: Begin Scanning a Microsoft Teams App
Focus
Focus

Begin Scanning a Microsoft Teams App

Table of Contents

Begin Scanning a Microsoft Teams App

Learn how to add the Microsoft Teams app so that
Data Security
can protect the assets on them from data exfiltration and malware propagation.
To connect Microsoft Teams to
Data Security
and begin scanning assets, you need to:
  • Plan to add the Office 365 app—either before or after you add the Microsoft Teams app, if you haven’t already done so.
    Data Security
    depends on Office 365 app to scan Microsoft Teams attachments. In doing so, you must meet the onboarding requirements for Office 365 app.
    Additionally, enable activity monitoring during the course of onboarding the Office 365 app. Turn on auditing in Office 365 to record user and admin activity. This feature isn’t enabled by default.
    Data Security
    needs audit logs to search and report on activity and to perform forward scans. If you don’t turn on auditing, you’ll observe missing functionality related to user and administrator activity for Microsoft Teams, including activity related to channel creation.
  • Ensure that you have an Office 365 account with Global Administrator role permissions.
  • Grant
    Data Security
    access to Microsoft Teams.
  • Add the Microsoft Teams app to
    Data Security
    , providing
    Data Security
    information about your Microsoft Teams account.
Due to new Microsoft licensing requirements, Microsoft Teams connector will work only for customers running the E5 licenses.
Support for automated remediation capabilities varies by SaaS application.

Add Microsoft Teams App

For
Data Security
to scan assets, you must consent to specific permissions during adding the Microsoft Teams app.
  1. Establish communication between
    Data Security
    and Microsoft Teams.
    1. Go to http://portal.microsoftonline.com and log out of Office 365 to ensure that you're not logged in as a user other than an account with Global Admin role permissions.
    2. Log in to Office 365 using an account that has the Global Admin role permissions:
  2. To add the Microsoft Teams app, go to
    Data Security
    Applications
    Add Application
    Microsoft Teams
    .
    1. Select
      Microsoft Teams
      .
    2. Select Connect to Microsoft Teams Account.
    3. Enter the login credentials for the account with Global Admin role privileges on the Microsoft online page to which
      Data Security
      redirects you.
    4. Review and
      Accept
      the permissions requested.
      Data Security
      requires these permissions to scan your assets on Microsoft Teams.
      After authentication,
      Data Security
      adds the new Microsoft Teams app to the Cloud Apps list as
      Microsoft Teams
       n, where n is the number of Microsoft Teams app instances that you connected to
      Data Security
      . For example, if you added one Microsoft Teams app, the name displays as
      Microsoft Teams 1
      . You’ll specify a descriptive name soon.

Troubleshooting Onboarding for Microsoft Teams App

To ensure that your app has onboarded correctly without any issues in authentication or permissions, Data Security performs validation checks between the onboarding and scanning process. You can start scanning only after a successful validation. For Microsoft Teams, the following two validations happen:
  • App Authentication
  • Validating Permissions
After the validation is successful, Data Security displays the sample user activities.
If the
App Authentication
or
Validating Permissions
check fails, try the following:
  1. Ensure you have administrator permissions.
  2. Check if Palo Alto Networks application is listed in the list of Enterprise Applications. Following are the app names for specific regions:
    • Prisma SaaS by Palo Alto Networks AP1 for MSTeams
    • Prisma SaaS by Palo Alto Networks EU1 for MSTeams
    • Prisma SaaS by Palo Alto Networks IN for MSTeams
    • Prisma SaaS by Palo Alto Networks NAM for MSTeams
    • Prisma SaaS by Palo Alto Networks UK1 for MSTeams
    • Palo Alto Networks NG-CASB - AUS - Teams
  3. If Palo Alto Networks application is not listed, check if the Audit Logs Activity displays as
    Consent to application
    , Target as
    <app from the list given above>
    , and Status as
    Success
    .
See the following table to understand the errors you are facing during validation.
Error Codes
Description
Errors in App Authentication
invalid_request
Request is invalid.
invalid_grant
Internal error encountered.
unauthorized_client
The installed app in the Marketplace was uninstalled manually from your cloud app.
invalid_client
Issue related to Marketplace instance.
temporarily_unavailable
Microsoft Teams app issue on the server side. Please reinstall.
Errors in fetching sample assets and activities
accessDenied
Access is denied for ${user}.
activityLimitReached
App's API limit reached. Try after sometime.
invalidRange
You don't have any thing to get for this entity.
invalidRequest
Request is invalid.
itemNotFound
No data associated with this entity.
notAllowed
Authentication failure while retrieving the entity.
notSupported
Getting entity with required information no longer supported.
serviceNotAvailable
Microsoft Teams server is not responding.
quotaLimitReached
Quota for app request has been exhausted for now.
unauthenticated
Microsoft Teams app issue from server side.
If the issue persists, contact SaaS Security Technical Support.

Customize Microsoft Teams App

After you add the Microsoft Teams app, customize the app to make use of capabilities that are unique to this app or that differentiate this app instance from others.
  1. (
    Optional
    ) Give a descriptive name to this app instance.
    1. Select the Microsoft Teams n link on the Cloud Apps list.
    2. Enter a descriptive
      Name
      to differentiate this instance of Microsoft Teams from other instances you're managing.
    3. Click
      Done
      to save your changes.
  2. Next step
    : Proceed to Identify Risks.

Identify Risks

When you add a new cloud app, then enable scanning,
Data Security
automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
  1. To Start scanning the new Microsoft Teams app for risks, go to
    Data Security
    Applications
    Microsoft Teams
    Enable Scanning
    .
  2. During the discovery phase, as
    Data Security
    scans files and matches them against enabled policy rules:
    • Verify that
      Data Security
      displays assets.
      Attachments display under Office 365 as outlined in FAQs for Microsoft Teams App.
    • Verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, proceed to next step to improve your results.
  3. (
    Optional
    ) Modify match criteria for existing policy rules.
  4. (
    Optional
    ) Add new policy rules.
    Consider the business use of your cloud app, then identify risks unique to your enterprise. As necessary, add new:
  5. (
    Optional
    ) Configure or edit a data pattern.
    You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.

FAQs for Microsoft Teams App

Question
Answer
What content does
Data Security
scan for Microsoft Teams?
How does SaaS Security display Microsoft Teams attachments?
Data Security
web interface displays the attachment as a SharePoint or OneDrive asset, not as a Microsoft Teams asset.
If your assets are not displaying as expected, there are known reasons as outlined in Fix Office 365 Quarantine Issues.
Does
Data Security
support quarantine for Microsoft Teams channel messages and direct chats?
Does
Data Security
block sensitive content in channel messages?
Data Security
can't currently prevent users from posting sensitive content in messages to a channel, but automatic remediation is supported for User Quarantine as outlined in Remediation Support on Data Security.
With automatic remediation (User Quarantine), the following occurs automatically for the message that contains the sensitive content:
  • It's hidden in the channel and, therefore, can't be shared further.
  • The user who posted the message can view the asset and observe that it’s flagged due to sensitive content.
  • The incident generated for this asset automatically closes after the previously mentioned automatic remediation actions.
Can SaaS Security web interface display connection information (for example, IP address and OS version) for meeting participants who are not Microsoft users or who weren’t logged in under their accounts?
No. SaaS Security web interface can only display information provided by Microsoft's logs or events.

Recommended For You