_name\\(shareName|OtherShareName)($|\\.*)).*` **Narrow down the selection:** - Include ONLY the C$ drive shares: `\\server_name\C$` Regex: `^(?!\\\\server_name\\C\$($|\\.*)).*` - Include ONLY one folder under a share: `\\server\share\folderA` Regex: `^(?!\\\\server_name\\share\$($|\\folderA$|\\folderA\\.*)).*` - Include ONLY all administrative shares Regex: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Selecting and Scheduling the Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Associate the application with a Data Access Security [Data Classification Collection Cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html#data-classification-virtual-appliances). This service is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. 1. Select **Next** or **Finish**. # Configuring and Scheduling the NetApp Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. ## Configuring the Permission Collection The permission collector is a software component responsible for analyzing the permissions in an application. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collection** settings page. **Permission Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. Note The entry fields vary by application type. ### Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select the **Active** checkbox to activate the schedule. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Once - Single execution task runs. - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select **Next**. # NetApp Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Permission and Networking Requirements Perform the following steps to configure required permission for all Data Access Security tasks: 1. Create a dedicated domain user for the filer (for example, DAS\_). This user will be used in the application configuration. 1. This user must be a member of the Backup Operators and Power Users groups on the NetApp SVM/Vserver. 1. Additional setup and permissions are required for Activity Monitoring, which utilizes NetApp FPolicy and the NetApp ONTAP API (ONTAPI/ZEDI). These can be seen below. Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. ### Port Requirements for Virtual Appliance | **Requirement** | **Source** | **Destination** | **Port** | | ----------------------- | --------------------------------------------------------------------------------------- | ------------------------------------------- | ----------- | | NetApp API (FPolicy) | DAS Activity Monitor VA | NetApp Vserver/cluster management interface | 443 (https) | | NetApp events (FPolicy) | NetApp | DAS Activity Monitor VA | 12000 | | NetApp SMB access | DAS Activity Monitor/Resource Collector/Permissions Collector/Data Classification VA(s) | NetApp Vserver data interface | 445 | ## NetApp CLI Commands for Activity Monitoring 1. Create a new role for Data Access Security for the CIFS Vserver. For example, das_role. Replace (v_server) with CIFS Vserver name if you intend to use the Vserver’s management interface for API access, or the cluster name if you intend to use the cluster’s management interface for API access. `security login role create -role das_role -cmddirname "vserver fpolicy enable" -vserver (v_server) -access all` `security login role create -role das_role -cmddirname "vserver fpolicy disable" -vserver (v_server) -access all` 1. Assign the newly created role to the domain user created for Data Access Security (upper and lower case are important). `security login create -vserver (v_server) -username domain\domainAccountDas -application ontapi -authmethod domain -role das_role` 1. If no domain-tunnel is configured, run the following command (this command should be run only once, and not for each vserver). `security login domain-tunnel create -vserver (v_server)` 1. Execute the following commands to configure an FPolicy policy for the Vserver. Replace (v_server) with the Vserver name, (va1_ip_address),(va2_ip_address),… with a comma-separated list of the IP addresses of your Activity Monitor VAs, and (ssl_option) with one of the following: no-auth, server-auth, mutual-auth (more on these options in the Adding a NetApp Application section below). `fpolicy policy event create -event-name das_cifs_events -protocol cifs -file-operations create,create_dir,delete,delete_dir,read,write,rename,rename_dir,setattr,open -vserver (v_server) -filters first-read,first-write,open-with-delete-intent` `fpolicy policy external-engine create -vserver (v_server) -engine-name das_cifs_engine -primary-servers (va1_ip_address),(va2_ip_address),... -port 12000 -extern-engine-type asynchronous -ssl-option no-auth` `fpolicy policy create -vserver (v_server) -policy-name wbx_cifs_policy -events das_cifs_events -engine das_cifs_engine -is-mandatory false` `fpolicy policy scope create -vserver (v_server) -policy-name wbx_cifs_policy -volumes-to-include *` `fpolicy enable -vserver (v_server) -policy-name wbx_cifs_policy -sequence-number 1` 1. When creating a NetApp application in Data Access Security and a VServer UUID is required, run the following command. `vserver show -vserver -fields uuid` Note The policy name wbx_cifs_policy is mandatory. If utilizing the secure communication options, see the [document from NetApp](https://docs.netapp.com/us-en/ontap-cli/vserver-fpolicy-policy-external-engine-create.html#parameters) for more information on how to set up the FPolicy external-engine component with other ssl-option values. Note All NetApp Vservers that target the same virtual appliance need to have the *same* secure communication configuration to work properly. There will be more settings to configure to support this in the Adding a NetApp Application section under [Connection Details](https://documentation.sailpoint.com/das-connectors/help/nas_file_storage/add/index.html#connection-details) SSL Option. # Office 365 File Storage - [OneDrive](https://documentation.sailpoint.com/das-connectors/help/o365/one_drive/index.html) - [SharePoint Online](https://documentation.sailpoint.com/das-connectors/help/o365/sharepoint_online/index.html) - [Exchange Online](https://documentation.sailpoint.com/das-connectors/help/o365/exchange_online/index.html) ## Capabilities The Office 365 connectors enable you to use Data Access Security to access and analyze their stored data, as well: - Analyze the structure of your stored data. - Classify the data being stored. - Verify user permissions on the resources and compare them against requirements. - Utilize SailPoint Human Fabric source information to enrich data. ## Collecting Data Stored in a Managed Application The list below describes the high-level installation process required to collect and analyze data from an external application. Most of these should already be set up in your Data Access Security installation. 1. Create an Application in Data Access Security. 1. Create a [Virtual Appliance cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) if utilizing Data Classification. # Office 365 File Storage Prerequisites Make sure your system fits the descriptions below before starting the installation. Note Some prerequisites differ for Exchange Online. Refer to [Exchange Online Prerequisites](https://documentation.sailpoint.com/das-connectors/help/o365/exchange_online/exchange_online_prereqs.html). When you have confirmed your system meets the requirements, you will create an Azure application for your [OneDrive](https://documentation.sailpoint.com/das-connectors/help/o365/one_drive/one_drive_creating_azure_app.html), [SharePoint Online](https://documentation.sailpoint.com/das-connectors/help/o365/sharepoint_online/spo_creating_azure_app.html), or [Exchange Online](https://documentation.sailpoint.com/das-connectors/help/o365/exchange_online/exchange_online_create_azure_app.html) connector. ## Permissions ***Activity Monitor*** To perform Activity Monitoring, the Azure AD application for SharePoint Online requires the `ActivityFeed.Read` permission to access the Office 365 Management APIs. You must also ensure auditing is enabled for your tenant. Refer to [Microsoft auditing](https://learn.microsoft.com/en-us/purview/audit-log-enable-disable?tabs=microsoft-purview-portal) documentation for details. To verify auditing was enabled correctly, go to the compliance portal and see if activities are displaying. Note According to Microsoft, it may take some time before auditing is fully enabled on your tenant. ***Permissions Collection*** To perform crawl and permissions collection, the Azure AD application for SharePoint Online requires the `Sites.FullControl.All` permission to access the SharePoint APIs. ### OneDrive Azure Application Permissions | Feature | Permission in Azure App Registration | | ---------------------- | ------------------------------------------------------------------------------------------- | | Crawl | Microsoft Graph- Sites.Read.All- Files.Read.All- Users.Read.All- (optional) Domain.Read.All | | Permission Collection | Microsoft Graph- Files.Read.All SharePoint- Sites.FullControl.All | | Data Classification | Microsoft Graph- Files.Read.All | | Activity Monitoring | Office 365 Management APIs- ActivityFeed.Read | | Data Access Revocation | Microsoft Graph- Files.ReadWrite.All | ### SharePoint Online Azure Application Permissions | Feature | Permission in Azure App Registration | | ---------------------- | --------------------------------------------- | | Crawl | Microsoft Graph- Sites.Read.All | | Permission Collection | SharePoint- Sites.FullControl.All | | Data Classification | SharePoint- Sites.FullControl.All | | Activity Monitoring | Office 365 Management APIs- ActivityFeed.Read | | Data Access Revocation | Microsoft Graph- Files.ReadWrite.All | ## Communication Requirements | Requirement | Source | Destination | Port | | -------------------------------------------- | ------------------------------------------------------------------- | ------------------------ | ----- | | Permissions Collection / Data Classification | Permissions Collector/Data Classification | SharePoint Online | https | | Activity Monitoring | Activity Monitor | Office365 Activity API | https | | OAuth Access Token Acquisition | Permission Collector/Data Classification Collector/Activity Monitor | Microsoft Token Endpoint | https | Access to the following over HTTPS: - https://{tenant-name}.sharepoint.com/\* - https://{tenant-name}-admin.sharepoint.com/\* - https://{tenant-name}-my.sharepoint.com/\* - \* - to monitor and collect event data, using the Microsoft Management API - \* - for OAuth access token acquisition. ### Azure Active Directory Connectivity Requirements The OneDrive and SharePoint Online Connectors require an AzureAD Identity Collector. The following attributes are required: **Accounts (Identities)** - userPrincipalName - objectId - domain - mail - displayName **Groups (Entitlements)** - displayName Data Access Security uses the Microsoft Graph REST API, which works exclusively in HTTPs. The API base path is: , where the tenant domain name is the customer assigned domain name on Microsoft cloud. It is usually in the format of domain_name.onmicrosoft.com, but might be different in your configuration. A list of resources that are accessed by Data Access Security using the REST graph API include: - - - - - - - Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. # Exchange Online Connector Overview The Exchange Online connector allows you to access and analyze data. ## Exchange Online Connector OAuth 2.0 Support The connector uses fully Modern Authentication methods, and does not require Legacy Authentication methods be enabled, tenant-wide, or otherwise. ## Exchange Online Connector Installation Flow Overview To install the Exchange Online connector: 1. Configure all the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/o365/exchange_online/exchange_online_prereqs.html). 1. Add a new Exchange Online [application](https://documentation.sailpoint.com/das-connectors/help/o365/exchange_online/add/index.html). ### Permissions Collection Operation Principle The Data Access Security Connector connects using the PowerShell interface and analyzes mailboxes, folders, public folders, and their permissions. # Creating an Azure Application for Exchange Online A new Azure application must be created and configured to support the Data Access Security Exchange Online functionality. This configuration can be performed either by running the automated powershell script supplied with the SailPoint distribution pack, or by creating and configuring the application through the Azure portal. ## Creating and Configuring the Application Automatically There is a powershell script below will perform all the Azure application creation and configuration steps required for Exchange Online. To run this script the Azure AD powershell module must be installed. 1. Open PowerShell as an Administrator. 1. Install the Microsoft Graph PowerShell module: `Install-Module -Name Microsoft.Graph` 1. Open the `CreateExchangeOnlineApp.ps1` file in a text editor to review the default parameters. The parameters can be edited in the file or passed as parameters when running the script. CreateExchangeOnlineApp.ps1 ```powershell # Configures Azure Application for use as DAS Exchange Online Application: # Creates Azure app with the following permissions: # Office 365 Exchange Online: # Exchange.ManageAsApp # Office 365 Management APIs: # ActivityFeed.Read # Creates and uploads certificate as app client credential. # Assigns application to directory role. # Prompts for application admin consent. # # NOTE: AzureAD PowerShell is deprecated. Use Microsoft.Graph instead. param( [string]$AppName = 'DAS Exchange Cloud App', [string]$DirectoryRole = 'Exchange Administrator', # DnsName will be included in Cert subject name [string]$CertDnsName = 'organization.com', [int]$CertYearsValid = 10, [int]$SleepBeforeConsentSeconds = 30, [Parameter(Mandatory=$True)] [Security.SecureString]$CertPassword ) # Stop the script on error $ErrorActionPreference = "Stop" '' 'Connecting to Microsoft Graph...' # Import only the Graph submodules needed for this script to reduce startup time $graphModules = @( 'Microsoft.Graph.Authentication', 'Microsoft.Graph.Applications', 'Microsoft.Graph.Identity.DirectoryManagement' ) foreach ($module in $graphModules) { if (-not (Get-Module -ListAvailable -Name $module)) { throw "Required module not found: $module" } Import-Module $module -ErrorAction Stop } Connect-MgGraph -Scopes 'Application.Read.All', 'Application.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All', 'Directory.ReadWrite.All', 'RoleManagement.ReadWrite.Directory', 'Organization.Read.All' '' 'Getting required API details...' function Get-RequireResource{ param($appId, $permissionValues) $appObj = (Get-MgServicePrincipal -Filter ("AppId eq '{0}'" -f $appId)) $appPermissions = $appObj.AppRoles | Where-Object {$_.Value -in $permissionValues} $appHT = @() foreach($ap in $appPermissions){ $appHT += @{ Id = $ap.Id; Type = "Role"; } } $appResource = @{ ResourceAppId = $appId ResourceAccess = $appHt } return $appResource; } $exoPermissionValues = 'Exchange.ManageAsApp' $o365PermissionValues = 'ActivityFeed.Read' '' 'Building API permissions...' ## Build the API permission object (TYPE: Role = Application) $AppsAndPermissions = @{ '00000002-0000-0ff1-ce00-000000000000' = $exoPermissionValues 'c5393580-f805-4401-95e8-94b7a6ef2fc2' = $o365PermissionValues } $apiPermission = @() foreach($aAndP in $AppsAndPermissions.GetEnumerator()) { $apiPermission += Get-RequireResource $aAndP.Name $aAndP.Value } '' 'Registering Azure App...' ## Register the new Azure AD App with API Permissions $myApp = New-MgApplication -DisplayName $AppName -RequiredResourceAccess $apiPermission ## Enable the Service Principal $mySP = New-MgServicePrincipal -AppId $myApp.AppID ## Find or activate the directory role $role = Get-MgDirectoryRole -Filter ("displayName eq '{0}'" -f $DirectoryRole) if (-not $role) { $roleTemplate = Get-MgDirectoryRoleTemplate -Filter ("displayName eq '{0}'" -f $DirectoryRole) if ($roleTemplate) { $role = New-MgDirectoryRole -RoleTemplateId $roleTemplate.Id } } ## Add the service principal to the directory role if ($role) { $refBody = @{ "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$($mySP.Id)" } New-MgDirectoryRoleMemberByRef -DirectoryRoleId $role.Id -BodyParameter $refBody } # Display the new App properties '' "App Display Name: $($myApp.DisplayName)" "App ID: $($myApp.AppID)" '' 'Creating certificate...' # Create certificate $myCert = New-SelfSignedCertificate -DnsName $CertDnsName -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears($CertYearsValid) -KeySpec KeyExchange '' 'Exporting certificate files to disk...' # Export certificate to .pfx file $pfxFilePath = ".\$($AppName).pfx" $output = $myCert | Export-PfxCertificate -FilePath $pfxFilePath -Password $CertPassword -CryptoAlgorithmOption AES256_SHA256 # Display certificate pfx file path '' "Certificate pfx file path: $($output.FullName)" # Export certificate to .cer file $certFilePath = ".\$($AppName).cer" $output = $myCert | Export-Certificate -FilePath $certFilePath # Display certificate cer file path '' "Certificate cer file path: $($output.FullName)" '' 'Uploading certificate to Azure App...' ## Upload and assign the certificate to application in Microsoft Graph $keyCredentials = @{ customKeyIdentifier = $myCert.GetCertHash() key = $myCert.GetRawCertData() type = "AsymmetricX509Cert" usage = "Verify" startDateTime = $myCert.NotBefore endDateTime = $myCert.NotAfter } Update-MgApplication -ApplicationId $myApp.Id -KeyCredentials $keyCredentials '' "Waiting $SleepBeforeConsentSeconds seconds to allow the Azure App to be fully created before consent..." sleep $SleepBeforeConsentSeconds '' 'Getting tenant details for consent...' ## Get the TenantID $tenantID = (Get-MgOrganization).Id ## Browse this URL $consentURL = "https://login.microsoftonline.com/$tenantID/adminconsent?client_id=$($myApp.AppId)" # Display the consent URL '' "Consent URL: $consentURL" '' 'Launching browser for consent...' # Browse to the consent URL using the default browser Start-Process $consentURL '' 'Done.' ``` 1. Run the script: - To run the script while overriding some of the default parameters, run `.\CreateExchangeOnlineApp.ps1 -AppName "Exchange Online DAS App" -DirectoryRole "Exchange Administrator" -CertDnsName "contoso.com" -CertYearsValid 1` 1. When prompted, log in with administrator credentials to create and configure Azure applications. The last step of the script will launch a URL to grant admin consent for the Application. After granting consent the page will redirect to a missing localhost URL. This can be ignored. Note If you experience an **access denied** error or other error in the web browser when granting admin consent, this might be a timing issue. This can be resolved by either [manually granting admin consent](#creating-and-configuring-the-application-manually) through the Azure portal. Alternatively, you can copy and paste the consent URL intow your browser. This is the last line of output from the script output that contains text `adminconsent`. The following output should be gathered or noted when running the script. This information will be used to configure the Exchange Online application in Data Access Security. 1. The App ID value in the console output. 1. The created certificate file .pfx located in your working directory. 1. The certificate password that was entered when prompted. ### Granting Permissions 1. Go to Azure AD and log in with administrator privileges. 1. Go to **App registrations** in the left navigation menu. 1. Search for and select the application created using the script above. 1. In the application properties, go to **API Permissions**. 1. Select **Grant admin consent**. This enables the Exchange Online permissions. ## Creating and Configuring the Application Manually The following steps will create and configure an Azure application for Exchange Online authentication through the Azure portal. These steps are adapted from the following online Microsoft documentation: Specify the Exchange Administrator when assigning the Azure Active Directory role. ### Registering the Application in Azure AD 1. Go to the the [Azure AD portal](https://portal.azure.com/). 1. Under Manage Azure Active Directory, select **View**. 1. On the Overview page, select **App registrations** under Manage. 1. On the App registrations page, select **New registration**. 1. On the Register an application page, configure the following settings: - Name - Enter something descriptive, like "Exchange Online DAS App" - Supported account types - Verify that Accounts in this organizational directory only (`` only - Single tenant) is selected. - Redirect URI (optional) - Leave empty 1. Select **Register**. You will now assign API permissions to the application from this screen. ### Assigning API Permissions to the Application 1. On the app page under Manage, select **Manifest**. 1. On the Manifest page, find the `requiredResourceAccess` entry. 1. Replace the entire `requiredResourceAccess` entry with the following: ```json "requiredResourceAccess": [     {         "resourceAppId": "c5393580-f805-4401-95e8-94b7a6ef2fc2",         "resourceAccess": [             {                 "id": "594c1fb6-4f81-4475-ae41-0c394909246c",                 "type": "Role"             }         ]     },     {         "resourceAppId": "00000002-0000-0ff1-ce00-000000000000",         "resourceAccess": [             {                 "id": "dc50a0fb-09a3-484d-be87-e023b12c6440",                 "type": "Role"             }         ]     } ], ``` 1. Select **Save**. 1. On the Manifest page, under Manage, select **API permissions**. 1. On the API permissions page, verify that both `Exchange.ManageAsApp` and `ActivityFeed.Read` appear on the list. 1. Select **Grant admin consent for **. Read the confirmation dialog that opens. 1. Select **Yes** in the confirmation dialog. The Status value should now be **Granted for ** on both entries. 1. Close the API Permissions page (*not the browser tab*) to return to the App registrations page to generate a self-signed certificate. ### Generating a Self-Signed Certificate Create a self-signed x.509 certificate using the following PowerShell commands. Edit parameters such as DnsName, Certificate expiration, and password as appropriate: **Create certificate** ```text $mycert = New-SelfSignedCertificate -DnsName **"contoso.org"** -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(**15**) -KeySpec KeyExchange ``` **Export certificate to .pfx file** ```text $mycert | Export-PfxCertificate -FilePath mycert.pfx -Password $(ConvertTo-SecureString -String "**P@ssw0Rd1234**" -AsPlainText -Force) ``` **Export certificate to .cer file** `$mycert | Export-Certificate -FilePath mycert.cer` ### Assigning the Certificate to the Azure Active Directory Application After you register the certificate with your application, you can use the private key (.pfx file) for authentication. 1. Go to the the [Azure AD portal](https://portal.azure.com/). 1. Under Manage Azure Active Directory, select **View**. 1. On the Overview page, under Manage, select **App registrations**. 1. On the Apps registration page, select the application you [registered](#registering-the-application-in-azure-ad). 1. On the application page, under Manage, select **Certificates & secrets**. 1. Select **Upload Certificate**. 1. Browse to the self-signed certificate .cer file that you created when [generating a self-signed certificate](#generating-a-self-signed-certificate). 1. Select **Add**. The certificate is now shown in the Certificates section. ### Assigning the Exchange Administrator Role to the Application 1. Go to the the [Azure AD portal](https://portal.azure.com/). 1. Under Manage Azure Active Directory, select **View**. 1. On the Overview page, under Manage, select **Roles and administrators**. 1. Select the Exchange administrator role by clicking on the name of the role, not the checkbox. 1. The Add assignment dialog displays. Find and select the application you [registered](#registering-the-application-in-azure-ad). 1. Select **Add**. 1. On the Assignments page, verify the application has been assigned to the role. # Prerequisites Make sure your system fits the description below before starting the installation. ## Permissions The Office365 Exchange Online service uses a similar permission model as the equivalent Exchange On-Premises. Exchange Online requires an [Azure application to be created](https://documentation.sailpoint.com/das-connectors/help/o365/exchange_online/exchange_online_create_azure_app.html). Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. ## Activity Monitoring By default, auditing is enabled for all new mailboxes with many mailbox event types already enabled. To see a list of all Owner, Delegate, and Admin event types, refer to the [Configuring Activity Monitoring](https://documentation.sailpoint.com/das-connectors/help/o365/exchange_online/add/exchange_online_activity_monitoring.html) section. ### Specific Mailbox Auditing Configuration If needing to capture additional event types, complete the actions described in the sections below. Warning Each event type will need to be added per mailbox. ### Exchange Online PowerShell Module This section contains some powershell scripts that can be used to modify your mailbox auditing configuration. To run these commands, you must use the Exchange powershell module. To install on local computer, run: `Install-Module -Name 'ExchangeOnlineManagement' -RequiredVersion 3.4.0` To use the module without installing it, run the following commands: `mkdir Modules` `Save-Module -Name ExchangeOnlineManagement -RequiredVersion 3.4.0 -Path .\Modules\ Import-Module -Name .\Modules\ExchangeOnlineManagement\` ### Resetting Mailbox Auditing Configuration Defaults If you feel that your mailbox auditing configuration may have been altered and you want to reset all mailboxes to their default configuration and ensure they are all enabled, run the following powershell script: `Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox,SharedMailbox | Select-Object UserPrincipalName | Foreach-Object { Set-Mailbox -Identity "$($_.UserPrincipalName)" -AuditEnabled $true -DefaultAuditSet Owner,Delegate,Admin }` ### Modifying Mailbox Event Types to Audit To add additional event types to audit, such as those that are not enabled by default, use the `add` syntax with `Set-Mailbox`. For example, the following script adds several event types for every mailbox that are not enabled by default: `Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox,SharedMailbox` `Select-Object UserPrincipalName | Foreach-Object {` `Set-Mailbox -Identity "$($_.UserPrincipalName)"` -`AuditOwner @{add="AddFolderPermissions","MailboxLogin","RemoveFolderPermissions"}` -`AuditDelegate @{add="AddFolderPermissions","Move","RecordDelete","RemoveFolderPermissions"}` -`AuditAdmin @{add="AddFolderPermissions","RecordDelete","RemoveFolderPermissions"}` } To remove event types from being audited, use the same command, but with the `remove` instead of `add`. For example, the following script removes the event “UpdateInboxRules” from being audited: `Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox,SharedMailbox` `Select-Object UserPrincipalName | Foreach-Object {` `Set-Mailbox -Identity "$($_.UserPrincipalName)"` -`AuditOwner @{remove="UpdateInboxRules"}` -`AuditDelegate @{remove="UpdateInboxRules"}` -`AuditAdmin @{remove="UpdateInboxRules"}` } ### Configuration for New Mailboxes Newly created mailboxes will have the default Microsoft auditing configuration. If you are modifying the mailbox event types, then you need to onboard new mailboxes in the same way. # Verifying the Exchange Online Connector Installation You can verify your Exchange Online connector installation by checking your application configuration and validations. ## Verifying Application Configuration After the configuration of the application is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common Exchange Online Validations The following is a list of common validations that run when the test connection is run with an Exchange Online application. - Verify the connectivity to Exchange Online - Verify the mailbox retrieval - Verify cmdlet permissions - Verify Activity Monitoring event auditing is active through the Office 365 API - Verify Activity Monitoring is checking permissions - Verify Activity Monitoring unified audit log is enabled ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding an Exchange Online Application In order to integrate with Exchange Online, we must first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details 1. Review and edit the application's general details: - Application Type - Exchange Online - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. **Identity Collector** - (Mandatory) Select either Azure Active Directory or Microsoft Entra as the Identity Collector. - You can create identity collectors on the **Admin > Identity Collectors** page. - Ensure you run the Identity Collector Aggregation task before running the Permission Collection Task. Select **Next** to open the Connection Details page. ## Connection Details Complete the Connection Details fields: **Tenant Domain Name** 1. Complete the Connection Details: - Initial Domain Name - The Initial Domain Name that was given when the Azure tenant was initially created can be found in **Microsoft 365 admin center > Settings > Domains**. It can be identified by its .onmicrosoft.com suffix and that it cannot be deleted. - Application ID - Enter the Application ID for the Azure application used by the Data Access Security SharePoint Online Connector. - Certificate File - The certificate assigned to the Azure application used by the Data Access Security SharePoint Online Connector. Either navigate to the certificate by selecting **Choose a File**, or drag the certificate onto the Certificate File field. - Supported file formats: pfx, p12. - Certificate Password - Enter the password for the certificate. Select **Next**. You can now [configure and schedule permissions collection and resource discovery](https://documentation.sailpoint.com/das-connectors/help/o365/exchange_online/add/exchange_online_crawlerpermcoll.html). # Configuring Exchange Online Activity Monitoring 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Activity Monitoring** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Activity Monitoring** on. Note Verify auditing is enabled which was listed in the prerequisites. ## Activity Exclusions Note Activity Monitoring exclusions need to be manually added. Allows administrators to configure activities which are not desired to reduce unnecessary noise of activity data set. Activities which match exclusions will be discarded so they will not display in forensics or be held in any storage. To add an exclusion: 1. Type an exclusion into the relevant dropdown list (file extension, user, folder, actions). 1. Select the **+** icon to add it to the list. 1. Select to **Next** or **Cancel** to close the panel once the list is complete. To edit or remove an exclusion from the list: 1. Select the appropriate dropdown list. 1. On the desired extension that needs to be edited or removed, select either the edit or delete icon. 1. Select to **Next** or **Cancel** to close the panel. 1. Click **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., txt, exe. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., \\servername\\share1\\folder1. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. **Exclude Actions** - List of actions that are not monitored. e.g., copy file. ## Scripts The following Microsoft documentation provides further insight into Exchange Online events: - [Mailbox event](https://learn.microsoft.com/en-us/purview/audit-mailboxes) - [Full "Set-Mailbox" documentation](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-mailbox?view=exchange-ps) - [Exchange Online Powershell](https://learn.microsoft.com/en-us/powershell/exchange/exchange-online-powershell?view=exchange-ps) starting information In order to execute exchange commands, you must first connect to Exchange Online using the following cmdlet: ```powershell Connect-ExchangeOnline ``` The following script gets all mailboxes current auditing states: ```powershell "Get audit state for all mailboxes" Get-EXOMailbox -ResultSize Unlimited -PropertySets Minimum,StatisticsSeed,Audit -RecipientTypeDetails UserMailbox,SharedMailbox | Select-Object Name,UserPrincipalName,AuditAdmin,AuditOwner,AuditDelegate | Foreach-Object { "Mailbox: NAME: $($_.Name), UPN: $($_.UserPrincipalName)" " AuditAdmin: $($_.AuditAdmin)" " AuditOwner: $($_.AuditOwner)" " AuditDelegate: $($_.AuditDelegate)" "" } ``` The following script will enable auditing for all mailbox events for all user and shared mailboxes: ```powershell "Setting audit state for all mailboxes" Get-EXOMailbox -ResultSize Unlimited -PropertySets Minimum,StatisticsSeed -RecipientTypeDetails UserMailbox,SharedMailbox ` | Select-Object Name,UserPrincipalName | Foreach-Object { "Mailbox: NAME: $($_.Name), UPN: $($_.UserPrincipalName)" Set-Mailbox -Identity "$($_.UserPrincipalName)" ` -AuditEnabled $true ` -AuditAdmin AddFolderPermissions,ApplyRecord,Copy,Create,FolderBind,HardDelete,ModifyFolderPermissions,Move,MoveToDeletedItems,RecordDelete,RemoveFolderPermissions,SendAs,SendOnBehalf,SoftDelete,Update,UpdateFolderPermissions,UpdateCalendarDelegation,UpdateInboxRules,MailItemsAccessed ` -AuditDelegate AddFolderPermissions,ApplyRecord,Create,FolderBind,HardDelete,ModifyFolderPermissions,Move,MoveToDeletedItems,RecordDelete,RemoveFolderPermissions,SendAs,SendOnBehalf,SoftDelete,Update,UpdateFolderPermissions,UpdateInboxRules,MailItemsAccessed ` -AuditOwner AddFolderPermissions,ApplyRecord,Create,HardDelete,MailboxLogin,ModifyFolderPermissions,Move,MoveToDeletedItems,RecordDelete,RemoveFolderPermissions,SoftDelete,Update,UpdateFolderPermissions,UpdateCalendarDelegation,UpdateInboxRules,MailItemsAccessed } ``` The following script will reset all mailboxes to use the default auditing configuration (default mailbox event types): ```powershell "Resetting default audit state for all mailboxes" Get-EXOMailbox -ResultSize Unlimited -PropertySets Minimum,StatisticsSeed -RecipientTypeDetails UserMailbox,SharedMailbox | Select-Object Name,UserPrincipalName | Foreach-Object { "Mailbox: NAME: $($_.Name), UPN: $($_.UserPrincipalName)" Set-Mailbox -Identity "$($_.UserPrincipalName)" -DefaultAuditSet Admin,Delegate,Owner } ``` ### Configuration for New Mailboxes Newly created mailboxes will have the default Microsoft auditing configuration. If you are modifying the mailbox event types, then you will need to on-board new mailboxes in the same way. ## Supported Event Types ### Owner | Event | Out-of-the-Box | Add-Ons | | ------------------------ | -------------- | ------- | | AddFolerPermission | | ✓ | | ApplyRecord | | ✓ | | Create | | ✓ | | HardDelete | ✓ | | | MailboxLogin | | ✓ | | MailItemsAccessed | ✓ | | | ModifyFolderPermissions | ✓ | | | Move | | ✓ | | MoveToDeletedItems | ✓ | | | RecordDelete | | ✓ | | RemoveFolderPermissions | | ✓ | | SoftDelete | ✓ | | | Update | ✓ | | | UpdateFolderPermissions | ✓ | | | UpdateCalendarDelegation | ✓ | | | UpdateInboxRules | ✓ | | ### Delegate | Event | Out-of-the-Box | Add-Ons | | ----------------------- | -------------- | ------- | | AddFolerPermission | | ✓ | | ApplyRecord | | ✓ | | Create | ✓ | | | FolderBind | | ✓ | | HardDelete | ✓ | | | MailItemsAccessed | ✓ | | | ModifyFolderPermissions | ✓ | | | Move | | ✓ | | MoveToDeletedItems | ✓ | | | RecordDelete | | ✓ | | RemoveFolderPermissions | | ✓ | | SendAs | ✓ | | | SendOnBehalf | ✓ | | | SoftDelete | ✓ | | | Update | ✓ | | | UpdateFolderPermissions | ✓ | | | UpdateInboxRules | ✓ | | ### Admin | Event | Out-of-the-Box | Add-Ons | | ------------------------ | -------------- | ------- | | AddFolerPermission | | ✓ | | ApplyRecord | | ✓ | | Copy | | ✓ | | Create | ✓ | | | FolderBind | ✓ | | | HardDelete | ✓ | | | MailItemsAccessed | ✓ | | | ModifyFolderPermissions | ✓ | | | Move | ✓ | | | MoveToDeletedItems | ✓ | | | RecordDelete | | ✓ | | RemoveFolderPermissions | | ✓ | | SendAs | ✓ | | | SendOnBehalf | ✓ | | | SoftDelete | ✓ | | | Update | ✓ | | | UpdateFolderPermissions | ✓ | | | UpdateCalendarDelegation | ✓ | | | UpdateInboxRules | ✓ | | # Configuring and Scheduling the Exchange Online Crawler ## Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list or use the filter to find the application. - Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler** settings page. The actual entry fields vary according to the application type. **Crawl Mailboxes, Crawl Public Folders** Select the types of folders to scan. **Create a Schedule** Select to open the schedule panel. Refer to [Scheduling a Task](#scheduling-a-task). ## Setting the Crawl Scope Options for setting the crawl scope are: - Setting an explicit list of resources to include and / or exclude from the scan. - Creating a regex to define the resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list or use the filter to find the application. - Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, enter the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list or use the filter to find the application. - Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Enter the paths to exclude by Regex; refer to regex examples in the section below. Since the system does not collect business resources that match this Regex, it also does not analyze them for permissions. ### Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: **Exclude all shares which start with one or more shares names** ```text Starting with Public Folders\\shareName Regex: Public Folders\\\\shareName$ Starting with Public Folders\\shareName or Public Folders\\OtherShareName Public Folders\\\\(shareName|OtherShareName)$ ``` **Include ONLY shares which start with one or more shares names** ```text Starting with Public Folders\\shareName Regex: ^(?!Public Folders\\\\shareName($|\\.*)).* Starting with Public Folders\\shareName or Public Folders\\OtherShareName Regex: ^(?!Public Folders\\\\(shareName|OtherShareName)($|\\.*)).* Include ONLY one folder under a share: \\server\share\folderA Regex: ^(?!\\\\Public Folders\\shareName\$($|\\folderA$|\\folderA\\.*)).* ``` **Exclude all mailboxes which start with one or more user names** ```text Starting with John.Doe Regex: ^Mailboxes\\John\.Doe@.* Starting with John.Doe or Jane.Doe Regex: ^Mailboxes\\(John|Jane)\.Doe@.* | ``` **Include ONLY mailboxes that start with one or more user names** ```text Starting with John.Doe Regex: ^(?!Mailboxes\/John\.Doe@.*).* Starting with John.Doe or Jane.Doe Regex: ^(?!Mailboxes\/(John|Jane)\.Doe@.*).* | ``` Note To write a backslash or a Dollar sign, add a backslash before it as an escape character. To add a condition in a single command, use a pipe character “|” . **Narrow down the selection** ```text Include ONLY *the C$ drive shares: \\server_name\*C$* Regex: ^(?!\\\\server_name\\*C*\$($|\\.*)).* | Include ONLY one folder under a share: \\server\share\*folderA* Regex`: ^(?!\\\\server_name\\share\$($|\\`*folderA*`$|\\`*folderA*`\\.*)).*` | Include ONLY all administrative shares Regex: ^(?!\\\\server_name\\[a-zA-Z]\$($|)).* | ``` Note To write a backslash or a Dollar sign, add a backslash before it as an escape character. To add a condition in a single command, use a pipe character “|” . ## Excluding Top Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Configuring and Scheduling the Exchange Online Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. ## Configuring the Permission Collection The permission collector is a software component responsible for analyzing the permissions in an application. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collection** settings page. Note The entry fields vary by application type. 1. You can now schedule a task. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select **Next**. # Selecting and Scheduling Exchange Online Data Classification Settings To associate an application with a data classification service, and set the schedule - Open the edit screen of the required application - Go to **Admin > Applications** - Scroll through the list, or use the filter to find the application - Select the **Edit** icon on the line of the application - Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type **Central Data Classification Service** Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. **Disabling Data Classification** To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). **Create a Schedule** This option is enabled only if a central data classification service is selected. Refer to [Scheduling a Task](https://documentation.sailpoint.com/das-connectors/help/o365/exchange_online/add/exchange_online_crawlerpermcoll.html#scheduling-a-task). Refer to the chapter “Data Classification” in the *Data Access Security Administrator Guide* for more information. - Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # OneDrive Connector Overview The OneDrive connector allows you to access and analyze data. Of that stored data, you are able to structure and classify it. ## OneDrive Connector Installation Flow Overview To install the OneDrive connector: 1. Configure all the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/o365/o365_prereqs.html). 1. Add a new OneDrive application. ## Permissions Collection Operation Principles - OneDrive for Business permissions collection task uses the Microsoft OneDrive REST API. - The permissions collection task queries OneDrive for Business for the existing Role Assignments to determine object permissions. - An Azure Identity Collector must be configured to map the permissions to users and groups from the Azure Active Directory. Note The section on Identity collection in the Data Access Security Account and Entitlement Aggregation Guide provides more information on how to define an Azure Identity Collector. Important Run a crawl before all permission collection tasks for the most accurate data. # Creating an Azure Application for OneDrive A new Azure Active Directory application must be created and configured to support the Data Access Security OneDrive functionality. This configuration can be performed either by running the automated PowerShell script supplied with the SailPoint distribution pack, or by creating and configuring the application through the Azure portal. ## Creating and Configuring the Application Automatically The script below will perform all the Azure application creation and configuration steps required for OneDrive. ### Windows Systems To run this script, the Azure AD PowerShell module must be installed. 1. Open PowerShell as an Administrator. 1. Install the Microsoft Graph PowerShell module: `Install-Module -Name Microsoft.Graph` 1. For Windows systems, open the `CreateOneDriveApp.ps1` file in a text editor to review the default parameters. The parameters can be edited in the file or passed as parameters when running the script. CreateOneDriveApp.ps1 ```powershell <# .SYNOPSIS Configures an Azure Application for use by Data Access Security One Drive Applications: .DESCRIPTION Configures an Azure Application for use by Data Access Security One Drive Applications Creates an Azure App with the following API Permissions Microsoft.Graph Files.ReadWrite.All Sites.Read.All User.Read.All Domain.Read.All Office 365 Management APIs ActivityFeed.Read Sharepoint Online APIs Sites.FullControl.All Creates and uploads a certificate as app client credential. Prompts for App admin consent. .EXAMPLE AddDasPermissionsForOneDrive "Azure App Name" 'CertificateDnsName.com' 1 30 $SecureStringVariableWithPassword .NOTES Version: 1.0.1 Requires: Microsoft.Graph.Authentication, Microsoft.Graph.Applications, Microsoft.Graph.Identity.DirectoryManagement Install: Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Applications, Microsoft.Graph.Identity.DirectoryManagement #> param( [string]$AppName = 'DAS OneDrive App', # DnsName will be included in Cert subject name [string]$CertDnsName = 'organization.com', [int]$CertYearsValid = 10, [int]$SleepBeforeConsentSeconds = 30, [Parameter(Mandatory = $True)] [Security.SecureString]$CertPassword ) # Stop the script on error $ErrorActionPreference = "Stop" # Windows PowerShell 5.1 defaults to 4096 functions per session, which the Graph modules can exhaust if ($PSVersionTable.PSEdition -ne 'Core' -and $MaximumFunctionCount -lt 32768) { $MaximumFunctionCount = 32768 } # Import only the submodules used here; importing the Microsoft.Graph meta-module loads every # submodule and overflows the function limit foreach ($module in 'Microsoft.Graph.Authentication', 'Microsoft.Graph.Applications', 'Microsoft.Graph.Identity.DirectoryManagement') { if (-not (Get-Module -ListAvailable -Name $module)) { throw "Required module '$module' is not installed. Run: Install-Module $module -Scope CurrentUser" } Import-Module $module -ErrorAction Stop } function Get-RequireResource{ param($appId, $permissionValues) $appObj = (Get-MgServicePrincipal -Filter ("AppId eq '{0}'" -f $appId)) $appPermissions = $appObj.AppRoles | Where-Object {$_.Value -in $permissionValues} $appHT = @() foreach($ap in $appPermissions){ $appHT += @{ Id = $ap.Id; Type = "Role"; } } $appResource = @{ ResourceAppId = $appId ResourceAccess = $appHt } return $appResource; } Write-Output 'Connecting' Connect-MgGraph -Scopes 'Application.Read.All', 'Application.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All' Write-Output 'Getting required API details...' $graphPermissionValues = 'Files.ReadWrite.All', 'Sites.Read.All', 'User.Read.All', 'Domain.Read.All' $o365PermissionValues = 'ActivityFeed.Read' $spoPermissionsValues = 'Sites.FullControl.All' $AppsAndPermissions = @{ '00000003-0000-0000-c000-000000000000' = $graphPermissionValues 'c5393580-f805-4401-95e8-94b7a6ef2fc2' = $o365PermissionValues '00000003-0000-0ff1-ce00-000000000000' = $spoPermissionsValues } $apiPermission = @() foreach($aAndP in $AppsAndPermissions.GetEnumerator()) { $apiPermission += Get-RequireResource $aAndP.Name $aAndP.Value } '' 'Registering Azure App...' # Register the new Azure App with API Permissions $myApp = New-MgApplication -DisplayName $AppName -RequiredResourceAccess $apiPermission # Display the new App properties '' "App Display Name: $($myApp.DisplayName)" "App ID: $($myApp.AppID)" '' 'Creating certificate...' # Create certificate $myCert = New-SelfSignedCertificate ` -DnsName $CertDnsName ` -CertStoreLocation "cert:\LocalMachine\My" ` -NotAfter (Get-Date).AddYears($CertYearsValid) ` -KeySpec KeyExchange '' 'Exporting certificate files to disk...' # Export certificate to .pfx file $pfxFilePath = ".\$($AppName).pfx" $output = $myCert | Export-PfxCertificate -FilePath $pfxFilePath -Password $CertPassword -CryptoAlgorithmOption AES256_SHA256 # Display certificate pfx file path '' "Certificate pfx file path: $($output.FullName)" # Export certificate to .cer file $certFilePath = ".\$($AppName).cer" $output = $myCert | Export-Certificate -FilePath $certFilePath # Display certificate cer file path '' "Certificate cer file path: $($output.FullName)" '' 'Uploading certificate to Azure App...' # Upload and assign the certificate to Azure App $keyCredentials = @{ customKeyIdentifier = $myCert.GetCertHash() key = $myCert.GetRawCertData() type = "AsymmetricX509Cert" usage = "Verify" startDateTime = $myCert.NotBefore endDateTime = $myCert.NotAfter } "Waiting $SleepBeforeConsentSeconds seconds to allow the Azure App to be fully created before uploading cert..." Start-Sleep $SleepBeforeConsentSeconds '' Update-MgApplication -ApplicationId $myApp.Id -KeyCredentials $keyCredentials '' 'Getting tenant details for consent...' # Get the tenant ID $tenantID = (Get-MgOrganization).Id # Build the consent URL $consentURL = "https://login.microsoftonline.com/$tenantID/adminconsent?client_id=$($myApp.AppId)" # Display the consent URL '' "Consent URL: $consentURL" '' 'Launching browser for consent...' # Browse to the consent URL using the default browser Start-Process $consentURL ``` 1. Run the script: - To run the script with the default parameters from the directory where the script is located, run `.\CreateOneDriveApp.ps1` - To run the script while overriding some of the default parameters, like DNS Name, years of certificate validity, or application name: `.\CreateOneDriveApp.ps1 -AppName "OneDrive DAS App" -CertDnsName "contoso.com" -CertYearsValid 15` 1. When prompted, log in with administrator credentials to create and configure Azure applications. ### Linux / MacOS Systems 1. Ensure you have the Azure CLI installed. - [Install - Linux](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux?view=azure-cli-latest&pivots=apt) - [Install - macOS](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-macos?view=azure-cli-latest) 1. For Linux / MacOS systems, open the `CreateOneDriveApp.sh` file in a text editor to review the default parameters. CreateOneDriveApp.sh ```powershell g!