: Enable Group-based Selective Scanning (Beta)
Focus
Focus

Enable Group-based Selective Scanning (Beta)

Table of Contents

Enable Group-based Selective Scanning (Beta)

Learn how to enable group-based selective scanning.
Group-based visibility requires Azure Active Directory integration, which has many benefits, including group-based selective scanning—the ability to include or exclude specific AD groups from scans. Sometimes you might want to monitor the assets and accounts of specific groups of users and not others. If your cloud app supports selective scanning,
Data Security
enables you to select which directory groups to include or exclude from both forward scan and backward scan.
Selective scanning is an advanced feature. Before you enable selective scanning, contact SaaS Security Technical Support to have your use case reviewed by an experienced Support Engineer.
Selective scanning is supported by specific cloud apps. By default, selective scanning is not enabled, and it’s important that you decide if you want to enable selective scanning—before you connect a cloud app to
Data Security
. Otherwise, you must delete the cloud app instance, then reconnect the cloud app to
Data Security
to rediscover all assets and events for all users: all assets and events previously stored will be deleted and incidents reported for users no longer included in the selected groups are automatically closed.
Before you enable selective scanning, learn about selective scanning behaviors.

Selective Scanning Behaviors

As you maintain selective scanning and groups in active directory services, consider how
Data Security
updates your scan results, user activities, and incidents.
Group/User Change
Data Security
...
Remove a user from a group in directory services
Removes assets or user activities. Closes any related incidents. Takes up to 7 days.
Remove a group from Selective Scanning
Add a user to a group in directory services.
Records new user activities.
Add a group to Selective Scanning

Enable Selective Scanning During Onboarding

It’s easier to enable group-based selective scanning when you onboard the cloud app. If, however, you choose to enable selective scanning after you add the cloud app, you must delete the cloud app instance and add it back so
Data Security
can discover all assets and events for all users.
  1. Log in to SaaS Security.
  2. Connect your the cloud app to
    Data Security
    .
  3. Select
    Enable selective scanning
    .
    Scan
    and
    Exclude from scan
    options only display during initial configuration.
  4. Choose a subset of groups to scan using
    >>
    to add all groups or
    >
    to add selected groups.
  5. Select
    Save
    to continue.

Enable Selective Scanning After Onboarding

It’s easier to enable group-based selective scanning when you onboard the cloud app. If, however, you choose to enable afterward, you must delete the cloud app instance and add it back so
Data Security
can discover all assets and events for all users.
  1. Log in to SaaS Security.
  2. Select
    Settings
    Cloud Apps and Scan Settings
    .
  3. In the Cloud App list, click on the cloud app for which you want to enable selective scanning.
  4. Select
    Enable selective scanning
    .
  5. Click
    Yes
    to delete the cloud app instance.
  6. Choose a subset of groups to scan using
    >>
    to add all groups or
    >
    to add selected groups.
  7. Select
    Save
    to continue.

Recommended For You