After you onboard a cloud app, you must initiate scanning on that cloud app so that Data Security can scan for policy violations and data exposure. When you initiate scanning—known as discovery or initial backward scan—Data Security scans all assets in the associated cloud app. During the discovery process, Data Security also matches the assets against enabled default policy rules and identifies incidents. The time required to complete the discovery process depends on the number of assets on your cloud app. However, as soon as you begin to see the assets populate on the Data Security Dashboard, you can assess incidents.

After the discovery process completes, Data Security periodically queries for scannable root entities (for example, user, channel, shared drive, etc.) that are not on its list of known entities, and this scan frequency depends on the SaaS app, taking into account optimal performance; however, Data Security scans most SaaS apps every 5 minutes and is able to do so without delay if Data Security hasn’t reached the rate limit. Each cloud app has unique entities for scanning purposes. When Data Security detects such entities, two distinct scan processes trigger automatically:

When you connect Data Security to one of your sanctioned SaaS applications, you must provide login credentials that enable the service to establish a secure connection with the cloud app. Data Security and the app maintain this secure connection (in most cases using token-based authentication). In some cases, you might need to reauthenticate to a cloud app when:

If you encounter authentication errors when you retrieve a token for Data Security, see Authentication Errors.

When you initially onboard a cloud app, Data Security automatically verifies that the administrator account has the necessary permissions. Additionally, using API calls to the cloud app, Data Security continues to periodically perform this check on a regular, scheduled basis. Although the cloud app in Data Security can indicate a Monitoring status, there might be an undetected permissions issue if permissions changed after the last health check.

You might want to verify permissions outside this scheduled event if:

When you Configure Data Patterns, Data Security scans all connected cloud apps automatically to detect sensitive content that match on these patterns. This is the discovery process. Unlike a forward scan, a rescan does not request assets from the cloud; rather, a rescan downloads previously discovered assets from the cloud app.

Consider a rescan if:

When you delete a cloud app, Data Security purges all related cloud app data from Data Security, removes the cloud app from the Dashboard, and relinquishes permissions to access the cloud app. Deleting a cloud app does not remove the integration from the cloud app’s marketplace—you must do so manually.

For specific cloud apps, the cloud app vendor automatically notifies Data Security when you delete the integration. If you do not delete the cloud app, the SaaS Security web interface displays Marketplace integration deleted. Finish installing.. In this case, we recommend that you also delete the cloud app to complete your uninstall.

Delete a cloud app if: