Integrating with Microsoft Priva

You can natively integrate OneTrust to an account of Microsoft Priva and request personal information held in those environments to help service OneTrust data subject or consumer rights requests.

When a data subject submits a request to a OneTrust web form, the request workflows will automatically submit an equal request through the Microsoft integration. This will create a ticket in the Priva compliance center to find and deliver all personal information relating to the requester held in Priva. While the request is processing, privacy admins can monitor its status in the OneTrust Privacy Rights Automation module. and once the request is complete, consumer files can be pulled back from the Microsoft environment into the module.

The information found within Priva systems can then be reviewed and compiled with similar files found across non-Microsoft systems. OneTrust can then automatically redact sensitive and confidential data that should not be included in your response before sharing this information with the requester via the Privacy Portal. For more information, see OneTrust DSAR Redaction Capabilities.

Note:

The Microsoft Priva integration is currently available as a preview feature. To enable access to this feature, please contact OneTrust Support to submit the request.

Prerequisites

  • OneTrust Application Role: Site Admin or Integration Manager

  • Microsoft Role: Administrator, must allow for app creation with eDiscovery permissions

  • Internal OneTrust user added to tenant as Site Admin to load integration package

  • Privacy Rights Automation web form and workflow

  • Existing test data in Microsoft tenant and provided to OneTrust

Register an application

  1. As the Microsoft Admin, log in to your tenant at portal.azure.com.
  2. Search and select App Registrations. The App Registrations screen appears.
  3. Click New registration.
  4. Provide a name for the new registered application.
  5. Under Supported account types choose the setting Accounts in this organizational directory only.
  6. Under Redirect URI (optional) select Web as the platform, then paste the following URL: https://uat.onetrust.com/integrationmanager/api/v1/tokens/callback
  7. Click the Register button.
  8. Note down the Application (client ID) and Directory (tenant) ID.

Certificates & Secrets


  1. Click Manage > Certificates & Secrets.


  2. Click New Client Secret. The Add a client secret pane appears.


  3. Enter a description for this new client secret.


  4. In the Expiration field, choose an expiration timeframe.


  5. Click the Add button. The console will update the credentials with a new Secret ID.


  6. Note down the Secret ID.

API Permissions


  1. Click Manage > API permissions.


  2. Click Add a permission. The Request API permissions pane appears.

    Note:

    If the Microsoft Graph permission is already present, click on the permission name. The Request API Permissions pane appears.


  3. Under Microsoft APIs, locate and choose Microsoft Graph.


  4. Click Delegated permissions.


  5. In the Select permission search field, look up eDiscovery.


  6. Click the arrow to expand the section, then select the following permissions:

    • eDiscovery.Read.All

    • eDiscovery.ReadWrite.All


  7. Click the Add permissions button. The new permissions will be listed under the Microsoft Graph API permission.


  8. Select Grant admin consent for (Company Name) for these permissions.

OneTrust Integration Credential Setup

Important:

OneTrust must enabled this feature package for your environment account. Please contact OneTrust Support to get started.

  1. On the Integrations menu, select Credentials. The Credentials screen appears.
  2. Click the Add New button. The Select System screen appears.
  3. Enter Microsoft 365 in the Select System field.
  4. Click the Next button. The Enter Credential Details screen appears.
  5. Give the new credential a unique name.
  6. Select HTTPS for the Connector Type field.
  7. Select OAuth 2 for the Authentication Type field.
  8. Select Authorization Code for the Grant Type field.
  9. In the Auth URL field, enter the following URL and replace "tenant_id" with the Directory (tenant) ID previously noted in the Microsoft credential setup.
    CODE 
    https://login.microsoftonline.com/tenant_id/oauth2/v2.0/authorize
  10. In the Access Token URL field, enter the following URL and replace "tenant_id" with the Directory (tenant) ID previously noted in the Microsoft credential setup.
    CODE 
    https://login.microsoftonline.com/tenant_id/oauth2/v2.0/token 
  11. Paste the Client ID and Client Secret to the respective fields.
  12. Select Form URL encoded for the Send Authorization Parameters field.
  13. Click the Generate Token button. You will be asked to log into your Microsoft account.
    Note:

    If the user is already authenticated then they may see a window appear briefly then close.

  14. Verify that a token is generated in the Access Token field.
  15. Click the Save button.

OneTrust DSAR Workflow Configuration

  1. On the Data Subject Rights menu, select Setup > Workflows. The Workflows screen appears.
  2. Create a new workflow or choose an existing workflow to test with. The Workflow Details screen should be opened.
  3. Select the desired workflow stage, then click the Add Connection button. The Add Connection pane appears.
  4. Under the Add Existing Connection section, search and select the workflow you just created for the Microsoft integration.
  5. Click the Next button. The Configure Subtask screen will appear in the pane.
  6. Configure the System Subtask according to your desired preferences.
  7. Click the Add button. The integration connection will be added to the given workflow stage to trigger the subtask.
  8. Click the Activate button to enable the DSAR workflow.

OneTrust DSAR Web Form Configuration

  1. On the Data Subject Rights menu, select Setup > Web Forms. The Web Forms screen appears.
  2. Create a new web form or choose an existing web form to test with. The Web Form Customization screen should be opened.

    • For new web forms, select the DSAR workflow you just configured in the Request Fulfillment Workflow field.

    • For existing web forms, select the DSAR workflow as the Default Workflow in the Settings tab or create an automation rule with the DSAR workflow in the Rules tab.

  3. Click the Publish button.

Testing the Integration

  1. On the Data Subject Rights menu, select Setup > Web Forms. The Web Forms screen appears.
  2. Select the web form you configured for this integration. The Web Form Customization screen appears.
  3. Click the Context Menu icon, then select Test Live Form. The web form will appear in a new browser tab.
  4. Create a request using test data or data available in your Microsoft tenant.
  5. Once the request is received by the application, manually advance the request workflow to the stage where you added the integration connection. The integration will be triggered to create a request within the Microsoft tenant.
  6. The Microsoft tenant user will need to advance the request within Priva to the Complete stage.
  7. Once the Priva request is complete and the OneTrust application has ran, the data will be posted to the request's Result Summary screen. The System Subtask will also be marked as Complete in the workflow.
  8. Results can now be shared with data subjects via the Privacy Portal.