Prerequisites

Make sure your system fits the descriptions below before starting the installation.

Software Requirements

File Access Manager requires the latest ASP.NET Core 6.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 6.0.x Hosting Bundle version from here.

Permissions

Activity Monitor - To perform Activity Monitoring, the Azure AD application for SharePoint Online requires the ActivityFeed.Read permission to access the Office 365 Management APIs.

Permissions Collection - To perform crawl and permissions collection, the Azure AD application for SharePoint Online requires the Sites.FullControl.All permission to access the SharePoint APIs.

Communication Requirements

Requirement	Source	Destination	Port
File Access Manager Access	Activity Monitor	File Access Manager Servers	8000-8008
Permissions Collection / Data Classification	Permissions Collector/Data Classification	SharePoint Online	https
Activity Monitoring	Activity Monitor	Office365 Activity API	https
OAuth Access Token Acquisition	Permission Collector/Data Classification Collector/Activity Monitor	Microsoft Token Endpoint	https

Access to the following over HTTPS

https://{tenant-name}.sharepoint.com/*
https://{tenant-name}-admin.sharepoint.com/*
https://{tenant-name}-my.sharepoint.com/*
https://manage.office.com/* - to monitor and collect event data, using the Microsoft Management API
https://login.microsoftonline.com/* - for OAuth access token acquisition.

Azure Active Directory Connectivity Requirements

The OneDrive Connector requires an AzureAD Identity Collector.

File Access Manager uses the Microsoft Graph REST API – which works exclusively in HTTPS.

The API base path is: https://graph.microsoft.com/v1.0/, where the tenant domain name is the customer assigned domain name on Microsoft cloud. It is usually in the format of domain_name.onmicrosoft.com, but might be different in your configuration.

Resources that are accessed by File Access Manager using the REST graph API include:

Creating an Azure Application for OneDrive

A new Azure Active Directory application must be created and configured to support the File Access Manager OneDrive functionality.

This configuration can be performed either by running the automated PowerShell script supplied with the SailPoint distribution pack, or by creating and configuring the application through the Azure portal.

Creating and Configuring the Application Automatically

There is a PowerShell script named CreateSharePointOnlineAndOneDriveApp.ps1 provided in the Collectors.zip under the extracted scripts sub-folder. This script will perform all the Azure application creation and configuration steps required for OneDrive.

To run this script, the Azure AD PowerShell module must be installed.

Install-Module -Name AzureAD

Before running the script, open the file in a text editor to review the default parameters. The parameters can be edited in the file or passed as parameters when running the script.

To run the script with the default parameters:

.\CreateSharePointOnlineAndOneDriveApp.ps1

To run the script while overriding some of the default parameters: .\CreateSharePointOnlineAndOneDriveApp.ps1 -AppName "OneDrive FAM App" -CertDnsName "contoso.com" -CertYearsValid 15

When prompted, log in with administrator credentials to create and configure Azure applications. The last step of the script will launch a URL to grant admin consent for the application. After granting consent, the page will redirect to a missing localhost URL. The operation is successful if the URL for that page contains admin_consent=True.

Note

If you experience an access denied error or other error in the web browser when granting admin consent, this might be a timing issue. This can be resolved by either manually granting admin consent through the Azure portal (see section Grant admin consent manually), or by copying and pasting the consent URL (represented in the line from the script output that starts in "Consent URL: ") into your browser.

The following output should be gathered or noted when running the script. This information will be used to configure the OneDrive application in File Access Manager:

The App ID value in the console output.
The created certificate file .pfx located in your working directory.
The certificate password that was entered when prompted.

Creating and Configuring the Application Manually

The following steps create and configure an Azure application for OneDrive authentication through the Azure portal.

These steps are adapted from the online Microsoft documentation.

Registering an Azure Active Directory Application

Follow these steps to register an application in Azure Active Directory (Azure AD):

Open the Azure AD portal at https://portal.azure.com.
Under Manage Azure Active Directory, select View.
On the Overview page, under Manage, select App registrations.
On the App registrations, select New registration.
On the Register an application page, configure the following settings:
- Name: Enter something descriptive. For example, OneDrive FAM App.
- Supported account types: Verify that Accounts in this organizational directory only ( only - Single tenant) is selected.
- Redirect URI (optional): Leave this field empty.
When you're finished, select Register.

Note

Leave the app page open. You'll use it in the next step.

Assign API Permissions to the Application

On the app page under Manage, select Manifest. Locate the requiredResourceAccess entry.

Replace the entire requiredResourceAccess entry with the following:

 "requiredResourceAccess": [
    {
       "resourceAppId": "c5393580-f805-4401-95e8-94b7a6ef2fc2",
       "resourceAccess": [
             {
                "id": "594c1fb6-4f81-4475-ae41-0c394909246c",
                "type": "Role"
             }
       ]
    },
    {
       "resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
       "resourceAccess": [
             {
                "id": "678536fe-1083-478a-9c59-b99265e6b0d3",
                "type": "Role"
             }
       ]
    }
 ],

Select Save.
On the Manifest page, under Manage, select API permissions.
On the API permissions page, verify that both Sites.FullControl.All and ActivityFeed.Read appear on the list.
Select Grant admin consent for and read the confirmation dialog that opens.
Select Yes. The Status value should now be Granted for on both entries.
Close the current API permissions page (not the browser tab) to return to the App registrations page. You will use it in an upcoming step.

Generate a Self-Signed Certificate

Create a self-signed x.509 certificate using the following PowerShell commands.

Edit parameters such as DnsName, Certificate expiration, and password as appropriate:

# Create certificate - $mycert = New-SelfSignedCertificate -DnsName "contoso.org" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(15) -KeySpec KeyExchange

# Export certificate to .pfx file - $mycert | Export-PfxCertificate -FilePath mycert.pfx -Password $(ConvertTo-SecureString -String "P@ssw0Rd1234" -AsPlainText -Force)

# Export certificate to .cer file - $mycert | Export-Certificate -FilePath mycert.cer

Assign the Certificate to the Azure Active Directory Application

After you register the certificate with your application, you can use the private key (.pfx file) for authentication.

If you need to get back to the Apps registration page:
1. Open the Azure AD portal at https://portal.azure.com/
2. Under Manage Azure Active Directory, select View.
3. On the Overview page that opens, under Manage, select App registrations.
On the Apps registration page from the end of Step 2, select your application.
On the application page that opens, under Manage, select Certificates & secrets.
Select Upload Certificate.
Browse to the self-signed certificate (.cer file) that you created in Step 3.
Click Add. The certificate is now shown in the Certificates section.
Close the current Certificates & secrets page, and then the App registrations page to return to the main https://portal.azure.com page. You'll use it in the next step.