/bin/bash # Usage: ./AddDasPermissionsForOneDrive.sh "Azure App Name" "CertificateDnsName.com" 10 30 "CertPassword" APP_NAME="${1:-DAS OneDrive App}" CERT_DNS_NAME="${2:-organization.com}" CERT_YEARS_VALID="${3:-10}" SLEEP_BEFORE_CONSENT="${4:-30}" CERT_PASSWORD="${5}" if [ -z "$CERT_PASSWORD" ]; then echo "Certificate password is required as the 5th argument." exit 1 fi set -e echo "Logging in to Azure..." az login --only-show-errors --allow-no-subscriptions echo "Registering Azure App..." APP_ID=$(az ad app create --display-name "$APP_NAME" --query appId -o tsv) echo "App Display Name: $APP_NAME" echo "App ID: $APP_ID" echo "Adding required API permissions..." # Microsoft Graph az ad app permission add --id "$APP_ID" --api 00000003-0000-0000-c000-000000000000 --api-permissions 75359482-378d-4052-8f01-80520e7db3cd=Role df021288-bdef-4463-88db-98f22de89214=Role 332a536c-c7ef-4017-ab91-336970924f0d=Role dbb9058a-0e50-45d7-ae91-66909b5d4664=Role # Office 365 Management APIs az ad app permission add --id "$APP_ID" --api c5393580-f805-4401-95e8-94b7a6ef2fc2 --api-permissions 594c1fb6-4f81-4475-ae41-0c394909246c=Role # SharePoint Online APIs az ad app permission add --id "$APP_ID" --api 00000003-0000-0ff1-ce00-000000000000 --api-permissions 678536fe-1083-478a-9c59-b99265e6b0d3=Role echo "Creating certificate..." CERT_SUBJECT="/CN=$CERT_DNS_NAME" CERT_DAYS=$((365 * CERT_YEARS_VALID)) openssl req -x509 -nodes -days "$CERT_DAYS" -newkey rsa:2048 -keyout "$APP_NAME.key" -out "$APP_NAME.crt" -subj "$CERT_SUBJECT" -passout pass:"$CERT_PASSWORD" openssl pkcs12 -export -out "$APP_NAME.pfx" -inkey "$APP_NAME.key" -in "$APP_NAME.crt" -password pass:"$CERT_PASSWORD" -keypbe AES-256-CBC -certpbe AES-256-CBC -macalg SHA256 echo "Certificate pfx file path: $(pwd)/$APP_NAME.pfx" echo "Certificate cer file path: $(pwd)/$APP_NAME.crt" echo "Uploading certificate to Azure App..." az ad app credential reset --id "$APP_ID" --cert "@$APP_NAME.crt" --append echo "Waiting $SLEEP_BEFORE_CONSENT seconds before admin consent..." sleep "$SLEEP_BEFORE_CONSENT" echo "Getting tenant details for consent..." TENANT_ID=$(az account show --query tenantId -o tsv) CONSENT_URL="https://login.microsoftonline.com/$TENANT_ID/adminconsent?client_id=$APP_ID" echo "Consent URL: $CONSENT_URL" echo "Launching browser for consent..." if command -v xdg-open &> /dev/null; then xdg-open "$CONSENT_URL" elif command -v open &> /dev/null; then open "$CONSENT_URL" else echo "Please open the following URL in your browser:" echo "$CONSENT_URL" fi ``` The last step of the script will launch a URL to grant admin consent for the application. When you grant consent, you will be redirected to a missing localhost URL. The operation is successful if the URL for that page contains `admin_consent=True`. Note If you experience an access denied or other error in the web browser when granting admin consent, this might be a timing issue. This can be resolved by [manually granting admin consent](#creating-and-configuring-the-application-manually) through the Azure portal. Alternatively you can copy and paste the consent URL into your browser. This is found in the script at: `Consent URL:`. The following output should be gathered or noted when running the script. This information will be used to configure the OneDrive application in Data Access Security: 1. The App ID value in the console output. 1. The created certificate file .pfx located in your working directory. 1. The certificate password that was entered when prompted. Note Confirm the [API Permissions](#final-result) have been configured properly. ## Creating and Configuring the Application Manually The following steps will create and configure an Azure application for OneDrive authentication through the Azure portal. These steps are adapted from the [Microsoft SharePoint Online documentation](https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread). ### Registering the Application in Azure AD 1. Go to the the [Azure AD portal](https://portal.azure.com/). 1. Under Manage Azure Active Directory, select **View**. 1. On the Overview page, select **App registrations** under Manage. 1. On the App registrations page, select **New registration**. 1. On the Register an application page, configure the following settings: - Name - Enter something descriptive, like "OneDrive DAS App" - Supported account types - Verify that Accounts in this organizational directory only (`` only - Single tenant) is selected. - Redirect URI (optional) - Leave empty 1. Select **Register**. You will now assign API permissions to the application from this screen. ### Assigning API Permissions to the Application Note To optimize performance for these connectors, SailPoint recommends having separate application registrations in Azure for each OneDrive and SharePoint Online connector. 1. On the app page under Manage, select **Manifest**. 1. On the Manifest page, find the `requiredResourceAccess` entry. 1. Replace the entire `requiredResourceAccess` entry with the following: ```json "requiredResourceAccess": [ { "resourceAppId": "00000003-0000-0000-c000-000000000000", "resourceAccess": [ { "id": "dbb9058a-0e50-45d7-ae91-66909b5d4664", "type": "Role" }, { "id": "75359482-378d-4052-8f01-80520e7db3cd", "type": "Role" }, { "id": "332a536c-c7ef-4017-ab91-336970924f0d", "type": "Role" }, { "id": "df021288-bdef-4463-88db-98f22de89214", "type": "Role" } ] }, { "resourceAppId": "00000003-0000-0ff1-ce00-000000000000", "resourceAccess": [ { "id": "678536fe-1083-478a-9c59-b99265e6b0d3", "type": "Role" } ] }, { "resourceAppId": "c5393580-f805-4401-95e8-94b7a6ef2fc2", "resourceAccess": [ { "id": "594c1fb6-4f81-4475-ae41-0c394909246c", "type": "Role" } ] } ], ``` 1. Select **Save**. 1. On the Manifest page, under Manage, select **API permissions**. 1. On the API permissions page, verify the following permissions: 1. Microsoft Graph 1. Files.ReadWrite.All 1. Sites.Read.All 1. User.Read.All 1. Domain.Read.All 1. Office 365 Management APIs 1. ActivityFeed.Read 1. SharePoint 1. Sites.Fullcontrol.All 1. Select **Grant admin consent for **. Read the confirmation dialog. 1. Select **Yes** in the confirmation dialog. The Status value should now be **Granted for ** on both entries. Note Confirm the [API Permissions](#final-result) have been configured properly. 1. Close the API Permissions page (*not the browser tab*) to return to the App registrations page to generate a self-signed certificate. ### Generating a Self-Signed Certificate Create a self-signed x.509 certificate using the following PowerShell commands. Edit parameters such as DnsName, Certificate expiration, and password as appropriate: **Create certificate** ```text $mycert = New-SelfSignedCertificate -DnsName **"contoso.org"** -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(**15**) -KeySpec KeyExchange ``` **Export certificate to .pfx file** This .pfx file will be used in the application configuration. ```text $mycert | Export-PfxCertificate -FilePath mycert.pfx -Password $(ConvertTo-SecureString -String "**P@ssw0Rd1234**" -AsPlainText -Force) ``` **Export certificate to .cer file** The .cer file will be used in step 6 of [Assigning the Certificate to the Azure Active Directory Application](#assigning-the-certificate-to-the-azure-active-directory-application). `$mycert | Export-Certificate -FilePath mycert.cer` ### Assigning the Certificate to the Azure Active Directory Application After you register the certificate with your application, you can use the private key (.pfx file) for authentication. 1. Go to the the [Azure AD portal](https://portal.azure.com/). 1. Under Manage Azure Active Directory, select **View**. 1. On the Overview page, under Manage, select **App registrations**. 1. On the Apps registration page, select the application you [registered](#registering-the-application-in-azure-ad). 1. On the application page, under Manage, select **Certificates & secrets**. 1. Select **Upload Certificate**. 1. Browse to the self-signed certificate .cer file that you created when [generating a self-signed certificate](#generating-a-self-signed-certificate). 1. Select **Add**. The certificate is now shown in the Certificates section. ## API Permissions Configuration Note The image above is a reference image to highlight configuration requirements. # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Accounts do not Appear in the Resources Tree There are several reasons why the crawler might not identify all or part of the accounts, which would cause OneDrive accounts to either not appear in the resources tree, or appear only partially: **Uninitialized OneDrive accounts** These are accounts which were never accessed and activated. These accounts can’t be crawled, nor will they appear in the resources tree. In the Crawl task details, you will see the message: "Not initialized accounts: X (see logs for details)" "X" stands for the number of uninitialized accounts. **Inaccessible OneDrive accounts** These are accounts which were not granted the prerequisite Site Collection Administrator permissions and cannot be accessed. In the Crawl task details, you will see the message: "Not accessible accounts: X (see logs for details)" "X" stands for the number of uninitialized accounts. ## Partial Folder Structure for a OneDrive Account Incomplete folder structures can happen when there is at least 1 publicly shared object (either a folder or file) under the OneDrive account. This makes it possible for external users to crawl it, but only the publicly shared objects will be returned. No error message is logged for these accounts, and you should verify that the required Site Collector Administrator permissions were granted. # Verifying the OneDrive Connector Installation You can verify your OneDrive connector installation by checking your application configuration and validations. ## Verifying Application Configuration After the configuration of one of the following applications is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common OneDrive Validations The following is a list of common validations that run when the test connection is run with a OneDrive application. - Server responsiveness - Verifying the connectivity to the OneDrive API - Verifying the permissions to read file data through the API - Verifying the event auditing is active through Office 365 API ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify that: - The tasks completed successfully - Business resources were created in the resource explorer (**Admin > Applications > [application column] > Manage Resources**) - Permissions display in the Permission Forensics page (**Forensics > Permissions**) # Adding a OneDrive Application In order to integrate with OneDrive, we must first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select Wizard Type. 1. Select **Standard Application** 1. Select **Next**. ## General Details 1. Complete the General Details: - Application Type - OneDrive for Business - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name and select **Enter** to create a tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - Event Manager Server - If there are multiple event manager servers configured in the system, you can select an event manager from the dropdown list. - Identity Collector - (Mandatory) Select either Azure Active Directory or Microsoft Entra as the Identity Collector. - You can create identity collectors on the **Admin > Identity Collectors** page. - If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. - Direct Access Revocation - Enabled by default. This allows permissions to be revoked that have been directly granted on the OneDrive application. 1. Select **Next**. ## Connection Details 1. Complete the Connection Details: - Initial Domain Name - The Initial Domain Name that was given when the Azure tenant was initially created can be found in **Microsoft 365 admin center > Settings > Domains**. It can be identified by its .onmicrosoft.com suffix and that it cannot be deleted. - Application ID - Enter the Application ID for the Azure application used by the Data Access Security SharePoint Online Connector. - Certificate File - The certificate assigned to the Azure application used by the Data Access Security SharePoint Online Connector. Either navigate to the certificate by selecting **Choose a File**, or drag the certificate onto the Certificate File Path field. - Supported file formats: pfx, p12. - Certificate Password - Enter the password for the certificate. Note When editing this application, if a new certificate is uploaded, the former password cannot be used. The user has to provide a new password. 1. Select **Next**. You can now [configure and schedule permissions collection and resource discovery](https://documentation.sailpoint.com/das-connectors/help/o365/one_drive/add/one_drive_permissions_collection.html) # Configuring and Scheduling the OneDrive Crawler To set or edit the Crawler configuration and scheduling: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. 1. In the Calculate Resource Size field, determine when, or at what frequency, Data Access Security calculates the resources' size: - Never - Always - Second crawl and on (default) 1. Select the **Active** checkbox to activate the schedule. 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Set the Crawl Scope by: - Setting an explicit [list of resources](#including-and-excluding-paths-by-list) to include or exclude from the scan. - [Creating a regex](#excluding-paths-by-regex) to define resources to exclude. 1. Select **Next**. ## Crawler Regex Exclusion Examples **Exclude all drives which start with one or more user names:** - Exclude drives starting with John.Doe: `^Personal\/John\.Doe@.*` - Exclude drives starting with John.Doe or Jane.Doe: `^Personal\/(John|Jane)\.Doe@.*` **Include ONLY drives which start with one or more user names:** - Include only drives starting with John.Doe: `^(?!Personal\/John\.Doe@.*).*` - Include only drives starting with John.Doe or Jane.Doe: `^(?!Personal\/(John|Jane)\.Doe@.*).*` **Narrow down the selection:** - Include only the C$ drive shares: \\server_name\\C$: `^(?!\\\\server_name\\*C*\$($|\\.*)).*` - Include only one folder under a share: \\server\\share\\folderA: `^(?!\\\\server_name\\share\$($|\\*folderA*$|\\*folderA*\\.*)).*` - Include only administrative shares: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Configuring OneDrive Activity Monitoring 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Activity Monitoring** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Activity Monitoring** on. Note Verify auditing is enabled which was listed in the prerequisites. ## Activity Exclusions Note Activity Monitoring exclusions need to be manually added. Allows administrators to configure activities which are not desired to reduce unnecessary noise of activity data set. Activities which match exclusions will be discarded so they will not display in forensics or be held in any storage. To add an exclusion: 1. Type an exclusion into the relevant dropdown list (file extension, user, folder, actions). 1. Select the **+** icon to add it to the list. 1. Select to **Next** or **Cancel** to close the panel once the list is complete. To edit or remove an exclusion from the list: 1. Select the appropriate dropdown list. 1. On the desired extension that needs to be edited or removed, select either the edit or delete icon. 1. Select to **Next** or **Cancel** to close the panel. 1. Click **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., txt, exe. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., \\servername\\share1\\folder1. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. **Exclude Actions** - List of actions that are not monitored. e.g., copy file. ## Supported Event Types - Access Request Approved - Access Request Created - AccessInvitationAccepted - AccessRequestApproved - Added To Group - Added To Secure Link - Anonymous Link Created - AnonymousLinkRemoved - AnonymousLinkUpdated - AnonymousLinkUsed - App Catalog SP Corporate Catalog Accessor Base Add - App Catalog SP Tenant Corporate Catalog Accessor Sync Solution To Teams - App Store Storefront Show App Details Page - App Store Storefront Task Get Apps - Client View Signaled - Comment Created - Comments Disabled - Company Link Created - Company Link Removed - CompanyLinkUsed - Device Access Policy Changed - File Accessed - File Accessed Extended - File Check Out Discarded - File Checked In - File Checked Out - File Copied - File deleted - File Deleted First Stage Recycle Bin - File Downloaded - File Modified - File Modified Extended - File Moved - File Previewed - File Recycled - File Renamed - File Uploaded - FileDeletedFirstStageRecycleBin - FileDeletedSecondStageRecycleBin - Folder Accessed - Folder Copied - Folder Created - Folder Deleted First Stage Recycle Bin - Folder Modified - Folder Moved - Folder Recycled - Folder Renamed - Folder Restored - FolderDeleted - FolderDeletedFirstStageRecycleBin - FolderDeletedSecondStageRecycleBin - Group Added - Group Removed - Group Updated - List Column Created - List Column Updated - List Created - List Item Created - List Item Updated - List Item Viewed - List Updated - List View Created - List View Updated - List Viewed - Page Prefetched - Permission Level Added - Removed From Group - RemovedFromSecureLink - Search Query Performed - Secure Link Created - SecureLinkCreated - SecureLinkDeleted - SecureLinkUsed - SharedLinkCreated - SharedLinkDisabled - Sharing Inheritance Broken - Sharing Inheritance Reset - Sharing Invitation Created - Sharing Policy Changed - Sharing Revoked - Sharing Set - SharingInvitationAccepted - SharingInvitationBlocked - SharingInvitationCreated - SharingInvitationUpdated - SharingRevoked - SharingSet - SP Corporate Catalog App Metadata Deploy Skip Feature Deployment - SP Corporate Catalog App Metadata Deploy With Feature Deployment - Web Members Can Share Modified - Web Request Access Modified # Selecting and Scheduling the OneDrive Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Data Classification** on. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This cluster is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. If a central data classification service is selected, you can schedule a task. 1. Select **Next** or **Done**. # Configuring and Scheduling the OneDrive Permission Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. Note If the Data Access Security Central Permission Collector wasn’t installed during server installation, this configuration setting will be disabled. Important Run a crawl before all permission collection tasks for the most accurate data. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collector** settings page. Note The entry fields vary by application type. 1. Select **Analyze Files with Unique Permissions**. Selecting this option may add on additional time for crawl to complete. 1. Choose if you want to skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. 1. Select **Next**. # SharePoint Online Connector Overview The SharePoint Online connector allows you to access and analyze data. Of that stored data, you are able to structure and classify it. ### Microsoft Teams Support The SharePoint Online connector supports gathering permissions, monitoring activities, and classifying information being stored in Teams sites and channels. - Files transferred through Teams chats are viewable under the **Team site > Shared Documents > General**. - Files transferred through private chats are placed under the initiating user's OneDrive for Business Personal Drive and are managed by the Data Access Security OneDrive for Business Application. ## SharePoint Online Connector Installation Flow Overview To install the SharePoint Online connector: 1. Configure all the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/o365/o365_prereqs.html). 1. Add a new SharePoint Online application. ## Permissions Collection Operation Principles **CSOM** Data Access Security SharePoint Online permissions collection and crawling uses SharePoint Client-Side Object Model (CSOM). **Azure Identity Collector** The permissions collection task queries SharePoint Online for the existing Role Assignments to determine object permissions. An Azure Identity Collector must be configured to map the permissions to users and groups from the Azure Active Directory. **Crawl level: Folder vs File** By default, permissions are analyzed to the folder level, but they can also be analyzed on the file level. If permissions are analyzed on the file level, the system will only display uniquely managed files in the Business Resource Tree. Refer to [Adding a SharePoint Online Application](https://documentation.sailpoint.com/das-connectors/help/o365/sharepoint_online/add/index.html) for information on analyzing file-level permissions. ## Collecting Data from an External Application The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your Data Access Security installation. 1. Install one or more Data Classification central engine using the server installer 1. Install one or more Permission Collection central engines using the server installer 1. Create an Application in Data Access Security from the Business Website. The application is linked to your installed central engines. 1. Add an Activity Monitor to collect activities for this application # Configuring and Scheduling the SharePoint Online Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. ## Configuring the Permission Collection The permission collector is a software component responsible for analyzing the permissions in an application. Note If the Data Access Security Central Permission Collector wasn’t installed during server installation, this configuration setting will be disabled. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collection** settings page. Note The entry fields vary by application type. 1. Select **Analyze Files with Unique Permissions**. Selecting this may impact performance as this is a heavy operation. 1. You can now schedule a task as described in the Configuring a Crawler section. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select **Next**. # Creating an Azure Application for SharePoint Online A new Azure Active Directory application must be created and configured to support the Data Access Security SharePoint Online functionality. This configuration can be performed either by running the automated PowerShell script supplied with the SailPoint distribution pack, or by creating and configuring the application through the Azure portal. ## Creating and Configuring the Application Automatically The script below will perform all the Azure application creation and configuration steps required for SharePoint Online. ### Windows Systems To run this script, the Azure AD PowerShell module must be installed. 1. Open PowerShell as an Administrator. 1. Install the Microsoft Graph PowerShell module: `Install-Module -Name Microsoft.Graph` 1. Open the `CreateSharePointOnline.ps1` file in a text editor to review the default parameters. The parameters can be edited in the file or passed as parameters when running the script. CreateSharePointOnline.ps1 ```powershell <# .SYNOPSIS Configures an Azure Application for use by Data Access Security SharePoint Online: .DESCRIPTION Configures an Azure Application for use by Data Access Security SharePoint Online Creates an Azure App with the following API Permissions: 1. Microsoft Graph: Sites.ReadWrite.All 2. SharePoint: Sites.FullControl.All 3. Office 365 Management APIs: ActivityFeed.Read Creates and uploads a certificate as app client credential. Prompts for App admin consent. .EXAMPLE .\CreateSharePointOnline.ps1 -AppName "SharePoint DAS App" -CertDnsName "contoso.com" -CertYearsValid 15 .NOTES Version: 3.0.0 Requires: Microsoft.Graph.Authentication, Microsoft.Graph.Applications, Microsoft.Graph.Identity.DirectoryManagement Install: Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Applications, Microsoft.Graph.Identity.DirectoryManagement #> param( [string]$AppName = 'DAS SharePoint Online', # DnsName will be included in Cert subject name [string]$CertDnsName = 'organization.com', [int]$CertYearsValid = 10, [int]$SleepBeforeConsentSeconds = 30, [Parameter(Mandatory=$True)] [Security.SecureString]$CertPassword ) # Stop the script on error $ErrorActionPreference = "Stop" # Windows PowerShell 5.1 defaults to 4096 functions per session, which the Graph modules can exhaust if ($PSVersionTable.PSEdition -ne 'Core' -and $MaximumFunctionCount -lt 32768) { $MaximumFunctionCount = 32768 } # Import only the submodules used here; importing the Microsoft.Graph meta-module loads every # submodule and overflows the function limit foreach ($module in 'Microsoft.Graph.Authentication', 'Microsoft.Graph.Applications', 'Microsoft.Graph.Identity.DirectoryManagement') { if (-not (Get-Module -ListAvailable -Name $module)) { throw "Required module '$module' is not installed. Run: Install-Module $module -Scope CurrentUser" } Import-Module $module -ErrorAction Stop } # Helper function to get required resource access (following pattern from CreateOneDriveApp.ps1) function Get-RequireResource{ param($appId, $permissionValues) $appObj = (Get-MgServicePrincipal -Filter ("AppId eq '{0}'" -f $appId)) $appPermissions = $appObj.AppRoles | Where-Object {$_.Value -in $permissionValues} $appHT = @() foreach($ap in $appPermissions){ $appHT += @{ Id = $ap.Id; Type = "Role"; } } $appResource = @{ ResourceAppId = $appId ResourceAccess = $appHT } return $appResource; } Write-Output 'Connecting to Microsoft Graph...' Connect-MgGraph -Scopes 'Application.Read.All', 'Application.