Begin Scanning Microsoft Office 365 Apps
Learn how to connect Microsoft Office 365 apps to SaaS Security API to begin scanning for security violations.
To connect Microsoft Office 365 to SaaS Security API and begin scanning files and folders on OneDrive and SharePoint, you need to:
- Ensure that you have a OneDrive subscription. A storage plan is separate from an Office 365 subscription.
- Grant SaaS Security API access to Office 365.
- Add the Office 365 app to SaaS Security API, providing SaaS Security API information about your Office 365 account.
- Enable activity monitoring. You must turn on auditing in Office 365 to record user and admin activity.
For information on which automated remediation capabilities SaaS Security API supports with Office 365, refer to Supported Applications with Remediation.
Prepare To Add Office 365 App
Before you add the Office 365 app, perform prerequisites steps to make use of all the capabilities that the app supports and that make for an efficient onboarding experience.
- (Recommended) Add your Office 365 app domain as an internal domain.
- (Optional) Enable group-based selective scanning.If you plan to use selective scanning using Azure Active Directory, you must retrieve your Azure AD group information before adding your Office 365 application so SaaS Security API can discover and scan assets belonging to the user groups you want to monitor.
- Next Step: Proceed to Add Office 365 App.
Add Office 365 App
In order for SaaS Security API to scan assets, you must consent to specific permissions during the course of adding the Office 365 app. Without the requested permissions, SaaS Security API cannot authenticate (OAuth2) with Office 365 and cannot scan assets, even after you successfully install the Office 365 app. If you forget to consent to permissions, you can correct the misconfiguration, but it’s more efficient to avoid the issue.
- Establish communication between SaaS Security API and Microsoft Office 365.
- Go to http://portal.microsoftonline.com and log out of Office 365 to ensure that you are not logged in as a user other than an account with Global Admin role permissions.
- Log in to Office 365 using an account that has the Global Admin role permissions:
- Add the Office 365 app.
- From theDashboard, clickAdd a Cloud App.
- SelectOffice 365.
- Select one of the following:
If you have a dedicated Office 365 account, selectUsing a custom configuration?and provide the URL for OneDrive and SharePoint that are part of your custom configuration.
- Connect to Office 365 Account
- Using a custom configuration?
- Enter the login credentials for the account with Global Admin role privileges on the Microsoft Online page to which SaaS Security API redirects you.
- Review andAcceptthe permissions requested.SaaS Security API requires these permissions to scan your assets on Office 365.After authentication, SaaS Security API adds the new Office 365 app to the Cloud Apps list asOffice365n, where n is the number of Office 365 app instances that you connected to SaaS Security API. For example, if you added one Office365 app, the name displays asOffice365 1. You’ll specify a descriptive name soon.
- Next Step: Proceed to Enable Activity Monitoring.
Enable Activity Monitoring
You must turn on auditing in Office 365 to record user and admin activity. This feature isn’t enabled by default. SaaS Security API needs audit logs to search and report on activity and to perform forward scans. If you don’t turn on auditing, you’ll observe missing functionality related to user and admin activity.
Customize Office 365 App
After you add the Office 365 app, customize the app to make use of capabilities that are unique to this app or that differentiate this app instance from others.
- (Optional) Specify anAlternative account for quarantined files.You can specify a different Office 365 account (in UPN format) for the quarantine administrator for precise assignment of incident management responsibilities. If you choose not to specify an alternative account, SaaS Security API uses the onboarding account to quarantined files in theAdmin Quarantinefolder. The Office 365 account for the quarantine administrator does not need to have admin privileges. After you define this quarantine administrator, you cannot modify the setting without deleting the Office 365 app and repeating the onboarding process; therefore, use a service account that persists as administrators join and leave your organization.
- (Optional) Give a descriptive name to this app instance.
- Select the Office365 n link on the Cloud Apps list.
- Enter a descriptiveNameto differentiate this instance of Office 365 from other instances you are managing.
- ClickDoneto save your changes.
- Next Step: Proceed to Identify Risks.
When you add a new cloud app, then enable scanning, SaaS Security API automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
- Start scanning the new Microsoft Office 365 app for risks.
- Select.SettingsCloud Apps & Scan Settings
- In the Cloud Apps row that corresponds to the new Office 365 app, select.ActionsStart Scanning
- During the discovery phase, as SaaS Security API scans files and matches them against enabled policy rules:
- Verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, proceed to next step to improve your results.
- (Optional) Modify match criteria for existing policy rules.
- (Optional) Configure or edit a data pattern.
- Next Step: Proceed to Fix Office 365 Onboarding Issues, if necessary.
Fix Office 365 Onboarding Issues
The most common issues related to onboarding are as follows:
After you add the Office 365 app, no scanned assets display for Office 365.
SaaS Security API doesn’t have permissions to access Office 365, resulting in a misconfiguration.
Office 365 app stopped scanning for assets.
On March 2020 SaaS Security API changed Office 365 app for SharePoint to use Microsoft’s new Graph API to improve performance and supportability (OneDrive already uses Graph API).
Reauthenticate your Office 365 app in order for SaaS Security API to continue scanning your assets. You’ll be asked to consent to the required SharePoint permissions. You do not need to repeat the onboarding process.
