: Begin Scanning Microsoft Office 365 Apps
Focus
Focus

Begin Scanning Microsoft Office 365 Apps

Table of Contents

Begin Scanning Microsoft Office 365 Apps

Learn how to connect the Microsoft Office 365 apps to
Data Security
to begin scanning for security violations.
To connect Microsoft Office 365 to
Data Security
and begin scanning files and folders on OneDrive and SharePoint, you need to:
  • Ensure that you have an Office 365 account with Global Administrator role permissions and valid OneDrive license assigned to that administrator account.
  • Ensure that you have a OneDrive subscription. A storage plan is separate from an Office 365 subscription.
  • Grant
    Data Security
    access to Office 365.
  • Add the Office 365 app to
    Data Security
    , providing
    Data Security
    information about your Office 365 account.
  • Enable activity monitoring. Turn on auditing in Office 365 to record user and admin activity.
If you have a previous version of the Office 365 app, you must reauthenticate to update the permissions so that Office 365 app does not stop scanning for assets.
Support for automated remediation capabilities varies by SaaS application.

Prepare To Add Office 365 App

Before you add the Office 365 app, perform prerequisites steps to make use of all the capabilities that the app supports for an efficient onboarding experience.
  1. (
    Recommended
    ) Add your Office 365 app domain as an internal domain.
  2. (
    Optional
    ) Enable group-based selective scanning.
    If you plan to use selective scanning using Azure Active Directory, you must retrieve your Azure AD group information before adding your Office 365 application so
    Data Security
    can discover and scan assets belonging to the user groups you want to monitor.
  3. Next step
    : Proceed to Enable Activity Monitoring.

Enable Activity Monitoring

Turn on auditing in Office 365 to record user and admin activity. This feature is enabled by default, but it’s important to verify that your organization didn’t turn off auditing.
Data Security
needs audit logs to search and report on activity and to perform forward scans. If you don’t turn on auditing, you’ll observe missing functionality related to user and admin activity.
  1. Log on to your Office 365 Admin account.
  2. Verity that auditing is enabled. If it isn't, turn on auditing. For more information, see Microsoft documentation about turning auditing on or off.
  3. Next step
    : Proceed to Add Office 365 App.

Add Office 365 App

In order for
Data Security
to scan assets, you must consent to specific permissions during adding the Office 365 app. Without the requested permissions,
Data Security
can’t authenticate (OAuth2) with Office 365 and can’t scan assets, even after you successfully install the Office 365 app. If you forget to consent to permissions, you can correct the misconfiguration, but it’s more efficient to avoid the issue.
  1. Establish communication between
    Data Security
    and Microsoft Office 365.
    1. Go to http://portal.microsoftonline.com and log out of Office 365 to ensure that you aren't logged in as a user other than an account with Global admin role permissions.
      By default, when you instruct
      Data Security
      to move an asset to Admin Quarantine folder, that asset folder resides on the admin account that you use to onboard the Office 365 app. However, after you onboard Office 365 app,
      Data Security
      enables you to specify an alternative account.
    2. Log in to Office 365 using an account that has the Global admin role permissions:
  2. To add the Office 365 app, go to
    Data Security
    Applications
    Add Application
    Office 365
    .
    1. Select
      Office 365
      . If you are using the Cloud Management Console, skip the following step.
    2. (For SaaS Security Console users only) Select one of the following:
      • Connect to Office 365 Account
      • Using a custom configuration?
      If you have a dedicated Office 365 account, select
      Using a custom configuration?
      and provide the URL for OneDrive and SharePoint that are part of your custom configuration.
    3. Enter the login credentials for the account with Global admin role privileges on the Microsoft online page to which
      Data Security
      redirects you.
    4. Review and
      Accept
      the permissions requested.
      Data Security
      requires these permissions to scan your assets on Office 365.
      After authentication,
      Data Security
      adds the new Office 365 app to the Cloud Apps list as
      Office 365
       n, where n is the number of Office 365 app instances that you connected to
      Data Security
      . For example, if you added one Office 365 app, the name displays as
      Office 365 1
      .
  3. Next step
    : Proceed to Customize Office 365 App.