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All' Write-Output 'Getting required API details...' # Define permissions for each API (following pattern from CreateOneDriveApp.ps1) $graphPermissionValues = 'Sites.ReadWrite.All' $o365PermissionValues = 'ActivityFeed.Read' $spoPermissionsValues = 'Sites.FullControl.All' $AppsAndPermissions = @{ '00000003-0000-0000-c000-000000000000' = $graphPermissionValues # Microsoft Graph 'c5393580-f805-4401-95e8-94b7a6ef2fc2' = $o365PermissionValues # Office 365 Management APIs '00000003-0000-0ff1-ce00-000000000000' = $spoPermissionsValues # SharePoint Online } '' 'Building API permissions...' $apiPermission = @() foreach($aAndP in $AppsAndPermissions.GetEnumerator()) { $apiPermission += Get-RequireResource $aAndP.Name $aAndP.Value } '' 'Registering Azure App...' # Register the new Azure App with API Permissions $myApp = New-MgApplication -DisplayName $AppName -RequiredResourceAccess $apiPermission # Display the new App properties '' "App Display Name: $($myApp.DisplayName)" "App ID: $($myApp.AppId)" '' 'Creating certificate...' # Create certificate $myCert = New-SelfSignedCertificate -DnsName $CertDnsName -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears($CertYearsValid) -KeySpec KeyExchange '' 'Exporting certificate files to disk...' # Export certificate to .pfx file $pfxFilePath = ".\$($AppName).pfx" $output = $myCert | Export-PfxCertificate -FilePath $pfxFilePath -Password $CertPassword -CryptoAlgorithmOption AES256_SHA256 # Display certificate pfx file path '' "Certificate pfx file path: $($output.FullName)" # Export certificate to .cer file $certFilePath = ".\$($AppName).cer" $output = $myCert | Export-Certificate -FilePath $certFilePath # Display certificate cer file path '' "Certificate cer file path: $($output.FullName)" '' 'Uploading certificate to Azure App...' # Upload and assign the certificate to Azure App (following pattern from CreateOneDriveApp.ps1) $keyCredentials = @{ customKeyIdentifier = $myCert.GetCertHash() key = $myCert.GetRawCertData() type = "AsymmetricX509Cert" usage = "Verify" startDateTime = $myCert.NotBefore endDateTime = $myCert.NotAfter } "Waiting $SleepBeforeConsentSeconds seconds to allow the Azure App to be fully created before uploading cert..." Start-Sleep $SleepBeforeConsentSeconds '' Update-MgApplication -ApplicationId $myApp.Id -KeyCredentials $keyCredentials '' 'Getting tenant details for consent...' # Get the tenant ID $tenantID = (Get-MgOrganization).Id # Build the consent URL $consentURL = "https://login.microsoftonline.com/$tenantID/adminconsent?client_id=$($myApp.AppId)" # Display the consent URL '' "Consent URL: $consentURL" '' 'Launching browser for consent...' # Browse to the consent URL using the default browser Start-Process $consentURL ``` 1. Run the script: - To run the script with the default parameters from the directory where the script is located, run `.\CreateSharePointOnline.ps1` - To run the script while overriding some of the default parameters, like DNS Name, years of certificate validity, or application name: `.\CreateSharePointOnline.ps1 -AppName "SharePoint DAS App" -CertDnsName "contoso.com" -CertYearsValid 15` 1. When prompted, log in with administrator credentials to create and configure Azure applications. ### Linux / MacOS Systems 1. Ensure you have the Azure CLI installed. - [Install - Linux](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux?view=azure-cli-latest&pivots=apt) - [Install - macOS](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-macos?view=azure-cli-latest) 1. For Linux / MacOS systems, open the `CreateSharePointOnline.sh` file in a text editor to review the default parameters. CreateSharePointOnline.sh ```powershell #!/bin/bash # Usage: ./CreateSharePointOnline.sh "Azure App Name" "CertificateDnsName.com" 10 30 "CertPassword" # # API permissions added (application / admin consent), aligned with CreateSharePointOnline.ps1: # 1. Microsoft Graph: Sites.ReadWrite.All # 2. SharePoint: Sites.FullControl.All # 3. Office 365 Management APIs: ActivityFeed.Read # # Then creates and uploads a certificate and opens the admin consent URL in a browser. APP_NAME="${1:-DAS SharePoint Online}" CERT_DNS_NAME="${2:-organization.com}" CERT_YEARS_VALID="${3:-10}" SLEEP_BEFORE_CONSENT="${4:-30}" CERT_PASSWORD="${5}" if [ -z "$CERT_PASSWORD" ]; then echo "Certificate password is required as the 5th argument." exit 1 fi set -e echo "Logging in to Azure..." az login --only-show-errors --allow-no-subscriptions echo "Registering Azure App..." # Web redirect URI required for admin-consent flow (AADSTS500113 if missing). Matches PS1 behavior: # after consent, browser redirects to localhost; success when URL contains admin_consent=True. APP_ID=$(az ad app create --display-name "$APP_NAME" --web-redirect-uris "http://localhost" --query appId -o tsv) echo "App Display Name: $APP_NAME" echo "App ID: $APP_ID" # Resolve app-role UUIDs from each resource service principal # Get-RequireResource). Hardcoded IDs drift or get mistyped; wrong RRA breaks admin consent (AADSTS65006). GRAPH_API_ID="00000003-0000-0000-c000-000000000000" O365_MANAGEMENT_API_ID="c5393580-f805-4401-95e8-94b7a6ef2fc2" SHAREPOINT_API_ID="00000003-0000-0ff1-ce00-000000000000" app_role_id() { local resource_app_id="$1" local role_value="$2" local resolved resolved=$(az ad sp show --id "$resource_app_id" --query "appRoles[?value=='${role_value}'].id | [0]" -o tsv) if [ -z "$resolved" ] || [ "$resolved" = "null" ]; then echo "ERROR: Could not resolve application permission '${role_value}' for API ${resource_app_id}." >&2 exit 1 fi echo "$resolved" } echo "Resolving API permission IDs from directory..." ID_SITES_READWRITE_ALL=$(app_role_id "$GRAPH_API_ID" "Sites.ReadWrite.All") ID_ACTIVITY_FEED_READ=$(app_role_id "$O365_MANAGEMENT_API_ID" "ActivityFeed.Read") ID_SITES_FULL_CONTROL=$(app_role_id "$SHAREPOINT_API_ID" "Sites.FullControl.All") echo "Adding required API permissions..." az ad app permission add --id "$APP_ID" --api "$GRAPH_API_ID" --api-permissions "${ID_SITES_READWRITE_ALL}=Role" az ad app permission add --id "$APP_ID" --api "$O365_MANAGEMENT_API_ID" --api-permissions "${ID_ACTIVITY_FEED_READ}=Role" az ad app permission add --id "$APP_ID" --api "$SHAREPOINT_API_ID" --api-permissions "${ID_SITES_FULL_CONTROL}=Role" # az may print hints about `permission grant`; that is for delegated permissions, not these app roles. # Admin consent is done in the browser at the end of this script (avoids CLI consent errors when an SP already exists). echo "Creating certificate..." CERT_SUBJECT="/CN=$CERT_DNS_NAME" CERT_DAYS=$((365 * CERT_YEARS_VALID)) openssl req -x509 -nodes -days "$CERT_DAYS" -newkey rsa:2048 -keyout "$APP_NAME.key" -out "$APP_NAME.crt" -subj "$CERT_SUBJECT" -passout pass:"$CERT_PASSWORD" openssl pkcs12 -export -out "$APP_NAME.pfx" -inkey "$APP_NAME.key" -in "$APP_NAME.crt" -password pass:"$CERT_PASSWORD" -keypbe AES-256-CBC -certpbe AES-256-CBC -macalg SHA256 echo "Certificate pfx file path: $(pwd)/$APP_NAME.pfx" echo "Certificate cer file path: $(pwd)/$APP_NAME.crt" echo "Uploading certificate to Azure App..." az ad app credential reset --id "$APP_ID" --cert "@$APP_NAME.crt" --append echo "Waiting $SLEEP_BEFORE_CONSENT seconds before admin consent..." sleep "$SLEEP_BEFORE_CONSENT" echo "Getting tenant details for consent..." TENANT_ID=$(az account show --query tenantId -o tsv) # redirect_uri must match a registered reply URL on the app (http://localhost above). CONSENT_URL="https://login.microsoftonline.com/${TENANT_ID}/adminconsent?client_id=${APP_ID}&redirect_uri=http%3A%2F%2Flocalhost" echo "Consent URL: $CONSENT_URL" echo "" echo "When you grant consent, the browser will redirect to a localhost URL that may not load." echo "That is expected. The operation succeeded if the address bar contains admin_consent=True." echo "" echo "Launching browser for consent..." if command -v xdg-open &> /dev/null; then xdg-open "$CONSENT_URL" elif command -v open &> /dev/null; then open "$CONSENT_URL" else echo "Please open the following URL in your browser:" echo "$CONSENT_URL" fi ``` The last step of the script will launch a URL to grant admin consent for the application. When you grant consent, you will be redirected to a missing localhost URL. The operation is successful if the URL for that page contains `admin_consent=True`. Note If you experience an access denied or other error in the web browser when granting admin consent, this might be a timing issue. This can be resolved by [manually granting admin consent](#creating-and-configuring-the-application-manually) through the Azure portal. Alternatively you can copy and paste the consent URL into your browser. This is found in the script at: `Consent URL:`. The following output should be gathered or noted when running the script. This information will be used to configure the SharePoint Online application in Data Access Security: 1. The App ID value in the console output. 1. The created certificate file .pfx located in your working directory. 1. The certificate password that was entered when prompted. Note Confirm the [API Permissions](#final-result) have been configured properly. ## Creating and Configuring the Application Manually The following steps will create and configure an Azure application for SharePoint Online authentication through the Azure portal. These steps are adapted from the [Microsoft SharePoint Online documentation](https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread). ### Registering the Application in Azure AD 1. Go to the the [Azure AD portal](https://portal.azure.com/). 1. Under Manage Azure Active Directory, select **View**. 1. On the Overview page that opens, under Manage, select **App registrations**. 1. On the App registrations page that opens, select **New registration**. 1. On the Register an application page that opens, configure the following settings: 1. Name - Enter something descriptive, like "SharePoint Online DAS App" 1. Supported account types - Verify that **Accounts in this organizational directory only (`` only - Single tenant)** is selected. 1. Redirect URI (optional) - Leave empty. 1. Select **Register**. You will now assign API permissions to the application from this screen. ### Assigning API Permissions to the Application 1. On the app page under Manage, select **Manifest**. 1. On the Manifest page, find the `requiredResourceAccess` entry. 1. Replace the entire `requiredResourceAccess` entry with the following: ```json "requiredResourceAccess": [ { "resourceAppId": "00000003-0000-0000-c000-000000000000", "resourceAccess": [ { "id": "9492366f-7969-46a4-8d15-ed1a20078fff", "type": "Role" } ] }, { "resourceAppId": "00000003-0000-0ff1-ce00-000000000000", "resourceAccess": [ { "id": "678536fe-1083-478a-9c59-b99265e6b0d3", "type": "Role" } ] }, { "resourceAppId": "c5393580-f805-4401-95e8-94b7a6ef2fc2", "resourceAccess": [ { "id": "594c1fb6-4f81-4475-ae41-0c394909246c", "type": "Role" } ] } ], ``` 1. Select **Save**. 1. On the Manifest page, under Manage, select **API permissions**. 1. On the API permissions page, verify the following permissions appear on the list: - Microsoft Graph - Sites.ReadWrite.All - Office 365 Management APIs - ActivityFeed.Read - SharePoint - Sites.FullControl.All 1. Select **Grant admin consent for **. Read the confirmation dialog that opens. 1. Select **Yes** in the confirmation dialog. The Status value should now be **Granted for ** on both entries. Note Confirm the [API Permissions](#final-result) have been configured properly. 1. Close the API Permissions page (*not the browser tab*) to return to the App registrations page to generate a self-signed certificate. ### Generating a Self-Signed Certificate Create a self-signed x.509 certificate using the following PowerShell commands. If an error message displays saying access is denied, run PowerShell as an Admin. Edit parameters such as DnsName, Certificate expiration, and password as appropriate: **Create certificate** ```text $mycert = New-SelfSignedCertificate -DnsName "contoso.org" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(**15**) -KeySpec KeyExchange ``` **Export certificate to .pfx file** This .pfx file will be used in the application configuration. ```text $mycert | Export-PfxCertificate -FilePath mycert.pfx -Password $(ConvertTo-SecureString -String "P@ssw0Rd1234" -AsPlainText -Force) ``` **Export certificate to .cer file** The .cer file will be used in step 6 of [Assigning the Certificate to the Azure Active Directory Application](#assigning-the-certificate-to-the-azure-active-directory-application). `$mycert | Export-Certificate -FilePath mycert.cer` ### Assigning the Certificate to the Azure Active Directory Application After you register the certificate with your application, you can use the private key (.pfx file) for authentication. 1. Go to the the [Azure AD portal](https://portal.azure.com/). 1. Under Manage Azure Active Directory, select **View**. 1. On the Overview page, under Manage, select **App registrations**. 1. On the Apps registration page, select the application you [registered](#registering-the-application-in-azure-ad). 1. On the application page, under Manage, select **Certificates & secrets**. 1. Select **Upload Certificate**. 1. Browse to the self-signed certificate .cer file that you created when [generating a self-signed certificate](#generating-a-self-signed-certificate). 1. Select **Add**. The certificate is now shown in the **Certificates** section. ## API Permissions Configuration Note The image above is a reference image to highlight configuration requirements. # Verifying the SharePoint Online Connector Installation You can verify your SharePoint Online connector installation by checking your application configuration and validations. ## Verifying Application Configuration After the configuration of one of the following applications is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common SharePoint Online Validations The following is a list of common validations that run when the test connection is run with a SharePoint Online application. - Server responsiveness - Verifying there is a connection with SharePoint Online - Verifying access to the admin site - Verifying the ability to list site collections - Verifying the API permissions are correctly configured - Verifying the event auditing is active through the Office 365 API ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify that: 1. The tasks completed successfully 1. Business resources were created in the resource explorer (**Admin > Applications >[application column] > Manage Resources**) 1. Permissions display in the Permission Forensics page (**Forensics > Permissions**) # Adding a SharePoint Online Application In order to integrate with SharePoint Online, we must first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select Wizard Type. 1. Select **Standard Application** 1. Select **Next**. ## General Details 1. Complete the General Details: - Application Type - SharePoint Online - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name and select **Enter** to create a tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. - Identity Collector - (Mandatory) Select either Azure Active Directory or Microsoft Entra as the Identity Collector. - You can create identity collectors on the **Admin > Identity Collectors** page. - If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. - Direct Access Revocation - Enabled by default. This allows permissions to be revoked that have been directly granted on the SharePoint Online application. 1. Select **Next**. ## Connection Details 1. Complete the Connection Details: - Initial Domain Name - The Initial Domain Name that was given when the Azure tenant was initially created can be found in **Microsoft 365 admin center > Settings > Domains**. It can be identified by its .onmicrosoft.com suffix and that it cannot be deleted. - Application ID - Enter the Application ID for the Azure application used by the Data Access Security SharePoint Online Connector. - Certificate File - The certificate assigned to the Azure application used by the Data Access Security SharePoint Online Connector. Either navigate to the certificate by selecting **Choose a File**, or drag the certificate onto the Certificate File Path field. - Supported file formats: pfx, p12. - Certificate Password - Enter the password for the certificate. Note When editing this application, if a new certificate is uploaded, the former password cannot be used. The user has to provide a new password. 1. Select **Next**. You can now [configure and schedule permissions collection and resource discovery](https://documentation.sailpoint.com/das-connectors/help/o365/sharepoint_online/sharepoint_online_permissions_collection.html) # Selecting and Scheduling the SharePoint Online Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Data Classification** on. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This cluster is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. If a central data classification service is selected, you can schedule a task. 1. Select **Next** or **Done**. # Configuring SharePoint Online Activity Monitoring 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Activity Monitoring** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Activity Monitoring** on. Note Verify auditing is enabled which was listed in the prerequisites. ## Activity Exclusions Note Activity Monitoring exclusions need to be manually added. Allows administrators to configure activities which are not desired to reduce unnecessary noise of activity data set. Activities which match exclusions will be discarded so they will not display in forensics or be held in any storage. To add an exclusion: 1. Type an exclusion into the relevant dropdown list (file extension, user, folder, actions). 1. Select the **+** icon to add it to the list. 1. Select to **Next** or **Cancel** to close the panel once the list is complete. To edit or remove an exclusion from the list: 1. Select the appropriate dropdown list. 1. On the desired extension that needs to be edited or removed, select either the edit or delete icon. 1. Select to **Next** or **Cancel** to close the panel. 1. Click **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., txt, exe. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., \\servername\\share1\\folder1. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. **Exclude Actions** - List of actions that are not monitored. e.g., copy file. ## Supported Event Types - Access Request Approved - Access Request Created - AccessInvitationAccepted - AccessRequestApproved - Added To Group - Added To Secure Link - Anonymous Link Created - AnonymousLinkRemoved - AnonymousLinkUpdated - AnonymousLinkUsed - App Catalog SP Corporate Catalog Accessor Base Add - App Catalog SP Tenant Corporate Catalog Accessor Sync Solution To Teams - App Store Storefront Show App Details Page - App Store Storefront Task Get Apps - Client View Signaled - Comment Created - Comments Disabled - Company Link Created - Company Link Removed - CompanyLinkUsed - Device Access Policy Changed - File Accessed - File Accessed Extended - File Check Out Discarded - File Checked In - File Checked Out - File Copied - File deleted - File Deleted First Stage Recycle Bin - File Downloaded - File Modified - File Modified Extended - File Moved - File Previewed - File Recycled - File Renamed - File Uploaded - FileDeletedFirstStageRecycleBin - FileDeletedSecondStageRecycleBin - Folder Accessed - Folder Copied - Folder Created - Folder Deleted First Stage Recycle Bin - Folder Modified - Folder Moved - Folder Recycled - Folder Renamed - Folder Restored - FolderDeleted - FolderDeletedFirstStageRecycleBin - FolderDeletedSecondStageRecycleBin - Group Added - Group Removed - Group Updated - List Column Created - List Column Updated - List Created - List Item Created - List Item Updated - List Item Viewed - List Updated - List View Created - List View Updated - List Viewed - Page Prefetched - Permission Level Added - Removed From Group - RemovedFromSecureLink - Search Query Performed - Secure Link Created - SecureLinkCreated - SecureLinkDeleted - SecureLinkUsed - SharedLinkCreated - SharedLinkDisabled - Sharing Inheritance Broken - Sharing Inheritance Reset - Sharing Invitation Created - Sharing Policy Changed - Sharing Revoked - Sharing Set - SharingInvitationAccepted - SharingInvitationBlocked - SharingInvitationCreated - SharingInvitationUpdated - SharingRevoked - SharingSet - Site Collection Admin Added - Site Collection Admin Removed - Site Collection Created - Site Collection Quota Modified - Site Column Created - Site Content Type Created - Site Deleted - Site Design Invoked - Site IB Mode Set - Site Locks Changed - Site Sharing Report Job Created - SiteDeleted - SP Corporate Catalog App Metadata Deploy Skip Feature Deployment - SP Corporate Catalog App Metadata Deploy With Feature Deployment - Web Members Can Share Modified - Web Request Access Modified # Configuring and Scheduling the SharePoint Online Crawler To set or edit the Crawler configuration and scheduling: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. 1. The **Include Backend System Resources** option is disabled by default. Enable it to crawl resources that are created and maintained by Microsoft including but not limited to site diagnostics and system lists. These items are marked as hidden but can be accessible through the SharePoint Online UI. Note Enabling this feature will add additional time for the crawl to complete. 1. In the Calculate Resource Size field, determine when, or at what frequency, Data Access Security calculates the resources' size: - Never - Always - Second crawl and on (default) 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select the **Active** checkbox to activate the schedule. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Set the Crawl Scope by: - Setting an explicit [list of resources](#including-and-excluding-paths-by-list) to include or exclude from the scan. - [Creating a regex](#excluding-paths-by-regex) to define resources to exclude. 1. Select **Next**. Note Microsoft can take up to 45 minutes to make newly created sites available for collection. If you are not seeing newly created SharePoint Online sites in Data Access Security after the crawl task is completed, wait and try again after the allotted time. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, enter the full path to include or exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Enter the paths to exclude by regex. Since the system does not collect Business Resources that match this regex, it also does not analyze them for permissions. ### Crawler Regex Exclusion Examples **Exclude all drives which start with one or more user names:** - Exclude drives starting with John.Doe: `^Personal\/John\.Doe@.*` - Exclude drives starting with John.Doe or Jane.Doe: `^Personal\/(John|Jane)\.Doe@.*` **Include ONLY drives which start with one or more user names:** - Include only drives starting with John.Doe: `^(?!Personal\/John\.Doe@.*).*` - Include only drives starting with John.Doe or Jane.Doe: `^(?!Personal\/(John|Jane)\.Doe@.*).*` **Narrow down the selection:** - Include only the C$ drive shares: \\server_name\\C$: `^(?!\\\\server_name\\*C*\$($|\\.*)).*` - Include only one folder under a share: \\server\\share\\folderA: `^(?!\\\\server_name\\share\$($|\\*folderA*$|\\*folderA*\\.*)).*` - Include only administrative shares: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. 