You receive an account mismatch error when you reauthenticate.
Although your account is valid, it is for a different Microsoft tenant. It is not uncommon for organizations to have more than one tenant. For security reasons, log on using an account associated with the tenant you used to onboard the cloud app and for which you intended to grant SaaS Security API access.
Sometimes this issue occurs unknowingly when your browser caches your account information; in this case, log in again using an Incognito window. Otherwise, log in using the account associated with that other tenant.
You observe that the policy violation log is missing, violations are not being created for user activity rules, and activities on
Activitiesdo not display.
SaaS Security API needs audit logs to search and report on user activity. You forgot to enable this feature.
Fix SaaS Security API Access to Office 365
If you forgot to grant the necessary permissions during onboarding, you need to fix this misconfiguration.
- Grant SaaS Security API access to Office 365 using Azure Portal.Without permissions, SaaS Security API cannot authenticate (OAuth2) with Office 365 and cannot scan assets, even after you successfully install the Office 365 app.
- Log in to Azure Portal at https://portal.azure.com as Global Administrator.
- Navigate to.Enterprise applicationsAll applications
- Select.Aperture by Palo Alto NetworksSecurityPermissions
- ClickGrant admin consent for.yourOrganization
Fix Office 365 Quarantine Issues
If SaaS Security API is unable to quarantine the asset, quarantine status displays a summary explanation of the quarantine failure. If you need additional information, and due to the underlying differences between cloud apps, use the table below for a detailed explanation and resolution.
By default, Office 365 cloud app quarantines malicious assets, causing the quarantined file to become unavailable to third-party quarantine capabilities, including those on SaaS Security API. To provide the high user experience to which you’ve become accustomed, the SaaS Security web interface informs you when your cloud app quarantines an asset.
SaaS Security API understands that your organization needs to remediate files across cloud apps from a single user interface. SaaS Security API is working diligently with cloud app vendors to enable third-party remediation of malicious assets.
If you have super admin permissions on your cloud app, you will always have direct access to the assets quarantined by your cloud app, even when SaaS Security API does not.
License and Subscription
You must have a OneDrive subscription. Only then can SaaS Security API create the necessary
Quarantinefolder on OneDrive and quarantine assets.
Verify that you have a OneDrive subscription.
If you purchase a new OneDrive subscription, you must reauthenticate on SaaS Security API.
SaaS Security API requires the administrator account and OneDrive license that you used to onboard the Office 365 app, for moving assets to the quarantine folder.
After you add the Office 365 app, if later that same administrator account is deleted or the OneDrive license is revoked, SaaS Security API can no longer quarantine assets.
Verify that the administrator account you used to add the Office 365 app still exists and has a valid OneDrive license.
If the administrator account no longer exists, you must reauthenticate on SaaS Security API using a different administrator account with Global Administrator role permissions and a valid OneDrive license.
If the administrator account exists but does not have a valid OneDrive license, you must add that OneDrive license to the administrator account, then reauthenticate, or use another administrator account with Global Administrator role permissions that has a valid OneDrive license, then reauthenticate.
Files Unavailable for Quarantine
Your file does not display in SaaS Security web interface and your cloud app notified you that it quarantined the file.
SaaS Security API does not know that the file exists.
Your cloud app immediately discovered the malware and quarantined it—before SaaS Security API could copy the file’s metadata and the asset’s contents.
Quarantine status indicates
Unable to download asset.
Microsoft Thread Protection blocked the file for download.
SaaS Security API copied the file metadata but cannot download a copy of the asset itself for WildFire analysis because your cloud app quarantined the asset, making it unavailable.
SaaS Security API immediately copied the asset metadata—before the cloud app could discover and quarantine it.
SaaS Security API attempted to download a copy of the file to send to WildFire, but the cloud app already discovered and quarantined the asset.
You’re unable to quarantine a file that displays in SaaS Security API web interface. The
Quarantineoption is unavailable.
You’re unable to perform
Restorequarantine actions on a file initially quarantined by SaaS Security API.
SaaS Security API cannot download a new copy of the asset and perform quarantine actions because your cloud app quarantined the asset, making it unavailable.
SaaS Security API immediately copied the asset metadata, downloaded a copy of the asset itself, and quarantined it—before the cloud app could detect malware and quarantine it.
With WildFire analysis enabled, SaaS Security API sent your file to WildFire, a malware verdict was returned, and so SaaS Security API quarantined the asset based on your policy.
After the copy of the file expired on SaaS Security web interface or SaaS Security API received notification from your cloud app that your cloud app eventually discovered the malware and quarantined the asset, SaaS Security API overwrote the malware status.
As super admin, if you need to download or restore the file, do so on your cloud app.
However, if you want to delete the file, do so on SaaS Security API—not your cloud app, to enable SaaS Security API to close the open incident and the quarantined file, keeping the state up to date.
You’re unable to
View Snippetor access any other historical information on a file initially quarantined by SaaS Security API.
Your file’s malware status is
File Unavailable, but previously had a malware status of
You’re unable to view the WildFire report for a file whereas you were able to previously, although the WildFire data pattern matches display in SaaS Security API web interface.
Recommended For You
Recommended videos not found.