Troubleshooting Onboarding for Office 365 App

To ensure that your app has onboarded correctly without any issues in authentication or permissions, Data Security performs validation checks between the onboarding and scanning process. You can start scanning only after a successful validation. For Office 365, the following two validations happen:
  • App Authentication
  • Validating Permissions
After the validation is successful, Data Security displays sample assets and sample activities.
If you don't have any subscriptions, you will not see any User activities in the validation page. It might take up to 12 hours for the first content blobs to become available. For more information, see Office 365 Management Activity API reference.
If the
App Authentication
or
Validating Permissions
check fails, try the following:
  1. Ensure you have administrator permissions.
  2. Check if Palo Alto Networks application is listed in the list of Enterprise Applications. Following are the app names for specific regions:
    • Prisma SaaS by Palo Alto Networks AP1
    • Prisma SaaS by Palo Alto Networks EU1
    • Palo Alto Networks NG-CASB - India - Office365
    • Prisma SaaS by Palo Alto Networks NAM
    • Palo Alto Networks NG-CASB - UK - Office365
    • Palo Alto Networks NG-CASB - Aus - Office365
  3. If Palo Alto Networks application is not listed, check if the Audit Logs Activity displays as
    Consent to application
    , Target as
    <app from the list given above>
    , and Status as
    Success
    .
See the following table to understand the errors you are facing during validation.
Error Codes
Description
Errors in App Authentication
invalid_request
Request is invalid.
invalid_grant
Internal error encountered.
unauthorized_client
The installed app in the Marketplace was uninstalled manually from your cloud app.
invalid_client
Issue related to Marketplace instance.
temporarily_unavailable
Office 365 app issue on the server side. Please reinstall.
Errors in fetching sample assets and activities
accessDenied
Access is denied for ${user}.
activityLimitReached
App's API limit reached. Try after sometime.
invalidRange
You don't have any thing to get for this entity.
invalidRequest
Request is invalid.
itemNotFound
No data associated with this entity.
notAllowed
Authentication failure while retrieving the entity.
notSupported
Getting entity with required information no longer supported.
serviceNotAvailable
Office 365 server is not responding.
quotaLimitReached
Quota for app request has been exhausted for now.
unauthenticated
Office 365 app issue from server side.
The other most common issues related to onboarding are as follows:
Symptom
Explanation
Solution
After you add the Office 365 app, no scanned assets display for Office 365.
Data Security
doesn’t have permissions to access Office 365, resulting in a misconfiguration.
Log in to the Azure portal and grant the necessary permissions for
Data Security
to successfully scan your assets on Office 365.
Office 365 app stopped scanning for assets.
On March 2020
Data Security
changed Office 365 app for SharePoint to use Microsoft’s new Graph API to improve performance and supportability (OneDrive already uses Graph API).
Reauthenticate your Office 365 app in order for
Data Security
to continue scanning your assets. You’ll be asked to consent to the required SharePoint permissions. You do not need to repeat the onboarding process.
You receive an account mismatch error when you reauthenticate.
Although your account is valid, it is for a different Microsoft tenant. It is not uncommon for organizations to have more than one tenant. For security reasons, log on using an account associated with the tenant you used to onboard the cloud app and for which you intended to grant
Data Security
access.
Sometimes this issue occurs unknowingly when your browser caches your account information; in this case, log in again using an Incognito window. Otherwise, log in using the account associated with that other tenant.
You observe that the policy violation log is missing, violations aren’t being created for user activity rules, and activities on
Explore
>
Activities
do not display.
Data Security
needs audit logs to search and report on user activity. You forgot to enable this feature.
If the issue persists, contact SaaS Security Technical Support.

Customize Office 365 App

After you add the Office 365 app, customize the app to make use of capabilities that are unique to this app or that differentiate this app instance from others.
  1. (
    Optional
    ) Specify an
    Alternative account for quarantined files
    .
    You can specify a different Office 365 account (in UPN format) for the quarantine administrator for precise assignment of incident management responsibilities. If you choose not to specify an alternative account,
    Data Security
    uses the onboarding account to quarantine files in the
    Admin Quarantine
    folder. The Office 365 account for the quarantine administrator doesn’t need to have admin privileges. After you define this quarantine administrator, you can’t modify the setting without deleting the Office 365 app and repeating the onboarding process; therefore, use a service account that persists as administrators join and leave your organization.
  2. (
    Optional
    ) Give a descriptive name to this app instance.
    1. Select the Office365n link on the Cloud Apps list.
    2. Enter a descriptive
      Name
      to differentiate this instance of Office 365 from other instances you are managing.
    3. Click
      Done
      to save your changes.
  3. (
    Optional
    ) Enable group-based selective scanning.
    If you have not already done so, instruct
    Data Security
    to retrieve your Azure AD group information, then return to this step to choose the user groups.
  4. Next Step
    : Proceed to Identify Risks.

Identify Risks

When you add a new cloud app, then enable scanning,
Data Security
automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
  1. To Start scanning the new Microsoft Office 365 app for risks, go to
    Data Security
    Applications
    Office 365
    Enable Scanning
    .
  2. During the discovery phase, as
    Data Security
    scans files and matches them against enabled policy rules:
    • Verify that SaaS Security web interface displays assets. If none display, fix the misconfiguration.
    • Verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, proceed to next step to improve your results.
  3. (
    Optional
    ) Modify match criteria for existing policy rules.
  4. (
    Optional
    ) Add new policy rules.
    Consider the business use of your cloud app, then identify risks unique to your enterprise. As necessary, add new:
  5. (
    Optional
    ) Configure or edit a data pattern.
    You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.

Fix
Data Security
Access to Office 365

If you forgot to grant the necessary permissions during onboarding, you need to fix this misconfiguration.
  1. Grant
    Data Security
    access to Office 365 using Azure Portal.
    Without permissions,
    Data Security
    can’t authenticate (OAuth2) with Office 365 and can’t scan assets, even after you successfully install the Office 365 app.
    1. Log in to Azure Portal at https://portal.azure.com as Global Administrator.
    2. Select
      Enterprise applications
      All applications
      .
    3. Select
      Aperture by Palo Alto Networks
      Security
      Permissions
      .
    4. Click
      Grant admin consent for
      yourOrganization
      .

Fix Office 365 Quarantine Issues

If
Data Security
is unable to quarantine the asset, quarantine status displays a summary explanation of the quarantine failure. If you need additional information, and due to the underlying differences between cloud apps, use the table below for a detailed explanation and resolution.
By default, Office 365 cloud app quarantines malicious assets, causing the quarantined file to become unavailable to third-party quarantine capabilities, including those on
Data Security
. To provide the high user experience to which you’ve become accustomed, the SaaS Security web interface informs you when your cloud app quarantines an asset.
Data Security
understands that your organization needs to remediate files across cloud apps from a single user interface.
Data Security
is working diligently with cloud app vendors to enable third-party remediation of malicious assets.
If you have super admin permissions on your cloud app, you will always have direct access to the assets quarantined by your cloud app, even when
Data Security
doesn’t.
Symptom
Explanation
Resolution
License and Subscription
After you add the Office 365 app,
Data Security
doesn’t quarantine your OneDrive assets and quarantine status indicates
Unable to create quarantine location
.
You must have a OneDrive subscription. Only then can
Data Security
create the necessary
Quarantine
folder on OneDrive and quarantine assets.
Verify that you have a OneDrive subscription.
If you purchase a new OneDrive subscription, you must reauthenticate on
Data Security
.
Data Security
stopped quarantining your OneDrive assets and quarantine status indicates
Unable to create quarantine location
.
Data Security
requires the administrator account and OneDrive license that you used to onboard the Office 365 app, for moving assets to the quarantine folder.
After you add the Office 365 app, if later that same administrator account is deleted or the OneDrive license is revoked,
Data Security
can no longer quarantine assets.
Verify that the administrator account you used to add the Office 365 app still exists and has a valid OneDrive license.
If the administrator account no longer exists, you must reauthenticate on
Data Security
using a different administrator account with Global Administrator role permissions and a valid OneDrive license.
If the administrator account exists but doesn’t have a valid OneDrive license, you must add that OneDrive license to the administrator account, then reauthenticate, or use another administrator account with Global Administrator role permissions that has a valid OneDrive license, then reauthenticate.
Files Unavailable for Quarantine
Your file doesn’t display in SaaS Security web interface and your cloud app notified you that it quarantined the file.
Data Security
doesn’t know that the file exists.
Your cloud app immediately discovered the malware and quarantined it—before
Data Security
could copy the file’s metadata and the asset’s contents.
As super admin, remediate the file within your cloud app.
Quarantine status indicates
Unable to download asset
.
Microsoft Thread Protection blocked the file for download.
Data Security
copied the file metadata but can’t download a copy of the asset itself for WildFire analysis because your cloud app quarantined the asset, making it unavailable.
Data Security
immediately copied the asset metadata—before the cloud app could discover and quarantine it.
Data Security
attempted to download a copy of the file to send to WildFire, but the cloud app already discovered and quarantined the asset.
As super admin, remediate the file within your cloud app.
Your file’s malware status is
File Unavailable
.
You’re unable to quarantine a file that displays in
Data Security
web interface. The
Actions
:
Quarantine
option is unavailable.
You’re unable to perform
Download
and
Restore
quarantine actions on a file initially quarantined by
Data Security
.
Data Security
can’t download a new copy of the asset and perform quarantine actions because your cloud app quarantined the asset, making it unavailable.
Data Security
immediately copied the asset metadata, downloaded a copy of the asset itself, and quarantined it—before the cloud app could detect malware and quarantine it.
With WildFire analysis enabled,
Data Security
sent your file to WildFire, a malware verdict was returned, and so
Data Security
quarantined the asset based on your policy.
After the copy of the file expired on SaaS Security web interface or
Data Security
received notification from your cloud app that your cloud app eventually discovered the malware and quarantined the asset,
Data Security
overwrote the malware status.
As super admin, if you need to download or restore the file, do so on your cloud app.
However, if you want to delete the file, do so on
Data Security
—not your cloud app, to enable
Data Security
to close the open incident and the quarantined file, keeping the state up to date.
You’re unable to
View Snippet
or access any other historical information on a file initially quarantined by
Data Security
.
Your file’s malware status is
File Unavailable
, but previously had a malware status of
Pending Analysis
or
Analyzed
.
You’re unable to view the WildFire report for a file whereas you were able to previously, although the WildFire data pattern matches display in
Data Security
web interface.

Recommended For You