Configure Microsoft OneDrive as the Cloud Provider

1. Register a new app in Azure.

   1. Sign in to the Azure Portal.
   2. Go to Azure Active Directory → App registrations → + New registration.
   3. Enter a descriptive name (for example, Prisma Browser Cloud Storage for M365)
   4. Choose Single tenant (Accounts in this organizational directory only).
   5. Under Redirect URI, select Single-page application (SPA) and use this URI: https://gdhaibkimkeghllnpodfpoamchapggea.chromiumapp.org/
   6. Click Register.
2. Add Permissions to the New App.

   1. Open the new app → App permissions → + Add a permission.
   2. Choose Microsoft Graph.
   3. Add the following Application permissions:

      • Application.Read.All
      • DelegatedPermissionGrant.Read.All
   4. Click +Add a permission → Microsoft Graph → Delegated permissions.
   5. Add the following permission:

      • Files.ReadWrite.All
   6. Click Grant admin consent for <your tenant name> Click Yes in the consent confirmation pop-up.

      User.Read permission (delegated) is added by default by the application. DO NOT REMOVE THIS PERMISSION.

   WHY ARE THESE PERMISSIONS NEEDED?

   Prisma Browser requires specific permissions. These are the minimum necessary to ensure proper connection and to manage file downloads to your organization's cloud storage. This least-privilege approach minimizes security risks by only requesting access essential for its operation.

   Permission Type	Permission Name	Reason
   Delegated	User.Read	Confirms that the user connected to the browser is the same user that is connected to Microsoft.
   Delegated	Files.ReadWrite.All	Saving files to the user's OneDrive on their behalf.
   Application	Application.Read.All DelegatedPermissionGrant.Read.All	Verifies the integration configured by the Microsoft admin.

   Admins always consent to application permissions. In contrast, end users consent to delegated permissions. Granting admin consent for delegated permissions is required. It prevents users from mistakenly denying permissions, which would block them from downloading and saving files to OneDrive when a Security policy is triggered.

   Verifying the onboarding status of the integration is critical. Improper configuration will prevent Prisma Browser from saving files to OneDrive. This will block end users from downloading and saving files when their download action matches a policy rule.
3. Generate Client Secret.

   1. Go to Certificates & Secrets → New client secret.
   2. In the Add a client secret tab, do the following:

      1. Enter a description for the secret, for example - Microsoft secret 01. (this field is optional.
      2. In the Expires field, select 730 days (24 months).
   3. Click Add.
   4. Copy the value of the new client secret. You will need it for the next step when you connect the cloud storage to the Prisma Browser. We recommend that you save it in a safe place.
4. Connect to the Prisma Browser.

   1. Go to the Prisma Browser admin console and select Integrations.
   2. Select Cloud Storage.
   3. Click on either +add provider or Connect your first provider.
   4. Select the provider - Microsoft.
   5. Insert a descriptive Storage name for the connection, for example - Microsoft Cloud Storage.
   6. Paste the Client secret that you generated in the previous step.
   7. Enter the Application (client) ID and the Directory (tenant) ID from the Application Overview in the Azure Portal.
   8. Click Test provider connection to verify the connection with Azure.
   9. Once the test is successful, click Add Provider.
5. Create the Save to Cloud Rule

   1. Open the Access & Data Control rules and create a new rule.
   2. At the Data Control step, select File Download.
   3. Select Save to organization storage and choose the provider that you configured in the previous step.
   4. Add any additional details, and click Set.

Known Limitations and Requirements

Configure Google Drive as the Cloud Provider

1. Enable the Google Drive API in GCP.

   1. Open a browser tab and navigate to the Google Cloud Console.
   2. Select or create a project that will be used for the integration.
   3. In the left side menu, go to APIs & Services → Enabled APIs and Services.
   4. Click Enable APIs & Services.
   5. Select Google Drive API and click Enable on the details page.
2. The Service Account allows the browser to upload files by generating a one-time token per upload, eliminating the need for the user to log in each time.
   Create a Service Account.

   1. In the Google Cloud Console, go to the project you selected in the previous step.
   2. Navigate to IAM & Admin and select Service Accounts.
   3. Click + Create service account.

      1. Enter a Service account name. This name will be displayed in the Google Cloud Console.
      2. Click Create and continue to generate the Service account ID. You can edit it, if needed.
      3. Optionally, enter a Service Account description.
      4. Click Done.
   4. Continue through the steps until the service account is created.
3. Generate a Private Key (JSON)

   1. Locate your newly-created service account in the list.
   2. Click the More (⋮) icon under the Actions field, and select Manage Keys.
   3. Click ADD KEY → Create new key.
   4. Choose JSON as the key type and click Create.
   5. The system downloads a private key file to your computer. Store this file securely; it authenticates the service account.
4. Retrieve the Client ID

   1. Go back to the Service Accounts page in the Cloud Console.
   2. Click the name of your service account to open its details.
   3. Under the Details tab, locate the Client ID and copy it. You will use this in the next step.
5. Delegate Domain-Wide Authority in Google Workspace.

   1. Open a browser and navigate to theGoogle Admin Console.
   2. Sign in using a Super Admin account.
   3. From the left-hand menu, go to Security → API Controls.
   4. Scroll to the Domain-wide delegation section and click Manage Domain Wide Delegation.
   5. Click Add new to add a new Client ID.
   6. In the Client ID field, paste the ID you copied from your service account.

      In the OAuth Scopes field (comma-delimited), enter the following scopes:

      • https://www.googleapis.com/auth/drive.file
      • https://www.googleapis.com/auth/drive.metadata.readonly
   7. These scopes allow the service account to access and manage Google Drive files on behalf of users within the domain.
   8. Click Authorize to complete the delegation process.

      Why are the Scopes required?

      ​​These scopes adhere to the principle of least privilege, ensuring the application only has the permissions required to perform its core functions — securing connections and managing file downloads effectively to the organizational cloud.
   9. These scopes allow the service account to access and manage Drive files on behalf of users within the domain.

      drive.metadata.readonly	Used to list folders in the user's drive
      drive.file	Used to upload files to the user's drive

      By using domain-wide delegation, Prisma Browser can upload files to an end-user's Google Drive without any user interaction. This process leverages the user's browser sign-in context, eliminating the need for them to be actively signed into Google.

      For security, Prisma Browser uses a short-lived access token to upload files to Google Drive. This token is created only when a file download triggers a matching cloud storage rule and is strictly scoped to the signed-in user, which prevents extensive access.
6. Create the integration with the Prisma Browser Console.

   1. Go to the Prisma Browser admin console and select Integrations.
   2. Select Cloud Storage.
   3. Click on either +add provider or Connect your first provider.
   4. Select Google.
   5. Insert a descriptive name for connection; for example, your Google tenant name.
   6. Upload the JSON file.
   7. Enter an email to verify permissions.

      • This step secures your organization’s data and enhances user productivity by integrating with your managed cloud storage services. Instead of allowing direct file downloads to user devices, our 'Save to Cloud' feature automatically redirects them to your organization’s cloud storage.
        This method ensures that you can enforce your data protection policies and give users seamless access to their files across all their devices, which supports better collaboration and a smoother workflow.
      • To ensure that you have configured the permissions correctly, you must use the email of an active, licensed user in your organization. The system uses this email solely for a permissions check; it will not send emails or upload any files to the account.
   8. Click Test provider connection to verify the connection with Google.
   9. Once the test is successful, click Add Provider.

Known Limitation