O365 (Microsoft) OneDrive Connector

Overview

Used for OneTrust Data Discovery, the OneDrive connector connects to Microsoft’s cloud file sharing system and can be used to scan file system information directly from OneDrive.

Pod Residency: o365-scanner
Connection Method: API/OAuth 2.0

Supported Scan Actions


Scan Type	Description
Catalog	Supports catalog scan as it can retrieve metadata from the list of drives, folders, and files within OneDrive.
Catalog & Scan	This will catalog the folder then file and classify the scan results.

Credentials & System Permissions

OneTrust recommends to adhere to your organization's security and infrastructure policy and include system engineer resources or other qualified subject matter experts to set up credentials on data sources.

From Microsoft Azure Portal you will need to create a new App Registration allowing Data Discovery to access your OneDrive drives, files, and folders.

You will need several values from this app registration for your vault credential that OneTrust Data Discovery will reference. From your app registration, your vault credential will need to securely record the Application ID (Client ID), and Directory ID (Tenant ID). Also, from the Endpoints section of your app registration, your vault credential will need the "OAuth 2.0 token endpoint (v2)" URL.

Finally, as part of your app registration you have created, under "Certificates and Secrets" you need to create a new client secret. This is the last item you need for your vault configuration. Record this securely as soon as you create it per your security policy and this should not be shared with OneTrust or anyone else not authorized. Ensure you capture the actual secret "value." Azure hides this value after it is created so you must get it the first time you create it.

CAUTION:

The Secret ID will NOT work, do not use this value in your credentials.

In your app registration, under API Permissions, set the following permissions:


Permission	Type
Files.Read.All	Application
Sites.Read.All	Application
User.Read.All	Application
Directory.Read.All	Application
Group.Read.All	Application
User.Read Note: When your credentials are created, Azure automatically creates this permission. Please leave it and do not delete.	Delegated

Sample JSON

JSON

{	
    "clientId": "your_client_id",
    "clientSecret": "your_client_secret",
    "scopes": "https://graph.microsoft.com/.default",
    "tenantId": "your_tenant"
}

{	
    "clientId": "your_client_id",
    "clientSecret": "your_client_secret",
    "scopes": "https://graph.microsoft.com/.default",
    "tenantId": "your_tenant"
}

Scan Profile Details

Note:

For additional details on scan profile configuration and management, see Setting Up Scan Profiles.

Limits

Max/Min File Size
Max Number of users, drives, folders, files
File Types
Include/Exclude Paths support user, folder, file at this time.
Incremental Scan by Last Modified/Created date

Include Path Details


Item	Description
User	Input the user's account that will be used to scan the files. Put [*] to scan all user's OneDrive.
Folder	Input the folder name. Important: Start with / before the folder name. Can put [] to scan all folders. Nested folders simply will be child of the first folder (e.g. /folder1/folder2). Include [] after folder to include all other nested folders like /dir1. CODE Example: /dir /dir1/dir2/dir3 /dir1/dir2* `Example: /dir * /dir1/dir2/dir3 /dir1/dir2*`
File	Input the file name as is. Input [] wildcard to scan all files. Input wildcard to scan all files starting with that phrase. Include the full file name with extension. CODE Example: sample.txt doc * `Example: sample.txt doc* *`

Common Structured File Types

The file types below are ones regularly tested and used for OneTrust deployments. Additional file type support can be considered as they are needed. Please contact OneTrust to inquire about specific files types for your unique deployment needs.

.pdf
.csv
.xlsx
.pptx
.docx
.zip

OneDrive Objects Collected

Using the OneDrive connector, OneTrust will be able to catalog and scan the OneDrive objects listed below:


Object	Description
Drive	The share where the folders and files are stored.
DriveItem	The Folder and Files, represents any item contained within a Drive.
Users	The top-level object in the OneDrive hierarchy used to identify the associated account.

OneDrive Fields Collected


Objects	Fields
Files	ID Modified Date Created Date Owner (User) Size on Disk Content Type Path
Discovered via Data Governance metadata attributes	Direct Link (Drive, File, Folder) Shared Access (Files) Web URL (Site)

Troubleshooting

Site Not Found

The following event log may be shown, which indicates that a valid license is not assigned to the user whose site/drive is being discovered. Verify the account license and assign it to the appropriate user.

CODE

com.microsoft.graph.http.GraphServiceException: Error code: ResourceNotFound Error message: User's mysite not found

com.microsoft.graph.http.GraphServiceException: Error code: ResourceNotFound Error message: User's mysite not found

Data Use Governance