Onboard Office 365 App to Data Security

1. Prerequisites

   1. Enable Activity Monitoring

      Turn on auditing in Office 365 to record user and admin activity. This feature is enabled by default, but it’s important to verify that your organization didn’t turn off auditing. Data Security needs audit logs to search and report on activity and to perform forward scans. If you don’t turn on auditing, you’ll observe missing functionality related to user and admin activity.

      1. Log in to your Office 365 Admin account.
      2. Verity that auditing is enabled. If it isn't, turn on auditing.
   2. Prepare to Onboard Office 365

      1. Add your Office 365 app domain as an internal domain.
      2. (Optional) If you plan to use selective scanning using Azure Active Directory, you must retrieve your Azure AD group information before adding your Office 365 application so Data Security can discover and scan assets belonging to the user groups you want to monitor. Or, Integrate Cloud Identity Engine with Data Security if you plan to use selective scanning before adding your application so that Data Security can discover and scan assets belonging to the user groups you want to monitor.
      3. Ensure that you have an Office 365 account with Global Administrator role permissions and valid OneDrive license assigned to that administrator account.

         The Global Administrator role is required only for the onboarding process. After successful onboarding, you can downgrade the account from the Global Administrator role to a normal user role in the Microsoft Office 365 Admin Center. Additionally, you can also delete the account used to onboard Office 365. However, if you delete the account, you cannot perform the Admin Quarantine function.
      4. Ensure that you have a OneDrive subscription. A storage plan is separate from an Office 365 subscription.
2. Establish communication between Data Security and Office 365

   1. Go to http://portal.microsoftonline.com and log out of Office 365 to ensure that you aren't logged in as a user other than an account with Global admin role permissions.

      By default, when you instruct Data Security to move an asset to Admin Quarantine folder, that asset folder resides on the admin account that you use to onboard the Office 365 app. However, after you onboard Office 365 app, Data Security enables you to specify an alternative account.

   2. Log in to Office 365 using an account that has the Global admin role permissions:

3. Add your Office 365 app

   1. Log in to Strata Cloud Manager.
   2. Select ConfigurationSaaS SecurityData SecurityApplicationsAdd ApplicationOffice 365 and click on the tile.

   3. On the onboarding page, select the type of permissions you want to use during onboarding and Connect.

      If you choose Read+Write app, you can perform the following actions:

      • Data Discovery
      • User Activity
      • Remediation

      If you choose Read only app, you cannot perform remediation actions. Only the following two actions are available:

      • Data Discovery
      • User Activity
   4. Enter the login credentials for the account with Global admin role privileges on the Microsoft online page to which Data Security redirects you.
   5. Review and Accept the permissions requested.

      The permissions requested are different for onboarding using the Read + Write and Read Only permissions. Data Security requires these permissions to scan your assets on Office 365.

      If your onboarding is successful, the following message appears:

4. View Onboarding Status

   1. Click View Onboarding Status to check if both App Authentication and Validating Permissions checks are successful. Sample data assets and user activities are also listed.
5. Optional Data Security adds the new Office 365 app to the Cloud Apps list as Office 365 n, where n is the number of Office 365 app instances that you connected to Data Security. The first Office 365 instance you add to Data Security will have the default name of Office 365 1. To rename your Office 365 app instance, click on the pen icon next to the name.

(Optional) Selective Scanning on Office 365 App

1. Enable group-based selective scanning.

   If you have not already done so, instruct Data Security to retrieve your Azure AD group information. Or, Integrate Cloud Identity Engine with Data Security if you plan to use selective scanning before adding your application so that Data Security can discover and scan assets belonging to the user groups you want to monitor. Then return to this step to choose the user groups.
2. You can choose to either Scan or Exclude From Scan your user groups.
3. Choose your groups from the Available Groups list and move them to the Selected Groups list.
4. Save your settings.

5. Next step: Proceed to Start Scanning and Monitor Results.

Start Scanning and Monitor Results

1. To start scanning the new Office 365 app for risks, select ConfigurationSaaS SecurityData SecurityApplicationsOffice 365View Settings...Start Scanning.

   Data Security will scan files uploaded by external collaborators only if those external collaborators are added to the Identity Provider as External.

2. Monitor the scan results.

   During the discovery phase, as Data Security scans files and matches them against enabled policy rules:

   • Verify that Data Security displays assets.
   • Verify that your default policies are effective. If the results don’t capture all risks or you see false positives, proceed to next step to improve your results.
3. (Optional) Modify match criteria for existing policies.
4. (Optional) Add new policies.

