Begin Scanning Microsoft Office 365 Apps

Learn how to connect Microsoft Office 365 apps to Prisma SaaS to begin scanning for security violations.
To connect Microsoft Office 365 to Prisma SaaS and begin scanning files and folders on OneDrive and SharePoint, you need to:
  • Ensure that you have an Office 365 account with Global Administrator role permissions and valid OneDrive license assigned to that administrator account.
  • Ensure that you have a OneDrive subscription. A storage plan is separate from an Office 365 subscription.
  • Grant Prisma SaaS access to Office 365.
  • Add the Office 365 app to Prisma SaaS, providing Prisma SaaS information about your Office 365 account.
If you have a previous version of the Office 365 app, you must reauthenticate so that Office 365 app does not stop scanning for assets.
For information on which automated remediation capabilities Prisma SaaS supports with Office 365, refer to Supported Applications with Remediation.

Add Office 365 App

In order for Prisma SaaS to scan assets, you must consent to specific permissions during the course of adding the Office 365 app. Without the requested permissions, Prisma SaaS cannot authenticate (OAuth2) with Office 365 and cannot scan assets, even after you successfully install the Office 365 app.
If you forget to consent to permissions, you can correct the misconfiguration, but it’s more efficient to avoid the issue.
  1. (
    Recommended
    ) Add your Office 365 app domain as an internal domain.
  2. Log in to Office 365 using an account with Global Admin role permissions.
    Before you add Office 365 app to Prisma SaaS, you must properly establish communication between Prisma SaaS and the Microsoft Office 365 SharePoint app and OneDrive app.
    1. Go to http://portal.microsoftonline.com and log out of Office 365 to ensure that you are not logged in as a user other than an account with Global Admin role permissions.
      office365-log-out.png
    2. Log in again to Office 365 using an account that has the Global Admin role permissions.
      office365-login-global-admin.png
  3. Add the Office 365 app.
    1. From the Prisma SaaS
      Dashboard
      , click
      Add a Cloud App
      .
    2. Select
      Office 365
      .
      microsoft-office-365-tile-frame.png
    3. Select one of the following:
      • Connect to Office 365 Account
      • Using a custom configuration?
      If you have a dedicated Office 365 account, select
      Using a custom configuration?
      and provide the URL for OneDrive and SharePoint that are part of your custom configuration.
    4. Enter the login credentials for the account with Global Admin role privileges on the Microsoft Online page to which Prisma SaaS redirects you.
    5. Review and
      Accept
      the permissions requested.
      Prisma SaaS requires these permissions to scan your assets on Office 365.
      office365-consent-permissions.png
      After authentication, Prisma SaaS adds the new Office 365 app to the Cloud Apps list as
      Office365
       
      n
      , where
      n
      is the number of Office 365 app instances that you connected to Prisma SaaS. For example, if you added one Office365 app, the name displays as
      Office365 1
      . You’ll specify a descriptive name soon.
  4. (
    Optional
    ) Enable group-based selective scanning.
    If you have not already done so, instruct Prisma SaaS to retrieve your Azure AD group information, then return to this step to choose the user groups.
  5. (
    Optional
    ) Give a descriptive name to this app instance.
    1. Select the Office365 
      n
      link on the Cloud Apps list.
    2. Enter a descriptive
      Name
      to differentiate this instance of Office 365 from other instances you are managing.
    3. Click
      Done
      to save your changes.
  6. Start scanning the new Microsoft Office 365 app for risks.
    1. Select
      Settings
      Cloud Apps & Scan Settings
      .
    2. In the Cloud Apps row that corresponds to the new Office 365 app, select
      Actions
      Start Scanning
      .
  7. During the discovery phase, as Prisma SaaS scans files and matches them against enabled policy rules:
    • Verify that Prisma SaaS displays assets. If none display, fix the misconfiguration.
    • Verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, improve your results.

Identify Risks

When you add a new cloud app, Prisma SaaS automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
  1. (
    Optional
    ) Modify match criteria for existing policy rules.
  2. (
    Optional
    ) Add new policy rules.
    Consider the business use of your cloud app, then identify risks unique to your enterprise. As necessary, add new:
  3. (
    Optional
    ) Configure or edit a data pattern.
    You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.

Fix Office 365 Onboarding Issues

The most common issues related to onboarding are as follows:
Symptom
Explanation
Solution
After you add the Office 365 app, no scanned assets display for Office 365.
Prisma SaaS doesn’t have permissions to access Office 365, resulting in a misconfiguration.
office365-access-denied.png
Log in to the Azure portal and grant the necessary permissions for Prisma SaaS to successfully scan your assets on Office 365.
Office 365 app stopped scanning for assets.
On March 2020 Prisma SaaS changed Office 365 app for SharePoint to use Microsoft’s new Graph API to improve performance and supportability (OneDrive already uses Graph API).
Reauthenticate your Office 365 app in order for Prisma SaaS to continue scanning your assets. You’ll be asked to consent to the required SharePoint permissions. You do not need to repeat the onboarding process.
After you add the Office 365 app, Prisma SaaS does not quarantine your OneDrive assets.
You must have a OneDrive subscription. Only then can Prisma SaaS create the necessary
Quarantine
folder on OneDrive and quarantine assets.
Verify that you have a OneDrive subscription.
If you purchase a new OneDrive subscription, you must reauthenticate on Prisma SaaS.
Prisma SaaS stopped quarantining your OneDrive assets.
Prisma SaaS requires the administrator account and OneDrive license that you used to onboard the Office 365 app, for moving assets to the quarantine folder.
After you add the Office 365 app, if later that same administrator account is deleted or the OneDrive license is revoked, Prisma SaaS can no longer quarantine assets.
Verify that the administrator account you used to add the Office 365 app still exists and has a valid OneDrive license.
If the administrator account no longer exists, you must reauthenticate on Prisma SaaS using a different administrator account with Global Administrator role permissions and a valid OneDrive license.
If the administrator account exists but does not have a valid OneDrive license, you must add that OneDrive license to the administrator account, then reauthenticate, or use another administrator account with Global Administrator role permissions that has a valid OneDrive license, then reauthenticate.

Fix Prisma SaaS Access to Office 365

If you forgot to grant the necessary permissions during onboarding, you need to fix this misconfiguration.
  1. Grant Prisma SaaS access to Office 365 using Azure Portal.
    Without permissions, Prisma SaaS cannot authenticate (OAuth2) with Office 365 and cannot scan assets, even after you successfully install the Office 365 app.
    1. Log in to Azure Portal at https://portal.azure.com as Global Administrator.
    2. Navigate to
      Enterprise applications
      All applications
      .
      office365-azureportal-apps.png
    3. Select
      Aperture by Palo Alto Networks
      Security
      Permissions
      .
    4. Click
      Grant admin consent for
      yourOrganization
      .
    office365-grant-access.png

Office 365 Files Unavailable To Prisma SaaS

By default, Office 365 cloud apps quarantine malicious assets, causing the quarantined file to become unavailable to third-party quarantine capabilities, including those on Prisma SaaS. To provide the high user experience to which you’ve become accustomed, Prisma SaaS UI informs you when your cloud app quarantines an asset.
Prisma SaaS understands that your organization needs to remediate files across cloud apps from a single user interface. Prisma SaaS is working diligently with cloud app vendors to enable third-party remediation of malicious assets.
If you have super admin permissions on your cloud app, you will always have direct access to the assets quarantined by your cloud app, even when Prisma SaaS does not.
quarantine-unavailable-files.png
Symptom
Explanation
Resolution
Your file does not display in Prisma SaaS and your cloud app notified you that it quarantined the file.
Prisma SaaS does not know that the file exists.
Your cloud app immediately discovered the malware and quarantined it—before Prisma SaaS could copy the file’s metadata and the asset’s contents.
As super admin, remediate the file within your cloud app.
Your file’s malware status is
File Unavailable
.
Prisma SaaS copied the file metadata but cannot download a copy of the asset itself for WildFire analysis because your cloud app quarantined the asset, making it unavailable.
Prisma SaaS immediately copied the asset metadata—before the cloud app could discover and quarantine it.
Prisma SaaS attempted to download a copy of the file to send to WildFire, but the cloud app already discovered and quarantined the asset.
As super admin, remediate the file within your cloud app.
You’re unable to quarantine a file that displays in Prisma SaaS. The
Actions
:
Quarantine
option is unavailable.
You’re unable to perform
Download
and
Restore
quarantine actions on a file initially quarantined by Prisma SaaS.
Prisma SaaS cannot download a new copy of the asset and perform quarantine actions because your cloud app quarantined the asset, making it unavailable.
Prisma SaaS immediately copied the asset metadata, downloaded a copy of the asset itself, and quarantined it—before the cloud app could detect malware and quarantine it.
With WildFire analysis enabled, Prisma SaaS sent your file to WildFire, a malware verdict was returned, and so Prisma SaaS quarantined the asset based on your policy.
After the copy of the file expired on Prisma SaaS or Prisma SaaS received notification from your cloud app that your cloud app eventually discovered the malware and quarantined the asset, Prisma SaaS overwrote the malware status.
As super admin, if you need to download or restore the file, do so on your cloud app.
However, if you want to delete the file, do so on Prisma SaaS—not your cloud app, to enable Prisma SaaS to close the open incident and the quarantined file, keeping Prisma SaaS up to date.
You’re unable to
View Snippet
or access any other historical information on a file initially quarantined by Prisma SaaS.
Your file’s malware status is
File Unavailable
, but previously had a malware status of
Pending Analysis
or
Analyzed
.
You’re unable to view the WildFire report for a file whereas you were able to previously, although the WildFire data pattern matches display in Prisma SaaS.

Recommended For You