Azure Files Connector

Overview

Used for OneTrust Data Discovery Scanners, the Azure Files Connector can help catalog fully managed file shares in the cloud that are accessible via the industry standard Server Message Block (SMB) protocol, Network File System (NFS) protocol.

Pod Residency

storage-scanner

Connection Method

Azure Files API

Supported Scan Actions

Scan Type

Description

Catalog

This will fetch the list of shares and folder/files present in those shares. It collects the metadata for these objects and sends it back to the main OneTrust app.

Catalog & Scan

This will fetch the list of shares and folder/files present in those shares. Metadata is collected and then content extraction. It will return personally identifiable information (PII), data elements (DE), and terms as per the classification label identified.

Credential & System Permissions

Important:

OneTrust recommends to adhere to your organization's security and infrastructure policy and include system engineer resources or other qualified subject matter experts to set up credentials on data sources. For specific instructions for how to enable these credentials, refer to your data source's implementation documentation, knowledge base and/or support resources.

This connector can support two authentication methods:

Access Key

There are two ways to create a shared key credential, the first is using the storage account name and account key. The second is using the storage connection string.

  1. Storage Account Name & Account Key: access the Access keys tab for your storage account and copy the Key value for either Key 1 or Key 2.

  2. Storage Connection String: access the Access keys tab and copy the Connection string value for either Key 1 or Key 2.

JSON 
{
    "endpoint" : "https://scannersmb3.file.core.windows.net?sv=...",
    "account_name" : "<account_name>",
    "share_name" : "<share_name>",
    "connectionUrl" : "<connectionstringvalue>"
 }

Shared Access Signature (SAS) Token

  1. Go to your storage account.

  2. Click on Shared access signature.

  3. The following permissions are needed for scanning Azure Fileshares.

    • Allowed services: File

    • Allowed resource types: Service, Container, Object

    • Allowed permissions: Read, List

  4. Click on Generate SAS and connection string. The output should resemble the following:

    JSON 
    {
    "connection_string" : "BlobEndpoint=https://storageaccountname.blob.core.windows.net/;QueueEndpoint=https://storageaccountname.queue.core.windows.net/;FileEndpoint=https://azurefiles.file.core.windows.net/;TableEndpoint=https://storageaccountname.table.core.windows.net/;SharedAccessSignature=sv=2022-11-02&ss=f&s4-06-27T15RriS4CW9QW5iHzpLKv2FnL%2FJhuVd1hyg%3B",
    "sas_token" : "sv=2022-11-02&ss=f&s4-06-27T15RriS4CW9QW5iHzpLKv2FnL%2FJhuVd1hyg%3B", 
    "file_sas_url" : "https://storageaccountname.file.core.windows.net/?sv=2022-11-02&ss=f&s4-06-27T15RriS4CW9QW5iHzpLKv2FnL%2FJhuVd1hyg%3B"
}

Permissions

Access Key authentication does not require any permissions as it includes full privileges.

Shared Access Signature authentication requires the following permissions:

  • Allowed services: File

  • Allowed resource types: Service, Container, Object

  • Allowed permissions: Read, List

Sample JSON - Access Key

JSON 
{ 
    "connectionUrl": "DefaultEndpointsProtocol=https;AccountName=azurefiles;AccountKey=PerCLBcFbSYevJ9TSXRag==;EndpointSuffix=core.windows.net" 
}

Sample JSON - Shared Access Signature

JSON 
{
    "endpoint" : "https://storageaccountname.file.core.windows.net/?sv=2022-11-02&ss=",
    "account_name" : "storageaccountname",
}

Scan Profile Support

Note:

For additional details on scan profile configuration and management, see Setting Up Scan Profiles.

Limits

  • Max Number of Shares

  • Maximum Number of Folders per Share

  • Maximum Number of Files per Share

Scope

  • Minimum/Maximum File Sizes

  • Incremental Scan

  • Include/Exclude File Types

  • Include/Exclude Paths

Collected Objects

  • Shares

  • Folders

  • Files

  • File Extension