   Consider the business use of your cloud app, then identify risks unique to your enterprise. As necessary, add new:

   • asset policies
   • user activity policies
5. (Optional) Configure or edit a data pattern.

   You can configure data patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.

Troubleshooting Onboarding

Fix Onboarding Issues

To ensure that your app has onboarded correctly without any issues in authentication or permissions, Data Security performs validation checks between the onboarding and scanning process. You can start scanning only after a successful validation. For Office 365, the following two validations happen:

• App Authentication
• Validating Permissions

After the validation is successful, Data Security displays sample assets and sample activities.

If you don't have any subscriptions, you will not see any User activities in the validation page. It might take up to 12 hours for the first content blobs to become available. For more information, see Office 365 Management Activity API reference.

If the App Authentication or Validating Permissions check fails, try the following:

1. Ensure you have administrator permissions.
2. Check if Palo Alto Networks application is listed in the list of Enterprise Applications. Following are the app names for specific regions:
   • Prisma SaaS by Palo Alto Networks AP1
   • Prisma SaaS by Palo Alto Networks EU1
   • Palo Alto Networks NG-CASB - India - Office365
   • Prisma SaaS by Palo Alto Networks NAM
   • Palo Alto Networks NG-CASB - UK - Office365
   • Palo Alto Networks NG-CASB - Aus - Office365

3. If Palo Alto Networks application is not listed, check if the Audit Logs Activity displays as Consent to application, Target as <app from the list given above>, and Status as Success.

See the following table to understand the errors you are facing during validation.

Error Codes	Description
Errors in App Authentication
invalid_request	Request is invalid.
invalid_grant	Internal error encountered.
unauthorized_client	The installed app in the Marketplace was uninstalled manually from your cloud app.
invalid_client	Issue related to Marketplace instance.
temporarily_unavailable	Office 365 app issue on the server side. Please reinstall.
Errors in fetching sample assets and activities
accessDenied	Access is denied for ${user}.
activityLimitReached	App's API limit reached. Try after sometime.
invalidRange	You don't have any thing to get for this entity.
invalidRequest	Request is invalid.
itemNotFound	No data associated with this entity.
notAllowed	Authentication failure while retrieving the entity.
notSupported	Getting entity with required information no longer supported.
serviceNotAvailable	Office 365 server is not responding.
quotaLimitReached	Quota for app request has been exhausted for now.
unauthenticated	Office 365 app issue from server side.

The other most common issues are as follows:

Symptom	Explanation	Solution
After you add the Office 365 app, no scanned assets display for Office 365.	Data Security doesn’t have permissions to access Office 365, resulting in a misconfiguration.	Log in to the Azure portal and grant the necessary permissions for Data Security to successfully scan your assets on Office 365.
Office 365 app stopped scanning for assets.	On March 2020 Data Security changed Office 365 app for SharePoint to use Microsoft’s new Graph API to improve performance and supportability (OneDrive already uses Graph API).	Reauthenticate your Office 365 app for Data Security to continue scanning your assets. You’ll be asked to consent to the required SharePoint permissions. You do not need to repeat the onboarding process.
You receive an account mismatch error when you reauthenticate.	Although your account is valid, it is for a different Microsoft tenant. It is not uncommon for organizations to have more than one tenant. For security reasons, log on using an account associated with the tenant you used to onboard the cloud app and for which you intended to grant Data Security access.	Sometimes this issue occurs unknowingly when your browser caches your account information; in this case, log in again using an Incognito window. Otherwise, log in using the account associated with that other tenant.
You observe that the policy violation log is missing, violations aren’t being created for user activity rules, and activities on IncidentsUser Activity Incidents do not display.	Data Security needs audit logs to search and report on user activity. You forgot to enable this feature.	Enable Auditing.

Fix Access Issues

Grant Data Security access to Office 365 using Azure Portal. Without permissions, Data Security can’t authenticate (OAuth2) with Office 365 and can’t scan assets, even after you successfully install the Office 365 app.

1. Log in to Azure Portal at as Global Administrator.
2. Select Enterprise applications All applications.

3. Select Aperture by Palo Alto NetworksSecurityPermissions.
4. Click Grant admin consent for yourOrganization.

Fix Quarantine Issues

If Data Security is unable to quarantine the asset, quarantine status displays a summary explanation of the quarantine failure. If you need additional information, and due to the underlying differences between cloud apps, use the table below for a detailed explanation and resolution.