1. Select **Next**. # On-Prem Connectivity The following are Data Access Security supported connectors: - [Active Directory](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/active_directory/index.html) - [NetApp](https://documentation.sailpoint.com/das-connectors/help/nas_file_storage/index.html) - [Powerscale](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/powerscale/index.html) - [SharePoint](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/sharepoint/index.html) - [SMB](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/smb/index.html) - [Unity](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/unity/index.html) - [Windows Server](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/windows_server/index.html) Important Based on the type of functionality you plan to incorporate for the connector in [Data Access Security](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html), select the corresponding Virtual Appliance cluster component type in SailPoint Human Fabric. # Active Directory Connector Overview This connector enables you to use Data Access Security to access and analyze data stored in Active Directory and do the following: - Analyze the structure of your stored data. ## Installation Flow Overview 1. Configure the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/active_directory/prereqs.html). 1. [Add](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/active_directory/add/index.html) a new Active Directory application. ## Crawling Supported for all domain versions, forest versions, and operating systems. ## Collecting Data Stored in a Managed Application The list below describes the high-level installation process required to collect and analyze data from an external application. Most of these should already be set up in your Data Access Security installation. 1. Create an Application in Data Access Security. 1. Create a [Virtual Appliance cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to enable Resource Discover. # Prerequisites for Active Directory Verify the following is set up for crawling. Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. ## Crawling and Permission Collection Prerequisites Active directory SSL is recommended; but requires a SSL certificate which will need to be upload the to Data Access Security. Non-ssl is enabled by default. **If utilizing SSL:** Enable 636 port inbound rule on the firewall on all Active Directory Domain Controllers. **If utilizing non-SSL:** Enable 389 port inbound rule on the firewall on all Active Directory Domain Controllers. Note Data Access Security does not support custom ports. You must utilize default ports to properly connect to Active Directory Lastly, two [Virtual Appliances](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) need to be installed. When creating a virtual appliance for Active Directory, be sure to select the Data Access Security - Resource Crawler and the Data Access Security - Permission Collection under Type. ## Adding a SailPoint Human Fabric Active Directory Source Creating a new separate Active Directory Custom App for SailPoint Human Fabric is recommended. The following attributes are required: **Accounts (Identities)** - sAMAccountName - NetBIOSName - objectSid **Groups (Entitlements)** - sAMAccountName - NetBIOSName - objectSid # Verifying the Active Directory Connector Installation You can verify your Active Directory connector installation by checking your application configuration and validations. ## Verifying Application Configuration After the configuration of the applications is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common Active Directory Validations The following is a list of common validations that run when the test connection is run with an Active Directory application. - Check that the configured account can connect to Active Directory and see if it encounters any of these common errors: - Account restrictions - Expired account or password - An account in an invalid state like disabled, locked out, or in too many security groups - If SSL is enabled, validating the certificate # Adding an Active Directory Application In order to integrate with Active Directory, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details 1. Review and edit the application's general details: - Application Type - Active Directory - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. 1. Select an **Identity Collector** of type Active Directory. - You can create identity collectors on the **Admin > Identity Collectors** page. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Fill in the connection details: - Domain Name - FQDN of the domain. Warning When using the host.yaml file in the virtual appliance, the domain name is case-sensitive. - SSL - Select if utilizing SSL. Must be checked to connect with LDAPS. If this is selected, a certificate needs to be provided. - Domain NetBIOS Name - The short name of the domain. Warning Do not put the FQDN in this field. This results in authentication failures. - Base DN - Use Distinguished Name (DN) for field entry. The level in the Active Directory tree from which the crawler will start collecting resource. This field should remain empty unless needed. - Username - The following are the types of usernames. In order to connect to Data Access Security, you need to have access to Active Directory. The user cannot be suspended or disabled. - samAccountName - UPN - If the user is from a different trusted domain. - Distinguished Username - (example 'cn=user1, dc=users, dc=example, dc=com') - Password - The user's password. - Specific Server Connection - Data Access Security will connect dynamically to any of the domain controllers available. To specify a specific domain controller to force all communication, enter the server name into this field. - Select **Next**. You can now [configure and schedule resource discovery](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/active_directory/add/ad_perm_collection.html). # Configuring and Scheduling the Active Directory Crawler To set or edit the Crawler configuration and scheduling: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. **Resource Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. 1. [Schedule a task](#scheduling-a-task). 1. Set the Crawl Scope by: - Setting an explicit [list of resources](#including-and-excluding-paths-by-list) to include or exclude from the scan. - [Creating a regex](#excluding-paths-by-regex) to define resources to exclude. ## Setting the Crawl Scope There are several options to set the crawl scope: Note When the crawl is performed, two resources will display but neither are added by the crawl. These two resources also cannot be removed from the scope. Configuration Resource:for all activities that occur in the Configuration schema of the domain, which is shared across the forest. This means that in a multi-domain forest, you will still see it under the forest node rather than under the domain node. \_Audit Policy: specifically for changes to the domain's audit policy, which are not really associated with any part of the domain tree, thus are given their own resource. - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, enter the full path to include or exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Enter the paths to exclude by regex. Since the system does not collect Business Resources that match this regex, it also does not analyze them for permissions. ### Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: **Exclude all users (CNs) under specific department (OU)** Example: All under Finance OU Regex: ^CN=.+,OU=finance,DC=office,DC=mydomain,DC=com$ | Example: All under Finance and Accounting OU Regex: ^CN=.+,OU=(finance|accounting),DC=office,DC=mydomain,DC=com$ | **Include ONLY users (CNs) under specific department (OU)** Example: Only under Finance OURegex: ^(?! CN=.+,OU=finance,DC=office,DC=mydomain,DC=com)$ | ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. If all resources need to be selected, select **Select All**. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Configuring and Scheduling the Active Directory Permission Collection To configure the permission collection: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permission Collection** settings page. **Permission Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select the **Active** checkbox to activate the schedule. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select **Next**. # Active Directory Troubleshooting Check the issue below for common problems and suggested ways of handling them. ## Errors in Accessing the Domain Controllers If there are errors in accessing the domain controllers, such as RPC server or server not available: - Verify that this domain controller is running on Windows 2008 or above. - Open the event viewer of the domain controller on which the change was made, with the user configured in the Application configuration. If the viewer fails to open, verify that the user has the permissions described in the prerequisites section. # PowerScale Connector Overview This connector enables you to use Data Access Security to access and analyze data stored in PowerScale and do the following: - Provide storage structure analysis. - Verify user permissions. - Classify the data being stored. - Monitor user activity on resources. - Collect local users and groups. This connector does not support PowerScale NFS. ## Installation Flow Overview 1. Configure the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/powerscale/prereqs.html). 1. [Add](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/powerscale/add/index.html) a new PowerScale application. ## PowerScale Connector Operation Principles - Data Access Security connects to the EMC PowerScale shares and analyzes folders permissions. - Data Access Security utilizes SMB protocol to gather local users, groups, and share permissions. Data Access Security will utilize OneFS platform API (if enabled) and SMB protocol to process audit events. ## Collecting Data Stored in a Managed Application The list below describes the high-level installation process required to collect and analyze data from an external application. Most of these should already be set up in your Data Access Security installation. 1. Create a [Virtual Appliance cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) for each feature that needs to be enabled for Data Access Security. 1. Create an Application in Data Access Security. ## Multiple Access-Zone and Tenant Isolation Support Data Access Security offers tenant isolation and full capabilities for multiple access-zones on PowerScale Clusters. With the addition of the activity monitoring and permissions collection capabilities for multiple access-zones within an PowerScale cluster and removing the dependency on the administrative (system)-zone-based OneFS API, each access zone within the cluster can function as an independent PowerScale application within Data Access Security, with the complete set of Data Access Security capabilities. This mode of access requires knowledge, connectivity and access rights of and to the managed access zone. This allows for a complete delegation of the configuration, administration and monitoring of an PowerScale access zone to the tenant owner, and does not require centralized management. Tenant Isolation and management is critically valuable in multi-tenant hosted environments, where such isolation enhances data privacy and autonomous management. The access zone and management API (optional) settings can be configured through the application configuration wizards. With full tenant isolation, and full capability support for multiple access zones on the PowerScale cluster, each access zone is treated as a separate entity. ### Activity Monitoring for Access Zones of the Same Cluster Due to limitations of the CEPA architecture, all systems utilizing the same Common Event Enabler (CEE) must be configured to use the same Data Access Security activity monitoring virtual appliance cluster. There is a one to one relationship from the virtual appliance cluster to the CEE. You must select the same activity monitoring virtual appliance cluster for all associated Data Access Security applications. For example, PowerScale1, PowerScale2, and Unity1 are configured with CEE1. PowerScale3 is configured with CEE2. When creating Data Access Security applications for PowerScale1, PowerScale2 and Unity1, each need to be configured utilizing the same activity monitoring virtual appliance cluster which corresponds to CEE1. When creating a Data Access Security application for PowerScale3, it would require creating a new activity monitoring virtual appliance cluster which would correspond to CEE2. Do not utilize the same activity monitoring virtual appliance cluster configured with CEE1 for PowerScale3 applications. Important Configuring multiple CEE's to one activity monitoring virtual appliance cluster can cause missing events. Important This only applies for Dell EMC activity monitoring. Due to limitations in the CEE architecture, the CEE forwards events to *only one* virtual appliance node in the activity monitor virtual appliance cluster at a time. Any additional virtual appliances associated in the cluster will act as a failover. Important Adding multiple virtual appliances in the cluster will not improve throughput. # Verifying Application Configuration After the configuration is complete, verify PowerScale was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ## Common PowerScale Validations The following is a list of common validations that run when the test connection is run with a PowerScale application. **Resource Crawler Validations:** - Verifying the ability to list shares - Verifying the ability to read share permissions - Verifying the membership to the Backup Operators group **Data Classification Validations:** - Verifying the ability to list shares ## Permissions Collection 1. Run the Crawler task by going to **Settings > Task Management > Scheduled Tasks**. Upon successful completion, run the Permission Collection task. 1. Verify that: - The tasks completed successfully. - Go to **Admin > Applications > *[application column]* > Manage Resources** to view the business resources that were created. - Go to **Forensics > Permissions** to view permissions. # PowerScale Connector Prerequisites Verify your system fits the descriptions below before starting the installation. ## Pre-software Requirements **EMC PowerScale Isilon** - OneFS 7.1 to OneFS v9.7.0.0 **EMC Common Event Enabler** - CEE 6.5 and above ## Configuring the CEE Service ### Linux Hosted CEEs 1. On every CEE server, navigate to the `/opt/CEEPack` directory and ensure that the `emc_cee_config.xml` has the following in the `` block, under ``: ```json ... 1 whitebox@http://IP of your Activity Monitor VA ... ... ``` 1. Restart the EMC CEE service. ### Windows Hosted CEEs 1. On every CEE server, open the registry and perform the following changes: `[HKLM\Software\EMC\CEE\CEPP\Audit\Configuration]` `Endpoint=whitebox@http://:13000` `Enabled=1` Note If multiple virtual appliances in the activity monitoring virtual appliance cluster exist, each should be listed semicolon (;) separated like: whitebox@http://``:13000; whitebox@http://``:13000;... Note Type is REG_DWORD. 1. Restart the EMC CEE service. ## Enabling CEE using PowerScale OneFS WebUI 1. Select **Cluster Management**, then **Auditing**. 1. Click **Enable Protocol Access Auditing**. 1. Add Access Zone(s) you want to audit. **Event Forwarding** - Enter the uniform resource identifier (URI) where the CEE service is installed. The format of the entry is: ```text http://[fully.qualified.domain.name/IP]:[port]/cee Example: http://172.17.40.251:12228/cee ``` Note `https` is not currently supported. **Port** - The default is 12228 **Storage Cluster** - Provide a name for the cluster. This can be empty. ## Enabling and Configuring Auditing the CLI **To enable auditing** - `isi audit settings global modify --protocol-auditing-enabled on` **To disable auditing** - `isi audit settings global modify --protocol-auditing-enabled off` **Add access zone to audit** - `isi audit settings modify --audited-zones ` **View audit settings** - `isi audit settings global view` ### Audit Event Configuration Using CLI **To enable specific audit events** - isi audit settings modify --audit-success create, rename, delete, read, write, get_security, set_security **To enable all audit events** - isi audit settings modify --audit-success all **To monitor all the activities listed under the Monitored Activates section** - Enable all audit events ## Required Permissions Data Access Security requires different permissions, based on the tasks that require those permissions. The user configured in the Application configuration wizard must have the following permissions on the Access Zone: - Share Read permissions to all share - Member of the local Administrator group - Member of the local Backup Operators group - Ability to list shares Add required permissions by creating a new role and associating the user with that role in one of the following ways: **Add Permissions via the Cluster Management Web Interface** 1. Log in to the OneFS Cluster Management Web interface. 1. Select **Access > Membership and Roles**. 1. Select the **Roles** tab. 1. Select **Create Role**. 1. Enter a name for the Role (ex. DataAccessSecurity) 1. Select **Add a member to this role** and add the Data Access Security user which will be used in the Application Configuration wizard. 1. Scroll down and select **Add a privilege to this role** and add the following privileges: 1. ‘Platform API: Log in to the Platform API and WebUI’ – read_only Access 1. Auth: Configure Identities and authentication sources – read_only Access 1. Audit: Configure audit capabilities – read_only Access 1. SMB: configure SMB server – read_only Access **Add Permissions via the Cluster Management Shell** Run the following commands from the cluster management shell: - `isi auth roles create DataAccessSecurity` - `isi auth roles modify DataAccessSecurity --add-priv-ro=ISI_PRIV_LOGIN_PAPI` - `isi auth roles modify DataAccessSecurity --add-priv-ro=ISI_PRIV_SMB` - `isi auth roles modify DataAccessSecurity --add-priv-ro=ISI_PRIV_AUTH` - `isi auth roles modify DataAccessSecurity --add-priv-ro=ISI_PRIV_AUDIT` - `isi auth roles modify DataAccessSecurity --add-user=’\’` **Add Permissions via Built-in Roles** Associate the user with the SystemAdmin and SecurityAdmin built-in roles. - `isi auth roles modify SystemAdmin --add-user=’\’` - `isi auth roles modify SecurityAdmin --add-user=’\’` ## Permissions Required for each Data Access Security Task The user must have the permissions listed below in order to perform these tasks: **Crawling** - Share Read permissions to all the shares on the file server. - Be a member of the local Administrator group on the Access Zone. **Permission Collection** - Share Read permissions to all the shares on the Access Zone. - Be a member of the local Backup Operators group on the Access Zone. - Be a member of the local Administrators group to read the Share Permissions. - Permissions to the OneFS Platform API to read the local Users and Groups. **Data Classification** - Share Read permissions for all the shares on the Access Zone. - Be a member of the local Backup Operators group on the Access Zone. **Activity Monitoring** - Ability to list shares. - Share Read permissions to all the shares on the file server. - Be a member of the local Backup Operators and local Administrator group on the Access Zone. - If enabling of OneFS the additional permission of PAPI access for configured user (requires proper license). ## Configuring PowerScale with Data Access Security 1. If utilizing separate IP address ranges assigned to each access zone, each access zone should have its own separate Data Access Security application. 1. If utilizing a single IP address range assigned to the System access zone or a single overarching access zone, then the System/main access zone should be the target of a single application in Data Access Security. Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. ## Communication Requirements | **Requirement** | **Source** | **Destination** | **Port** | | ------------------- | ---------------------------------- | ---------------------------------- | -------- | | EMC CEE | EMC PowerScale / Isilon cluster | CEE Service | 12228 | | OneFS Plaform API | Activity Monitor Virtual Appliance | PowerScale | 8080 | | Activity Monitoring | CEE Service | Activity Monitor Virtual Appliance | 13000 | | Activity Monitoring | Activity Monitor Virtual Appliance | PowerScale | SMB | # Adding a PowerScale Application In order to integrate with PowerScale, first create an application entry in Data Access Security. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## General Details 1. Review and edit the application's general details: - Application Type - PowerScale - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. 1. Select an **Identity Collector** of type Active Directory. - You can create identity collectors on the **Admin > Identity Collectors** page. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Review and edit the application's general details: - Host Name - The real name used when connecting to the CIFS server. This will be used by the SMB (CIFS) protocol. Note NFS is not supported at this time. - Domain Name, Username, Password - Credentials for the user defined in the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/powerscale/prereqs.html). - Storage Cluster Name - The name defined in the PowerScale Auditing configuration. If no storage cluster name is defined in the PowerScale Web Admin interface Auditing configuration, leave blank. - Access Zone - Enter the Access Zone which the PowerScale is being configured. Leave empty if configuring a single application for all access zones. Field does not accept multiple values. See [Configuring PowerScale with Data Access Security](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/powerscale/prereqs.html#configuring-powerscale-with-data-access-security) for more details. - Use OneFS API - Toggle on to enable access to the OneFS API. If not enabled, Data Access Security will collect information via SMB protocol which accesses only the managed Access Zone configured. Tip We recommend only enabling this for Data Access Security applications containing the System Access Zone or if configuring one Data Access Security application for all access zones. - Web Administrative Interface - Valid only If access to the OneFS API is enabled, by enabling the Use OneFS API toggle. This field specifies the location of the Management API (System access zone). This field accepts IP addresses or any resolvable DNS name (FQDN or otherwise). - Aliases - SmartConnect Zone Aliases used as alternative DNS Names for the CIFS Server. All aliases must be provided to ensure that all activities performed on that server, through all access paths, are monitored by Data Access Security. These are available under the IP Pool Settings, in the Network Configuration section of the PowerScale OneFS Admin Interface, under the **Cluster Management > Network Configuration** tab. Note For access zone configurations, see [Configuring PowerScale with Data Access Security](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/powerscale/prereqs.html#configuring-PowerScale-with-data-access-security). Note Storage Cluster Name, Access Zone, Use OneFS API, and Aliases are only needed if utilizing Activity Monitoring. # Selecting and Configuring PowerScale Activity Monitoring 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Activity Monitoring** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Activity Monitoring** on. 1. Associate the application with a Data Access Security Activity Monitoring Collection Cluster. This cluster is responsible for running the Activity Monitoring data collection tasks on dedicated virtual appliances. Note This connector requires the activity monitoring virtual appliance to accept incoming network connections on port 13000. SailPoint recommends restricting incoming network access to only the devices that generate the relevant audit events. Note Verify auditing is enabled which was listed in the prerequisites. Note Ensure when selecting an Activity Monitoring virtual appliance cluster, [recommendations](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/powerscale/index.html#multiple-access-zone-and-tenant-isolation-support) are properly followed to ensure all events are collected. ## Setting the Data Retention Period Setting a data retention period allows the user to specify how long activities will be stored offline. Activities are available on the [Activity Forensics](https://documentation.sailpoint.com/das/help/forensics/activity_forensics.html) screen for a default of 12 months. After the initial 12 months, the activity data is retained and available via a support ticket. You can set a retention period from between 1 month and 7 years. After the retention period is met, all activities will be deleted. **Example:** If the data retention period in the application configuration is set to 18 months, the activities will be available in Data Access Security for the initial 12 months and then available by a support ticket for the 18 additional months, making it a total of 30 months. Note If any configuration changes are made after activity monitoring is initially enabled, save the changes and wait for about 60 seconds, or restart the virtual appliance to allow the changes to take effect. Note If a password in the configuration changes, the old password is cached for activity monitoring for 24 hours. Restart the activity monitoring virtual appliance cluster to ensure the password update takes effect and prevent the use of the cached password within the next 24 hours. ## Activity Exclusions Note Activity Monitoring exclusions need to be manually added. Allows administrators to configure activities which are not desired to reduce unnecessary noise of activity data set. Activities which match exclusions will be discarded so they will not display in forensics or be held in any storage. To add an exclusion: 1. Type an exclusion into the relevant dropdown list (file extension, user, folder, actions). 1. Select the **+** icon to add it to the list. 1. Select to **Next** or **Cancel** to close the panel once the list is complete. To edit or remove an exclusion from the list: 1. Select the appropriate dropdown list. 1. On the desired extension that needs to be edited or removed, select either the edit or delete icon. 1. Select to **Next** or **Cancel** to close the panel. 1. Click **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., txt, exe. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., \\servername\\share1\\folder1. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. **Exclude Actions** - List of actions that are not monitored. e.g., copy file. ## Supported Event Types - Create File - Create Folder - Create from Move - Create from Rename - Delete File - Delete Folder - Move File - Move Folder - Permission Change File - Permission Change Folder - Read File - Rename File - Rename Folder - Write File # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. **Resource Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. 1. In the Calculate Resource Size field, determine when, or at what frequency, Data Access Security calculates the resources' size: - Never - Always - Second crawl and on (default) 1. [Schedule a task](#scheduling-a-task). 1. Set the Crawl Scope by: - Setting an explicit [list of resources](#including-and-excluding-paths-by-list) to include or exclude from the scan. - [Creating a regex](#excluding-paths-by-regex) to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, enter the full path to include or exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the \*\*Crawler\* settings page. Note The entry fields vary by application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Enter the paths to exclude by regex. Since the system does not collect Business Resources that match this regex, it also does not analyze them for permissions. ### Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: **Exclude all shares which start with one or more shares names:** Starting with `\\server_name\*shareName*` Regex:`\\\\server_name\\`*shareName*`$` Starting with `\\server_name\shareName or \\server_name\*OtherShareName*` Regex: `\\\\server_name\\(`*shareName*`|`*OtherShareName*\`)$\`\` **Include ONLY shares which start with one or more shares names:** Starting with `\\server_name\*shareName` Regex: `^(?!\\\\server_name\\*shareName*($|\\.*)).*` Starting with `\\server_name\*shareName*` or `\\server_name\*OtherShareName*` Regex: `^(?!\\\\server_name\\(`*shareName*`|`*OtherShareName*`)($|\\.*)).*` **Narrow down the selection:** Include ONLY \*the C$ drive shares: `\\server_name\*C$*` Regex: `^(?!\\\\server_name\\*C*\$($|\\.*)).*` Include ONLY one folder under a share: `\\server\share\*folderA*` Regex`: ^(?!\\\\server_name\\share\$($|\\`*folderA*`$|\\`*folderA*`\\.*)).*` Include ONLY all administrative shares Regex: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Selecting and Configuring the Data Classification To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Data Classification** on. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This cluster is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. If a central data classification service is selected, you can schedule a task. 1. Select **Next** or **Done**. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. To configure the Permission Collection: 1. Navigate to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Click the edit icon on the line of the application. 1. Select **Next** until you reach the **Permissions Collection** settings page. The actual entry fields vary according to the application type. **Permission Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. **Permissions Comments on PowerScale for SMB server** - The permissions are managed on the NTFS level, or on the Share Level (as when the shares are configured with Full Control to everyone, and all the permissions are defined in the folders, in which case you should select NTFS, which is the default). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select the **Active** checkbox to activate the schedule. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select **Next**. # SharePoint Overview This connector enables you to use Data Access Security to access and analyze data stored in SharePoint and do the following: - Analyze the structure of your stored data. - Classify the data being stored. ## Installation Flow Overview 1. Configure the [prerequisites](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/sharepoint/prerequisites.html). 1. [Add](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/sharepoint/add/index.html) a new SharePoint application. ## Crawling Supported for all domain versions, forest versions, and operating systems. ## Supported Versions SharePoint supports SharePoint Server 2016 and 2019. ## Collecting Data Stored in a Managed Application The list below describes the high-level installation process required to collect and analyze data from an external application. Most of these should already be set up in your Data Access Security installation. 1. Create an Application in Data Access Security. 1. Create a [Virtual Appliance cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to enable Data Classification and Resource Discovery. # Prerequisites You will need users with the following permissions to interact with SharePoint: 1. Create a designated domain user in the domain in which SharePoint works (for example, das_wss). 1. Run "SPOnPremPermissions_ConfgAndContentDB.sql" script on the SQL server hosting the SharePoint Configuration database. This will grant necessary permissions for DAS to properly access Sharepoint information. If all content databases reside on the same server, there are no additional steps necessary. If there are content databases located on separate servers, run "SPOnPremPermissions_ContentDBOnly.sql" script on each content database as directed by script. Note SPOnPremPermissions_ConfgAndContentDB.sql provides the option to exclude Content databases which you wish to not be accessed by DAS. All content databases which should not be included, regardless of location, should be included in this script SPOnPremPermissions_ConfgAndContentDB.sql ````text ``` /* For the servers that host both: a config DB and 1 or more content DBs. Can be ran all at once or portion by portion. */ /* This script creates a new login for a SharePoint application with all required permissions for the Data Access Security services. INSTRUCTIONS: ------------ (*) Replace the "%USERNAME%" variable with the appropriate user name (e.g. DOMAIN\USER). (*) Replace the "%CONFIG_DB%" variable with the appropriate config database name (usually "SharePoint_Config"). (*) Optional - Exclude content databases by adding rows to the "@excludedContentDBS" table variable (see last section). */ SET NOCOUNT ON /**********************************************************/ /* CREATE THE NEW USER LOGIN */ /**********************************************************/ USE [master] GO IF NOT EXISTS (SELECT [loginname] FROM [master].[dbo].[syslogins] WHERE [name] = '%USERNAME%') BEGIN CREATE LOGIN [%USERNAME%] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english] PRINT 'Created a new login - ''%USERNAME%''' END /**********************************************************/ /* GRANT ACCESS TO THE "Config" DATABASE */ /**********************************************************/ USE [%CONFIG_DB%] GO IF (USER_ID('%USERNAME%') IS NULL) BEGIN CREATE USER [%USERNAME%] FOR LOGIN [%USERNAME%] WITH DEFAULT_SCHEMA=[%USERNAME%] END GRANT EXECUTE ON [dbo].[proc_GetVersion] TO [%USERNAME%] GO GRANT EXECUTE ON [dbo].[proc_getSiteNames] TO [%USERNAME%] GO GRANT EXECUTE ON [dbo].[proc_getObject] TO [%USERNAME%] GO GRANT EXECUTE ON [dbo].[proc_getObjectsByClass] TO [%USERNAME%] GO GRANT EXECUTE ON [dbo].[proc_getObjectsByBaseClass] TO [%USERNAME%] GO GRANT EXECUTE ON [dbo].[proc_getSiteMap] TO [%USERNAME%] GO GRANT EXECUTE ON [dbo].[proc_getSiteMapById] TO [%USERNAME%] GO GRANT SELECT ON [dbo].[SiteMapVisible] TO [%USERNAME%] GO PRINT 'Successfully granted permissions to ''%CONFIG_DB%''' /**********************************************************/ /* GRANT ACCESS TO THE "Content" DATABASES */ /**********************************************************/ DECLARE @excludedContentDBS TABLE ([name] NVARCHAR(MAX)) /* Add rows to exclude certain Content Databases by name, for example: INSERT INTO @excludedContentDBS VALUES ('WSS_Content_Excluded') */ DECLARE @grantCmd NVARCHAR(MAX) = ' IF (USER_ID(''%USERNAME%'') IS NULL) BEGIN CREATE USER [%USERNAME%] FOR LOGIN [%USERNAME%] WITH DEFAULT_SCHEMA=[%USERNAME%] END -- Used both by the Crawler/Permissions Collector to fetch objects such as Sites, Webs, Lists etc. GRANT EXECUTE ON [dbo].[proc_GetTpWebMetaDataAndListMetaData] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_GetWebExtendedMetaData] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_GetUrlDocId] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_GetWebUrlFromId] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_EnumLists] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_ListChildWebs] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_ListUrls] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_GetListMetaDataAndEventReceivers] TO [%USERNAME%] -- Used by the Permissions Collector to retrieve objects permissions, groups, users etc. GRANT EXECUTE ON [dbo].[proc_SecListSiteGroupsContainingUser] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetItemsWithUniquePermissions] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetSecurityInfo] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetWebsAndListsWithUniquePermissions] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListScopeUsers] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListAllWebMembers] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListScopeGroups] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListAllSiteMembers] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetRoleBindingsForAllPrincipals] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListSiteGroups] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetRoleDefs] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetSiteAdmins] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListSiteGroupMembership] TO [%USERNAME%] -- These tables are accessed by the Permissions Collector directly (not through a stored procedure). -- They are used to retrieve list items data which do not have a dedicated Stored Procedure. GRANT SELECT ON [dbo].[AllUserData] TO [%USERNAME%] GRANT SELECT ON [dbo].[UserData] TO [%USERNAME%] GRANT SELECT ON [dbo].[AllDocs] TO [%USERNAME%] GRANT SELECT ON [dbo].[Docs] TO [%USERNAME%] -- Used by the Activity Monitoring service to change audit flags and to get, purge and add audit entries GRANT EXECUTE ON [dbo].[proc_GetAuditEntries] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_TrimAuditEntries] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_GetAuditMask] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SetAuditMask] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_AddAuditEntryUrl] TO [%USERNAME%] ' -- Dynamically grant permissions for every content database DECLARE @farmIds TABLE (id UNIQUEIDENTIFIER) DECLARE @webServiceIds TABLE (id UNIQUEIDENTIFIER) DECLARE @webApplicationIds TABLE (id UNIQUEIDENTIFIER) DECLARE @contentDBSNames TABLE (Name NVARCHAR(MAX)) DECLARE @curr_id UNIQUEIDENTIFIER -- Get all farms ids INSERT INTO @farmIds EXEC [dbo].[proc_getObjectsByClass] '674DA553-EA77-44A3-B9F8-3F70D786DE6A', null, null -- Get all web services ids DECLARE farms_cursor CURSOR LOCAL STATIC FORWARD_ONLY READ_ONLY FOR SELECT id FROM @farmIds OPEN farms_cursor FETCH NEXT FROM farms_cursor INTO @curr_id WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO @webServiceIds EXEC [dbo].[proc_getObjectsByClass] '45AD2BF2-4E3E-46A1-B477-126944C0ACEF', @curr_id, '' FETCH NEXT FROM farms_cursor INTO @curr_id END CLOSE farms_cursor DEALLOCATE farms_cursor -- Get all web applications ids DECLARE web_services_cursor CURSOR LOCAL STATIC FORWARD_ONLY READ_ONLY FOR SELECT id FROM @webServiceIds OPEN web_services_cursor FETCH NEXT FROM web_services_cursor INTO @curr_id WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO @webApplicationIds EXEC [dbo].[proc_getObjectsByBaseClass] '113FB569-7520-4651-8FC4-E9F4F5887618', @curr_id FETCH NEXT FROM web_services_cursor INTO @curr_id END CLOSE web_services_cursor DEALLOCATE web_services_cursor -- Get all sites content databases DECLARE web_apps_cursor CURSOR LOCAL STATIC FORWARD_ONLY READ_ONLY FOR SELECT id FROM @webApplicationIds OPEN web_apps_cursor FETCH NEXT FROM web_apps_cursor INTO @curr_id WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO @contentDBSNames SELECT DISTINCT o.[Name] FROM [dbo].[SiteMapVisible] s (NOLOCK) INNER JOIN [dbo].[Objects] o (NOLOCK) ON o.[Id] = s.[DatabaseId] WHERE s.[ApplicationId] = @curr_id FETCH NEXT FROM web_apps_cursor INTO @curr_id END CLOSE web_apps_cursor DEALLOCATE web_apps_cursor -- Grant permissions for every content database DECLARE @curr_db_name NVARCHAR(MAX) DECLARE content_dbs_cursor CURSOR LOCAL STATIC FORWARD_ONLY READ_ONLY FOR SELECT DISTINCT [Name] FROM @contentDBSNames WHERE [Name] NOT IN (SELECT [Name] FROM @excludedContentDBS) OPEN content_dbs_cursor FETCH NEXT FROM content_dbs_cursor INTO @curr_db_name WHILE @@FETCH_STATUS = 0 BEGIN -- Execute the grant permissions command DECLARE @exec NVARCHAR(MAX) = '[' + @curr_db_name + '].[sys].[sp_executesql]' EXEC @exec @grantCmd PRINT 'Successfully granted permissions to content db ''' + @curr_db_name + '''' FETCH NEXT FROM content_dbs_cursor INTO @curr_db_name END CLOSE content_dbs_cursor DEALLOCATE content_dbs_cursor PRINT 'Script execution completed successfully.' ----------------------------------------------------------- ```` ```` SPOnPremPermissions_ContentDBOnly.sql ```text ``` /* For servers which are hosting Sharepoint Content database(s) which do not reside on the same server as the Sharepoint Configuration database. NOTE: Follow steps chronologically and run each separately. Do not run the full script at once. If more than 1 content DB hosted on the server: bottom portion will need to be edited and re-ran for each content DB on the server. */ /* Step 1: This portion creates a new login for a SharePoint application. Run once. INSTRUCTIONS: ------------ (*) Replace the "%USERNAME%" variable with the appropriate user name (e.g. DOMAIN\USER). */ SET NOCOUNT ON /**********************************************************/ /* CREATE THE NEW USER LOGIN */ /**********************************************************/ USE [master] GO IF NOT EXISTS (SELECT [loginname] FROM [master].[dbo].[syslogins] WHERE [name] = '%USERNAME%') BEGIN CREATE LOGIN [%USERNAME%] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english] PRINT 'Created a new login - ''%USERNAME%''' END /* Step 2: This portion grants access to the content DB(s). May need to run more than once -- see below. INSTRUCTIONS: ------------ (*) Replace the "%CONTENT_DB%" variable with the appropriate content database name (i.e. "WSS_Content"). (*) If you have more than one Content DB on the server: after successful run, edit %CONTENT_DB% with the next Content DB name and run again. Repeat until access granted to all Content DBs on the server. */ /**********************************************************/ /* GRANT ACCESS TO THE "Content" DATABASES */ /**********************************************************/ DECLARE @grantCmd NVARCHAR(MAX) = ' IF (USER_ID(''%USERNAME%'') IS NULL) BEGIN CREATE USER [%USERNAME%] FOR LOGIN [%USERNAME%] WITH DEFAULT_SCHEMA=[%USERNAME%] END -- Used both by the Crawler/Permissions Collector to fetch objects such as Sites, Webs, Lists etc. GRANT EXECUTE ON [dbo].[proc_GetTpWebMetaDataAndListMetaData] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_GetWebExtendedMetaData] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_GetUrlDocId] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_GetWebUrlFromId] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_EnumLists] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_ListChildWebs] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_ListUrls] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_GetListMetaDataAndEventReceivers] TO [%USERNAME%] -- Used by the Permissions Collector to retrieve objects permissions, groups, users etc. GRANT EXECUTE ON [dbo].[proc_SecListSiteGroupsContainingUser] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetItemsWithUniquePermissions] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetSecurityInfo] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetWebsAndListsWithUniquePermissions] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListScopeUsers] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListAllWebMembers] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListScopeGroups] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListAllSiteMembers] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetRoleBindingsForAllPrincipals] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListSiteGroups] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetRoleDefs] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecGetSiteAdmins] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SecListSiteGroupMembership] TO [%USERNAME%] -- These tables are accessed by the Permissions Collector directly (not through a stored procedure). -- They are used to retrieve list items data which do not have a dedicated Stored Procedure. GRANT SELECT ON [dbo].[AllUserData] TO [%USERNAME%] GRANT SELECT ON [dbo].[UserData] TO [%USERNAME%] GRANT SELECT ON [dbo].[AllDocs] TO [%USERNAME%] GRANT SELECT ON [dbo].[Docs] TO [%USERNAME%] -- Used by the Activity Monitoring service to change audit flags and to get, purge and add audit entries GRANT EXECUTE ON [dbo].[proc_GetAuditEntries] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_TrimAuditEntries] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_GetAuditMask] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_SetAuditMask] TO [%USERNAME%] GRANT EXECUTE ON [dbo].[proc_AddAuditEntryUrl] TO [%USERNAME%] ' -- Execute the grant permissions command DECLARE @exec NVARCHAR(MAX) = '[%CONTENT_DB%].[sys].[sp_executesql]' EXEC @exec @grantCmd PRINT 'Script execution completed successfully.' ----------------------------------------------------------- ```` ``` ``` 1. Verify the permissions were granted successfully. The script should have the following messages: - “Successfully granted permissions to [Configuration DB]” - For each content database, a message “Successfully granted permissions to content db [Content DB Name]” - “Script execution completed successfully” 1. If planning to utilize Data Classification, files that need to be classified are required to have read access. For ease of use, a user can be granted site collection read access allowing read to files that are associated to that site collection. Note Data Classification requires NTLM Authentication. If your Sharepoint server is configured with Kerberos, the Data Classification feature will not be available. Data Access Security plans to support this in the near future. Kerberos is supported when communicating with the Sharepoint database. Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. ## Communications Requirements | Requirement | Source | Destination | Port | | -------------------------- | ------------------------------------- | -------------------- | ---------------------------------------- | | SharePoint Database Access | Resource Collector Virtual Appliance | SharePoint Databases | According to the specific DB definitions | | Data Classification | Data Classification Virtual Appliance | SharePoint Farm | http & https as required | # Verifying Application Configuration After the configuration of one of the following applications is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common SharePoint Validations The following is a list of common validations that run when the test connection is run with a SharePoint application. - Server responsiveness - Verifying there is a connection with the SharePoint configuration database - Verifying user permissions to the SharePoint configuration database - Verifying connection to the SharePoint content databases - Verifying user permissions to the SharePoint content databases - Verifying the SharePoint content databases exist - Verifying connection to the IIS management site ## Running the Crawler 1. Run the Crawler tasks (*Settings > Task Management > Scheduled Tasks*) 1. Verify that: - The tasks completed successfully - Business resources were created in the resource explorer (*Admin > Applications > \*[application column]* > Manage Resources\*) # Adding a SharePoint Application In order to integrate with SharePoint, first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## General Details 1. Review and edit the application's general details: - Application Type - SharePoint - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. - Identity Collector - Create an [Active Directory Source](https://documentation.sailpoint.com/connectors/active_directory/help/integrating_active_directory/connecting_active_directory.html) in SailPoint Human Fabric and select that source here. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Complete the Connection Details: - Database Server - The address of the SharePoint server containing the configuration database. If using a non-default port number, add it, separated by a comma - [Server Name],[Port] The default port number is 1433. If the database has an instance name, the address should be in a format of “[Server Name][Instance Name]”. To enter a database with an instance name on a server with a non-default port number, use the format “[Server Name][Instance Name],[port]”. Note There are cases in which you will have configure an alias for Windows to support this non-default database name format. See the Troubleshooting section below. - Domain Name - This is defined during the prerequisites setup. - Username - This is defined during the prerequisites setup. Data classification authenticates to the website with this user. Resource collection authenticates to SQL server with this user. - Password - User defined this in the prerequisites. - Kerberos Configuration File - Data Access Security utilizes Kerberos integrated authentication to connect to Sharepoint SQL server. Upload your krb5.conf file here. Here is an example of krb5.conf :\[libdefaults\]: ```text default_realm = DAS.LOCAL [realms] DAS.LOCAL = { kdc = ad.das.local default_domain = das.local } [domain_realm] das.local = DAS.LOCAL .das.local = DAS.LOCAL ``` Note Ensure the SPN is properly configured on the Active Directory Domain Controller(s). MSSQLSvc/sqlserver.domain:port SQLSERVER MSSQLSvc/sqlserver.domain SQLSERVER - Specify Configuration Database Name? - Determines whether to specify a name for the configuration database in case it differs from the default “SharePoint_Config” name. - Specify Port - Use this port number for all content databases except those defined in "Specialized Individual Ports". - Specify Individual Ports: If there are content databases not using the specified port mentioned above, provide a host name and port number. 