By default, Office 365 cloud app quarantines malicious assets, causing the quarantined file to become unavailable to third-party quarantine capabilities, including those on Data Security. To provide the high user experience to which you’ve become accustomed, the SaaS Security web interface informs you when your cloud app quarantines an asset.

Data Security understands that your organization needs to remediate files across cloud apps from a single user interface. Data Security is working diligently with cloud app vendors to enable third-party remediation of malicious assets.

If you have super admin permissions on your cloud app, you will always have direct access to the assets quarantined by your cloud app, even when Data Security doesn’t.

Symptom	Explanation	Resolution
License and Subscription
After you add the Office 365 app, Data Security doesn’t quarantine your OneDrive assets and quarantine status indicates Unable to create quarantine location.	You must have a OneDrive subscription. Only then can Data Security create the necessary Quarantine folder on OneDrive and quarantine assets.	Verify that you have a OneDrive subscription. If you purchase a new OneDrive subscription, you must reauthenticate on Data Security.
Data Security stopped quarantining your OneDrive assets and quarantine status indicates Unable to create quarantine location.	Data Security requires the administrator account and OneDrive license that you used to onboard the Office 365 app, for moving assets to the quarantine folder. After you add the Office 365 app, if later that same administrator account is deleted or the OneDrive license is revoked, Data Security can no longer quarantine assets.	Verify that the administrator account you used to add the Office 365 app still exists and has a valid OneDrive license. If the administrator account no longer exists, you must reauthenticate on Data Security using a different administrator account with Global Administrator role permissions and a valid OneDrive license. If the administrator account exists but doesn’t have a valid OneDrive license, you must add that OneDrive license to the administrator account, then reauthenticate, or use another administrator account with Global Administrator role permissions that has a valid OneDrive license, then reauthenticate.
Files Unavailable for Quarantine
When you attempt to perform an Admin Quarantine of a file, you receive a 'File will be quarantined soon' message, but the file remains stuck in the 'quarantine_pending' status.	Although an E3 license was assigned, your OneDrive personal site (MySite) has not been provisioned. In Office 365, assigning a license does not automatically provision the storage environment; it requires a first-time login.	Sign in to your OneDrive via a web browser to initialize the provisioning process. Once the OneDrive space is active, the Admin Quarantine function will work as expected.
Your file doesn’t display in the Data Assets page and your cloud app notified you that it quarantined the file.	Data Security doesn’t know that the file exists. Your cloud app immediately discovered the malware and quarantined it—before Data Security could copy the file’s metadata and the asset’s contents.	As super admin, remediate the file within your cloud app.
quarantine status indicates Unable to download asset.	Microsoft Threat Protection blocked the file for download. Data Security copied the file metadata but can’t download a copy of the asset itself for WildFire analysis because your cloud app quarantined the asset, making it unavailable. Data Security immediately copied the asset metadata—before the cloud app could discover and quarantine it. Data Security attempted to download a copy of the file to send to WildFire, but the cloud app already discovered and quarantined the asset.	As super admin, remediate the file within your cloud app.
Your file’s malware status is File Unavailable.
You’re unable to quarantine a file that displays in the Data Assets page. The Actions:Quarantine option is unavailable.
You’re unable to perform Download and Restore quarantine actions on a file initially quarantined by Data Security.	Data Security can’t download a new copy of the asset and perform quarantine actions because your cloud app quarantined the asset, making it unavailable. Data Security immediately copied the asset metadata, downloaded a copy of the asset itself, and quarantined it—before the cloud app could detect malware and quarantine it. With WildFire analysis enabled, Data Security sent your file to WildFire, a malware verdict was returned, and so Data Security quarantined the asset based on your policy. After the copy of the file expired on SaaS Security web interface or Data Security received notification from your cloud app that your cloud app eventually discovered the malware and quarantined the asset, Data Security overwrote the malware status.	As super admin, if you need to download or restore the file, do so on your cloud app. However, if you want to delete the file, do so on Data Security—not your cloud app, to enable Data Security to close the open incident and the quarantined file, keeping the state up to date.
You’re unable to View Snippet or access any other historical information on a file initially quarantined by Data Security.
Your file’s malware status is File Unavailable, but previously had a malware status of Pending Analysis or Analyzed.
You’re unable to view the WildFire report for a file whereas you were able to previously, although the WildFire data pattern matches display in the Data Assets page.

If issues persist, contact SaaS Security Technical Support.