1. Select **Next**. You can now [configure and schedule resource discovery](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/sharepoint/add/sharepoint_perm.html) for SharePoint. # Configuring and Scheduling the SharePoint Crawler To configure the crawl: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler &** settings page. **Resource Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. Note The entry fields vary by application type. You can now [schedule a task](#scheduling-a-task). 1. Set the Crawl Scope by: - Setting an explicit [list of resources](#including-and-excluding-paths-by-list) to include or exclude from the scan. - [Creating a regex](#excluding-paths-by-regex) to define resources to exclude. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Crawler Regex Exclusion Examples The following are examples of crawler Regex exclusions: Exclude all resources which start with one or more resource names: **Example:** Starting with Regex: https://[www.mysharepoint.com](http://www.mysharepoint.com)/resourceName$ **Example:** Starting with \\resourceName or //[www.mysharepoint.com/OtherResourceName](http://www.mysharepoint.com/OtherResourceName) Regex: https://[www.mysharepoint.com](http://www.mysharepoint.com)/(resourceName|OtherResourceName)$ **Example:** SharePoint resources starting with Regex: https://[www.mysharepoint.com](http://www.mysharepoint.com)/sites/mySiteCollection$ **Example:** SharePoint resources starting with *sites/mySiteCollection* or *other site/Different Site* Regex: https://[www.mysharepoint.com](http://www.mysharepoint.com)/(sites/mySiteCollection|other_site/Different_Site)$ **Include ONLY resources which start with one or more resources names:** **Example:** Starting with Regex: ^(?!https://[www.mysharepoint.com](http://www.mysharepoint.com)/resourceName($|/.*)).* **Example:** Starting with or Regex: ^(?!https://[www.mysharepoint.com](http://www.mysharepoint.com)/(resourceName|OtherResourceName)($|/.*)).* **Example:** SharePoint resources starting with Regex: ^(?!https://[www.mysharepoint.com](http://www.mysharepoint.com)/sites/mySiteCollection($|/.*)).* **Example:** SharePoint resources starting with or site/Different_Site Regex: ^(?!https://[www.mysharepoint.com](http://www.mysharepoint.com)/(sites/mySiteCollection|other\_ site/Different_Site)($|/.*)).* ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Selecting and Scheduling the SharePoint Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This cluster is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. Select **Next** or **Finish**. # Configuring and Scheduling the SharePoint Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. ## Configuring the Permission Collection The permission collector is a software component responsible for analyzing the permissions in an application. Note If the Data Access Security Central Permission Collector wasn’t installed during server installation, this configuration setting will be disabled. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collection** settings page. Note The entry fields vary by application type. **Permission Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. Note When creating a permission collection VA, verify cluster type is Data Access Security - Permission Collector. 1. You can now schedule a task. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select **Next**. # SharePoint Troubleshooting The following are common issues and suggested ways of handling them. ## Crawler Fails When using a non-default port, there are cases in which Data Access Security fails to connect to the SharePoint databases using the existing configuration. In the Task Details view, if it shows the following error, please check DNS configuration on the Virtual Appliance. `Error in crawler: Error connecting to site ‘sharepoint.example.com’ at database server: ‘10.1.1.1’` ## Alias Issues An alias needs to be added to the virtual appliance's `hosts.yaml` file. Refer to [TLS Configuration without DNS](https://documentation.sailpoint.com/connectors/ibm/ca/topsecret_ldap/help/common/main_frame/using_an_internal_ca.html) for more information on how to configure the `hosts.yaml` file. The structure of the `hosts.yaml` file should look similar to this: ```text # Enter any entries needed in the /etc/hosts file # Note: A space is needed between each key: value #hosts: # 192.168.0.1: # - hostname.localhost # - hostname ``` # SMB Connector Overview This connector (previously CIFS) enables you to use Data Access Security to access and analyze data stored in SMB and do the following: - Analyze the structure of your stored data. - Classify the data being stored. - Verify user permissions on the resources and compare them against requirements. ## Installation Flow Overview 1. Setup the prerequisites. 1. Add a new SMB application to Data Access Security. ## Collecting Data Stored in a Managed Application The list below describes the high-level installation process required to collect and analyze data from an external application. Most of these should already be set up in your Data Access Security installation. 1. Create an application in Data Access Security. 1. Create a Virtual Appliance Cluster if utilizing Permission Collection, Crawler, or Data Classification. ## Supported Versions The Data Access Security Microsoft SMB Connector supports the following versions of Microsoft SMB and SMB Core: 2016, 2019, 2022, 2025 32 and 64-bit support for all versions. ## SMB Operation Principles Data Access Security connects to the SMB through SMB, collects the local users and groups, and analyzes the share and NTFS permissions on all the folders. ## Business Resource Path The full path of the business resource is the UNC shared path, rather than the physical path of the folder. The physical paths display since they are represented by the administrative shares (c, d...) and are treated in the same way as any other share on the server. - **Crawler** - The crawler crawls through all the shares and creates business resources with the share’s full path (\\server_name\\share\\folder). - **Permission Collector** - The permissions collector analyzes share permissions, as well as NTFS permissions. ## Resource Tree Structure Physical paths that do not belong to a share are not displayed in Data Access Security. The Business Resources tree is represented as follows: - [Application Name] - [Special / Admin Shares] (this includes C$ and any other volume configured on the endpoint) - [Share A] - [Share B] # Collecting Data Stored in an External Application ## Terminology: - **Connector** - The collection of features, components and capabilities that comprise Data Access Security support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your Data Access Security installation. Refer to the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in Data Access Security** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Adding Collectors **Install Permission Collectors and / or Data Classification Collector (optional)** - Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For further details, refer to the **Application > Central Service > Collector Relations** section in the Data Access Security Administrator Guide. # Installing Services: Collector Installation 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to Data Access Security. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A Data Access Security user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next** to open the **Service Configuration** window. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service. Select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service. Select **Add**. 1. Select *Next*. The Installation Folder window displays. 1. If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder. All future collectors will be installed in this folder. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The Data Access Security Administrator Guide provides more information on the collector services. # SMB Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Backup Operator Privileges The user configured in the permissions perquisites section must be a member of the local Backup Operator group of the file server. It eliminates the need to grant explicit permissions to the Data Access Security user to all the folders on the file server. By using the Backup Operator privilege, Data Access Security can crawl, collect permissions, and classify data even if the user does not have explicit permissions to the folder. ## Permissions Data Access Security requires different permissions based on the tasks that require those permissions. The user configured in the Application Configuration wizard must have the following permissions on the file server: - Share Read permissions to all shares on the file server - Member of the local Backup Operators group on the file server - Member of the local Administrators group on the file server The following describes required permissions by each Data Access Security task: - **Crawling** - The user must have Share Read permissions to all the shares on the file server and be a member of the local Backup Operators group on the file server. - **Permission Collection** - The user must have Share Read permissions to all the shares on the server and be member of the local Backup Operators group on the server. The user must also be a member of the local Administrators group to read the Share Permissions and the local Users and Groups of the server. - **Data Classification** - The user must have Share Read permissions for all the shares on the server and be member of the local Backup Operators group on the server. Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. ## CIFS Connector Communications Requirements | **Requirement** | **Source** | **Destination** | **Port** | | ----------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ---------------- | --------- | | Permissions / Resource Collector and Data Classification Analysis | Permissions and Resource Collector Virtual Appliance / Data Classification Server Virtual Appliance | Monitored Server | SMB (445) | # Verifying SMB Configuration After the configuration is complete, verify SMB was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ## Common SMB Validation The following is a list of common validations that run when the test connection is run with a SMB application. **Resource Crawler Validations:** - Verifying the ability to list shares - Verifying the ability to read share permissions **Data Classification Validations:** - Verifying the ability to list shares # Adding an SMB Application In order to integrate a SMB server, we must first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. ## General Details 1. Review and edit the application's general details: - **Application Type** - SMB - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client on the **Applications > Configuration > Permissions Management > Identity Collectors** page. 1. Select **Next** to open the **Connection Details** page. ## Connection Details - **Server Name** - The name of the SMB server to which users connect. - **Domain Name** - The user defined in the prerequisites. - **Username / Password** - Credentials of the the user defined in the prerequisites. Select **Next**. # Selecting and Scheduling the SMB Data Classification Settings **To associate an application with a data classification service, and set the schedule:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application 1. Select the **edit** icon on the line of the application 1. Select **Next** until you reach the **Data Classification** settings page. The actual entry fields vary according to the application type **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). **Create a Schedule** - This option is enabled only if a central data classification service is selected. Refer to [Scheduling a Task](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/smb/add/perm_coll.html#scheduling-a-task). Note Refer to the Data Classification chapter in the Data Access Security Administrator Guide for more information. Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collection** settings page. Note The entry fields vary by application type. **Permission Collection Cluster** - Select an existing Data Access Security - Permission Collection virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. **Resource Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. 1. In the Calculate Resource Size field, determine when, or at what frequency, Data Access Security calculates the resources' size: - Never - Always - Second crawl and on (default) 1. [Schedule a task](#scheduling-a-task). 1. Set the Crawl Scope by: - Setting an explicit [list of resources](#including-and-excluding-paths-by-list) to include or exclude from the scan. - [Creating a regex](#excluding-paths-by-regex) to define resources to exclude. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: **Exclude all shares which start with one or more shares names:** - Starting with `\\server_name\shareName` Regex:`\\\\server_name\\shareName$` - Starting with `\\server_name\shareName or \\server_name\OtherShareName` Regex: `\\\\server_name\\(shareName|OtherShareName)$` **Include ONLY shares which start with one or more shares names:** - Starting with `\\server_name\shareName` Regex: `^(?!\\\\server_name\\shareName($|\\.*)).*` - Starting with `\\server_name\shareName or \\server_name\OtherShareName` Regex: `^(?!\\\\server_name\\(shareName|OtherShareName)($|\\.*)).*` **Narrow down the selection:** - Include ONLY the C$ drive shares: `\\server_name\C$` Regex: `^(?!\\\\server_name\\C\$($|\\.*)).*` - Include ONLY one folder under a share: `\\server\share\folderA` Regex: `^(?!\\\\server_name\\share\$($|\\folderA$|\\folderA\\.*)).*` - Include ONLY all administrative shares Regex: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Unity SMB Connector Overview This connector enables you to use Data Access Security to access and analyze data stored in Unity SMB and do the following: - Analyze the structure of your stored data. - Classify the data being stored. - Monitor user activity on resources. - Verify user permissions on the resources, and compare them against requirements. - Collect local users and groups. For more information on the Dell EMC architecture and CEE, refer to Dell support documentation. ## Permissions Collection Data Access Security connects using Dell EMC administrative shares and analyzes folder permissions. Local groups and users are collected from the SMB server during the Permission Collection process. ## Supported Versions Unity v5.3.0 Unity v5.4.0 # Prerequisites for Unity Make sure your system fits the descriptions below before starting the installation. ## Permissions Data Access Security requires different permissions, based on the tasks that require those permissions. The user configured in the Application configuration wizard must have the following permissions on the file server: - Share Read permissions to all shares on the file server - Ability to list shares - Member of the local Administrator group - Member of the local Backup Operators group on the file server The following describes required permissions by each Data Access Security task: - **Crawling** - The user must have Share Read permissions to all the shares on the file server and be a member of the local Backup Operators group on the file server. - **Permission Collection** - The user must have Share Read permissions to all the shares on the server and be member of the local Backup Operators group on the server. - **Data Classification** - The user must have Share Read permissions for all the shares on the server and be member of the local Backup Operators group on the server. - **Activity Monitoring** - The user must have local Administrator permissions to access share information on the server. ## Configuring the CEE Service ### Linux Hosted CEEs 1. On every CEE server, navigate to the `/opt/CEEPack` directory and ensure that the `emc_cee_config.xml` has the following in the `` block, under ``: ```json ... 1 whitebox@http://IP of your Activity Monitor VA ... ... ``` 1. Restart the EMC CEE service. ### Windows Hosted CEEs Note Create an Activity Monitor virtual appliance cluster per CEE cluster. 1. On every CEE server, open the registry and perform the following changes: `[HKLM\Software\EMC\CEE\CEPP\Audit\Configuration]` `Endpoint=whitebox@` `Enabled=1` 1. Restart the EMC CEE service. Note If multiple monitor servers exist, the list should look like: whitebox@ip, whitebox@ip, ... ## Using Unisphere Management Interface 1. Verify Event Publishing is enabled for your Unity application. 1. For more information see Dell support documentation (https://[your unisphere location]/help/webhelp/en_US/unity_c_about_events_publishing.html). Note Replace "your unisphere location" with the IP of your Unisphere management interface. **Event Forwarding** - Enter the uniform resource identifier (URI) where the CEE service is installed. The format of the entry is: ```text http://[fully.qualified.domain.name/IP]:[port]/cee Example: http://172.17.40.251:12228/cee ``` **Port** - The default is 12228 Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. ## Communication Requirements | Requirement | Source | Destination | Port | | ------------------- | ----------------------------- | ------------------------------------- | -------------- | | Activity Monitoring | Activity Monitoring Collector | Unity server | CIFS/SMB (445) | | Activity Monitor | CEE | Activity Monitoring Virtual Appliance | 13000 | # Verifying the Unity Connector You can verify your Unity connector by checking your application configuration. ## Verifying Application After the configuration is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common Unity Validations The following is a list of common validations that run when the test connection is run with a Unity application. **Resource Crawler Validations:** - Verifying the ability to list shares - Verifying the ability to read share permissions - Verifying the membership to the Backup Operators group **Data Classification Validations:** - Verifying the ability to list shares # Adding a Unity Application In order to integrate Unity, we must first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## General Details 1. Review and edit the application's general details: - Application Type - Unity SMB - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. 1. Select an **Identity Collector** of type Active Directory. - You can create identity collectors on the **Admin > Identity Collectors** page. 1. Select **Next** to open the Connection Details page. ## Connection Details Fill in the connection details: - Host Name - The host name of SMB Server name of the NAS server. Not FQDN, and without trailing slashes. - Domain Name - The user defined in the prerequisites. - Username / Password - Credentials of the user defined in the prerequisites. Select **Next**. # Configuring Unity Activity Monitoring 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Activity Monitoring** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Activity Monitoring** on. 1. Associate the application with a Data Access Security Activity Monitoring Collection Cluster. This cluster is responsible for running the Activity Monitoring data collection tasks on dedicated virtual appliances. Note This connector requires the activity monitoring virtual appliance to accept incoming network connections on port 13000. SailPoint recommends restricting incoming network access to only the devices that generate the relevant audit events. Note Verify auditing is enabled which was listed in the prerequisites. ## Setting the Data Retention Period Setting a data retention period allows the user to specify how long activities will be stored offline. Activities are available on the [Activity Forensics](https://documentation.sailpoint.com/das/help/forensics/activity_forensics.html) screen for a default of 12 months. After the initial 12 months, the activity data is retained and available via a support ticket. You can set a retention period from between 1 month and 7 years. After the retention period is met, all activities will be deleted. **Example:** If the data retention period in the application configuration is set to 18 months, the activities will be available in Data Access Security for the initial 12 months and then available by a support ticket for the 18 additional months, making it a total of 30 months. Note If any configuration changes are made after activity monitoring is initially enabled, save the changes and wait for about 60 seconds, or restart the virtual appliance to allow the changes to take effect. Note If a password in the configuration changes, the old password is cached for activity monitoring for 24 hours. Restart the activity monitoring virtual appliance cluster to ensure the password update takes effect and prevent the use of the cached password within the next 24 hours. ## Activity Exclusions Note Activity Monitoring exclusions need to be manually added. Allows administrators to configure activities which are not desired to reduce unnecessary noise of activity data set. Activities which match exclusions will be discarded so they will not display in forensics or be held in any storage. To add an exclusion: 1. Type an exclusion into the relevant dropdown list (file extension, user, folder, actions). 1. Select the **+** icon to add it to the list. 1. Select to **Next** or **Cancel** to close the panel once the list is complete. To edit or remove an exclusion from the list: 1. Select the appropriate dropdown list. 1. On the desired extension that needs to be edited or removed, select either the edit or delete icon. 1. Select to **Next** or **Cancel** to close the panel. 1. Click **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., txt, exe. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., \\servername\\share1\\folder1. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. **Exclude Actions** - List of actions that are not monitored. e.g., copy file. ## Supported Event Types - Create File - Create Folder - Create from Move - Create from Rename - Delete File - Delete Folder - Move File - Move Folder - Permission Change File - Permission Change Folder - Read File - Rename File - Rename Folder - Write File # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. **Resource Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. 1. In the Calculate Resource Size field, determine when, or at what frequency, Data Access Security calculates the resources' size: - Never - Always - Second crawl and on (default) 1. [Schedule a task](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/unity/add/unity_perm_collection.html#scheduling-a-task). 1. Set the Crawl Scope by: - Setting an explicit [list of resources](#including-and-excluding-paths-by-list) to include or exclude from the scan. - [Creating a regex](#excluding-paths-by-regex) to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, enter the full path to include or exclude in the top field and select **+** to add it to the list. Example: `\\[UnityHostName]\ShareFolder1\Folder2` 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Enter the paths to exclude by regex. Since the system does not collect Business Resources that match this regex, it also does not analyze them for permissions. ## Crawler Regex Examples The following are examples of crawler Regex exclusions: **Exclude all resources which start with one or more resource names:** **Example:** Starting with `\\server_name\shareName` Regex: `\\\\server_name\\shareName$` **Example:** Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` Regex: `\\\\server_name\\(shareName|OtherShareName)$` **Include ONLY shares which start with one or more shares names:** **Example**: Starting with `\\server_name\shareName` Regex: `^(?!\\\\server_name\\shareName($|\\.*)).*` **Example:** Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` Regex: `^(?!\\\\server_name\\(shareName|OtherShareName)($|\\.*)).*` **Narrow down the selection:** **Example:** Include ONLY the C$ drive shares: `\\server_name\C$` Regex: `^(?!\\\\server_name\\C\$($|\\.*)).*` **Example:** Include ONLY one folder under a share: `\\server\share\folderA` Regex: `^(?!\\\\server_name\\share\$($|\\folderA$|\\folderA\\.*)).*` **Example:** Include ONLY all administrative shares Regex: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Selecting and Scheduling the Data Classification To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Toggle **Allow Data Classification** on. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This cluster is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. Select **Next** or **Finish**. # Configuring and Scheduling the Permission Collection To configure the permission collection: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permission Collection** settings page. **Permission Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. # Windows Server Connector Overview This connector enables you to use Data Access Security to access and analyze data stored in Windows Server and do the following: - Analyze the structure of your stored data. - Classify the data being stored. - Verify user permissions on the resources and compare them against requirements. ## Installation Flow Overview 1. Setup the prerequisites. 1. Add a new Windows Server application to Data Access Security. ## Collecting Data Stored in a Managed Application The list below describes the high-level installation process required to collect and analyze data from an external application. Most of these should already be set up in your Data Access Security installation. 1. Create an application in Data Access Security. 1. Create a [Virtual Appliance Cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) if utilizing Permission Collection, Crawler, or Data Classification. ## Supported Versions The Data Access Security Microsoft Windows Server Connector supports the following versions of Microsoft Windows Server and Windows Server Core: 2016, 2019, 2022, 2025 32 and 64-bit support for all versions ## Windows Server Operation Principles Data Access Security connects to the Windows Server through SMB, collects the local users and groups, and analyzes the share and NTFS permissions on all the folders. ## Business Resource Path The full path of the business resource is the UNC shared path, rather than the physical path of the folder. The physical paths display since they are represented by the administrative shares (c, d...) and are treated in the same way as any other share on the server. - **Crawler** - The crawler crawls through all the shares and creates business resources with the share’s full path (`\\server_name\share\folder`). - **Permission Collector** - The permissions collector analyzes share permissions, as well as NTFS permissions. ### Resource Tree Structure Physical paths that do not belong to a share are not displayed in Data Access Security. The Business Resources tree is represented as follows: - [Application Name] - [Special / Admin Shares] (this includes C$ and any other volume configured on the endpoint) - [Share A] - [Share B] ## Windows Server Failover Cluster Windows Server Failover Cluster is an Active Passive Cluster based on Windows Server. The following definitions apply to the Windows Server Failover Cluster: - **Node** - A physical server that is part of a cluster. All nodes in a cluster must be configured when the “Is Cluster”’ field in the application configuration wizard is checked. - **Server Name** - A logical layer on top of the node layer. Shares in a cluster belong to a Server Name which is the name used when shares in the cluster are accessed. A Server Name (discovered automatically, as part of the crawling task) is active on one node at a time. - **File Share Scoping** - Shares located on a cluster node can only be specified through the Server Name, not through the cluster node name in which they are currently active. ### Windows Failover Cluster Share Scoping Data Access Security supports Windows Failover Cluster Share Scoping. The Server Names and their corresponding shares are discovered as part of the crawl task. # Windows Server Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Backup Operator Privileges The user configured in the permissions perquisites section must be a member of the local Backup Operator group of the file server. It eliminates the need to grant explicit permissions to the Data Access Security user to all the folders on the file server. By using the Backup Operator privilege, Data Access Security can crawl, collect permissions, and classify data even if the user does not have explicit permissions to the folder. ## Permissions Data Access Security requires different permissions based on the tasks that require those permissions. The user configured in the Application Configuration wizard must have the following permissions on the file server: - Share Read permissions to all shares on the file server - Member of the local Backup Operators group on the file server - Member of the local Administrators group on the file server The following describes required permissions by each Data Access Security task: - **Crawling** - The user must have Share Read permissions to all the shares on the file server and be a member of the local Backup Operators group on the file server. - **Permission Collection** - The user must have Share Read permissions to all the shares on the server and be member of the local Backup Operators group on the server. The user must also be a member of the local Administrators group to read the Share Permissions and the local Users and Groups of the server. - **Data Classification** - The user must have Share Read permissions for all the shares on the server and be member of the local Backup Operators group on the server. Best Practice Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to **Admin > Identity Collector > locate IC > Actions > Run Aggregation**. This ensures all permissions will be mapped properly to SailPoint Human Fabric identities. ## Activity Monitor Installer An Activity Monitor Installer is required for Windows File Server–type applications only. The Activity Monitor Installer can be downloaded [here](https://community.sailpoint.com/t5/Data-Access-Security-Downloads/ct-p/data-access-security-downloads). The installer is a command-line application that receives parameters and installs the Activity Monitor service inside the Windows File Server. Important The installer must be executed from within the Windows File Server. ### Activity Monitor Installer Prerequisites **[ASP.Net](https://dotnet.microsoft.com/en-us/download/dotnet) Core 10.0 Runtime v10.0.7** - Windows Hosting Bundle Installer must be installed on the virtual machine. If that is missing, the installer will not start and will notify the user. ### Supported Windows Versions The installer can be installed on: - Windows Server 2016 - Windows Server 2019 - Windows Server 2022 - Windows Server 2025 ### Activity Monitor Installer Installation Phases 1. Configure the application using Data Access Security. 1. Retrieve one IP address in the virtual appliance cluster (Activity Monitor). 1. Install the Activity Monitor on the virtual machine. ### Activity Monitor Installer Installation The installer command-line application accepts the following parameters: | Parameter | Description | | -------------- | ----------------------------------- | | -f, --folder | (Required) Installation folder path | | -c, --cert | Certificate thumbprint | | -h, --host | (Required) VA address | | -p, --port | VA port. Default: 11000 | | -v, --verbose | Enables verbose log level | | -l, --log | Log file path | | -r, --rollback | Enables rollback support | | -?, -h, --help | Shows help and usage information | Here is an example with actual values: `"Data Access Security Installer v1.2.0.0.exe" install -f C:\InstallerPath -h "172.16.4.101"` Note If there are multiple virtual appliances in the cluster, add one IP for the virtual appliance cluster. Once the service is installed, it will pickup all the other IPs of the virtual appliance cluster and configure it automatically. After the installation is completed, the DAS_WFS service will be installed and running on the File Server. ### Mutual Authentication (mTLS) With mutual TLS enabled, the Windows agent connects to the Data Access Security on-prem activity listener over HTTPS and both sides present certificates. Traffic uses TCP port 11000 by default. Note All activity applications on the same virtual appliance must use the same Activity Monitoring SSL setting - all Mutual Auth, or all non–Mutual Auth. When configuring the Activity Monitoring SSL settings within the [Connection Details](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/windows_server/add/index.html#connection-details) of the application configuration: 1. Select **Mutual Auth**. 1. The **Virtual Appliance Certificate File** should be in the PKCS#12 form (.pfx / .p12 with private key). This is what secures HTTPS on the virtual appliance. 1. Set **Virtual Appliance Certificate File Password** to the password of the uploaded PKCS#12 file. 1. The **Windows Activities Service Certificate File** is delivered in PEM or CER form (public certificate text; must be readable as PEM, starts with -----BEGIN CERTIFICATE-----). Upload the CA certificate that issued the Windows client certificate (typically the issuing/intermediate CA). This PEM is uploaded in the application configuration only. You must still install the matching client certificate with a private key on each Windows server and set CertificateThumbprint – see the following instructions. Each Windows server running `DAS_WFS` needs the following: - A client authentication certificate with private key, installed in **Local Computer > Personal (My)**. - In `%ProgramData%\DAS_WFS\config.json`, under **WinActivitiesCollector**, set **CertificateThumbprint** to the certificate’s thumbprint and set the virtual appliance addresses and port to the Data Access Security listener. - Ensure the Windows machine trusts the listener certificate (issuer in Trusted Root / Intermediate Certification Authorities as appropriate for your PKI). **SAN and Names** Avoid a mismatch between SAN and names. - The agent opens TLS to the IPs you put in virtual appliance addresses (defined in the config file, e.g. “172.31.64.106”). - The certificate should include the IP in Subject Alternative Name (SAN) as an IP address. If you use multiple virtual appliances, include all IPs in SAN or use one shared listener certificate that lists every cluster node IP you use. - The virtual appliance validates the Windows client certificate against the uploaded CA certificate (custom trust). This is separate from the listener SAN. - The file server hostname is used for application identification; it does not replace the virtual appliance IP on the listener certificate. **TLS Version** The product does not have a minimum TLS version in the agent. It follows .NET and Windows defaults, typically TLS 1.2 and above in supported environments. **Mutual Authentication Troubleshooting** | **Symptom** | **What to Check** | | --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SSL connection could not be established / Cannot determine the frame size | Listener on that host:port is not speaking TLS (still HTTP), wrong service on 11000, or a proxy returning non TLS bytes. Confirm mutual TLS is enabled and the listener is up with HTTPS. | | Certificate / name mismatch (after TLS connects) | Virtual appliance IP in config vs IP SAN on the listener certificate. | | Client certificate rejected / TLS works but requests fail | The uploaded CA certificate in Data Access Security must validate the Windows client certificate chain; thumbprint in config.json must match the certificate in Local Machine\\My with private key. | | Certificate not found in store (when the agent first connects to the virtual appliance) | Wrong thumbprint, cert under Current User instead of Local Machine, or cert not valid (expired / broken chain). | | Mixed SSL settings on the same virtual appliance | One application configured as Mutual Auth, another not; listener mode fixed at first start. Align all apps on that virtual appliance and restart das-am . | ### Console Output During installation, the console displays progress information. Note Only the following two commands are mandatory: - -f (installation folder) - -h (VA host) If other parameters are omitted, the installer uses default values: - Default installation path: `C:\ProgramData\DAS_WFS` - Default log path: `C:\ProgramData\DAS_WFS\Logs` ### Post-Installation Behavior Once installation is complete, the installer will: 1. Create and configure the Activity Monitor service on the virtual machine. 1. Create the logs folder in the pre-defined location. ### Uninstallation To uninstall, run `"Data Access Security Installer v1.2.0.0.exe" uninstall`. The console will display the uninstallation progress and status. ## Communication Requirements | Requirement | Source | Destination | Port | | ----------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ---------------- | -------------- | | Permissions / Resource Collector and Data Classification Analysis | Permissions and Resource Collector Virtual Appliance / Data Classification Server Virtual Appliance | Monitored Server | SMB (139, 445) | # Verifying Windows Server Configuration After the configuration is complete, verify Windows Server was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ## Common Windows Server Validation The following is a list of common validations that run when the test connection is run with a Windows Server application. **Resource Crawler Validations:** - Verifying the ability to list shares - Verifying the ability to read share permissions - Verifying the membership to the Backup Operators group **Data Classification Validations:** - Verifying the ability to list shares # Adding a Windows Server Application In order to integrate with Windows Server, we must first create an application entry in Data Access Security. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## General Details 1. Review and edit the application's general details: - Application Type - Windows Server - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name. Select **Enter** to create a tag. 1. Select a required **Identity Collector**. You can create identity collectors on the **Admin > Identity Collectors** page. 1. Select **Next** to open the Connection Details page. ## Connection Details 1. Fill in the connection details: - Server Name - The IP address of the server or the FQDN of the server (Ex: server1.office.com). - Domain Name - The domain of the server. Use a short name for the domain. (Ex: office and not office.com). - Username - Administrator Username (Ex: admin). - Password - Credentials which will be used by the Permission Collector, Crawler, and Data Classifications. - IS Cluster Mode - Enable this toggle to configure the Windows Servers as a cluster. - Cluster Nodes - This option is available for cluster mode only. Select this to type in physical cluster nodes to the dropdown list. Type in a cluster node and select the **+** icon to add this item to the list. To delete an item from the list, select the delete icon on the line. - AM SSL Setting - This option has two possible selections: - No-Auth: Default. Uses no encryption or authentication between the Windows Activities Service and the virtual appliance. - Mutual-Auth: Encrypts the messages and authenticates the both virtual appliance and the Windows Activities Service. Requires a pfx/p12 certificate for the virtual appliance and a pem/cer certificate for the Windows Activities Service. - Virtual Appliance Certificate File: Upload the virtual appliance side certificate. - Virtual Appliance Certificate File Password: Password credentials for the virtual appliance side certificate. - Windows Activities Service Certificate File: Upload the Windows Activities Service certificate. 1. Select **Next**. # Configuring Windows Activity Monitoring 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Activity Monitoring** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Activity Monitoring** on. 1. Associate the application with a Data Access Security Activity Monitoring Collection Cluster. This cluster is responsible for running the Activity Monitoring data collection tasks on dedicated virtual appliances. Note This connector requires the activity monitoring virtual appliance to accept incoming network connections on port 11000. SailPoint recommends restricting incoming network access to only the devices that generate the relevant audit events. Note Verify auditing is enabled which was listed in the prerequisites. Activity Monitoring gathers events from applications to help control and audit resource access. Note Refer to [Activity Monitor Installer](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/windows_server/prereqs.html#activity-monitor-installer) in the Prerequisites for more information on the installer process. ## Setting the Data Retention Period Setting a data retention period allows the user to specify how long activities will be stored offline. Activities are available on the [Activity Forensics](https://documentation.sailpoint.com/das/help/forensics/activity_forensics.html) screen for a default of 12 months. After the initial 12 months, the activity data is retained and available via a support ticket. You can set a retention period from between 1 month and 7 years. After the retention period is met, all activities will be deleted. **Example:** If the data retention period in the application configuration is set to 18 months, the activities will be available in Data Access Security for the initial 12 months and then available by a support ticket for the 18 additional months, making it a total of 30 months. Note If any configuration changes are made after activity monitoring is initially enabled, save the changes and wait for about 60 seconds, or restart the virtual appliance to allow the changes to take effect. Note If a password in the configuration changes, the old password is cached for activity monitoring for 24 hours. Restart the activity monitoring virtual appliance cluster to ensure the password update takes effect and prevent the use of the cached password within the next 24 hours. ## Activity Exclusions Note Activity Monitoring exclusions need to be manually added. Allows administrators to configure activities which are not desired to reduce unnecessary noise of activity data set. Activities which match exclusions will be discarded so they will not display in forensics or be held in any storage. To add an exclusion: 1. Type an exclusion into the relevant dropdown list (file extension, user, folder, actions). 1. Select the **+** icon to add it to the list. 1. Select to **Next** or **Cancel** to close the panel once the list is complete. To edit or remove an exclusion from the list: 1. Select the appropriate dropdown list. 1. On the desired extension that needs to be edited or removed, select either the edit or delete icon. 1. Select to **Next** or **Cancel** to close the panel. 1. Click **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., txt, exe. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., \\servername\\share1\\folder1. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. **Exclude Actions** - List of actions that are not monitored. e.g., copy file. ## Supported Event Types ### Folder Operations - Create Folder - Delete Folder - Rename Folder - Create From Rename Folder - Create From Move Folder - Permission Change Folder - Permission Add Folder - Permission Remove Folder - Move Folder ### File Operations - Create File - Delete File - Rename File - Move File - Write File - Read File - Permission Change File - Permission Add File - Permission Remove File ### Permissions - Add Member - Remove Member - Create User - Delete User - Rename Object - Create Group - Delete Group - Remove Audit Account Management ### Windows Event Logs - 4720 - A user account was created - 4726 - A user account was deleted - 4731 - A security-enabled local group was created - 4732 - A member was added to a security-enabled local group - 4733 - A member was removed from a security-enabled local group - 4734 - A security-enabled local group was deleted - 4781 - The name of an account was changed # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler** settings page. Note The entry fields vary by application type. **Resource Collection Cluster** - Select an existing virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. 1. In the Calculate Resource Size field, determine when, or at what frequency, Data Access Security calculates the resources' size: - Never - Always - Second crawl and on (default) 1. [Schedule a task](https://documentation.sailpoint.com/das-connectors/help/on_prem_conn/windows_server/add/windows_perm_coll.html#scheduling-a-task). 1. Set the Crawl Scope by: - Setting an explicit [list of resources](#excluding-top-level-resources) to include or exclude from the scan. - [Creating a regex](#crawler-regex-exclusion-example) to define resources to exclude. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: **Exclude all shares which start with one or more shares names:** - Starting with `\\server_name\shareName` Regex:`\\\\server_name\\shareName$` - Starting with `\\server_name\shareName or \\server_name\OtherShareName` Regex: `\\\\server_name\\(shareName|OtherShareName)$` **Include ONLY shares which start with one or more shares names:** - Starting with `\\server_name\shareName` Regex: `^(?!\\\\server_name\\shareName($|\\.*)).*` - Starting with `\\server_name\shareName or \\server_name\OtherShareName` Regex: `^(?!\\\\server_name\\(shareName|OtherShareName)($|\\.*)).*` **Narrow down the selection:** - Include ONLY the C$ drive shares: `\\server_name\C$` Regex: `^(?!\\\\server_name\\C\$($|\\.*)).*` - Include ONLY one folder under a share: `\\server\share\folderA` Regex: `^(?!\\\\server_name\\share\$($|\\folderA$|\\folderA\\.*)).*` - Include ONLY all administrative shares Regex: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. # Selecting and Scheduling the Windows Server Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Data Classification** settings page. Note The entry fields vary by application type. 1. Toggle the **Allow Data Classification** on. 1. Associate the application with a Data Access Security Data Classification Collection Cluster. This cluster is responsible for running the Data Classification data collection tasks on dedicated virtual appliances. 1. To disable data classification, toggle the **Allow Data Classification** option off. Note You can also disable data classification by setting the scheduler to be inactive, which is the default setting for data classification. 1. If a central data classification service is selected, you can schedule a task. 1. Select **Next** or **Done**. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for Data Access Security to use in its analysis, and you have run a crawl for the application. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collection** settings page. Note The entry fields vary by application type. **Permission Collection Cluster** - Select an existing Data Access Security - Permission Collection virtual appliance [cluster](https://documentation.sailpoint.com/das/help/getting_started/cluster_creation.html) to associate with this application. Select the **+** to create a new cluster. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Semi-Annually - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. # Windows Server Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Unable to See Events **Symptom** - The following error displays in a log file while you attempt to install the monitoring connector: `ERROR, WBX.whiteOPS.Agents.FilesMiniFilterActivity Monitor.FileMiniFilterActivity MonitorManager,connect, An unexpected error occurred while you attempt to start the mini-filter:System.DllNotFoundException:` ```text `Unable to load DLL 'wbapi.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)—at WBX.whiteOPS.Agents.FilesMiniFilterActivity Monitor.SafeNativeMethods64.start(UInt32 bufferSizeInBytes, UInt32 trustedProcessId)—at WBX.whiteOPS.Agents.FilesMiniFilterActivity Monitor.FileMiniFilterActivity MonitorManager.connect()` ``` **Reason** - Visual C++ 2010 redistributable package was not installed as part of the Activity Monitor service installation. **Solution Steps** - See step 3 of Windows Server Core. ## Windows Server Not Listed in Collector Installation Manager **Symptom** - The application does not appear in dropdown list of the Collector Installation Managers in the Activity Monitoring. **Reason** - Either the application was not defined or the Host Name as defined in the (as defined when adding the application) does not match the server’s short name on which the Collector Installation Manager was opened on. **Solution Steps** - Verify that the Windows Server application was in fact created. In case it exists, make sure the Host Name is correct.