Azure AD Scan Assets Wizard

The Azure AD Scan Assets Wizard helps users automate asset discovery for your inventories and avoid manual configuration of assets in the OneTrust application. The connection identifies which apps are registered in your Azure AD instance and creates corresponding assets in Data Mapping Automation.

Prerequisites

  • Admin-level permissions in Azure AD to manage apps

  • Apps must have Application.Read.All permission for Microsoft Graph APIs

To create connection

  1. In the Scan Assets screen, provide a unique name and notification email for the new connection in the Name your new connection section.


  2. In the Provide Login Credentials section, you can choose to create new credentials or select existing credentials. For this example, we are creating new credentials using the Simple Connect feature.
    Note:

    For more on creating credentials in Integrations, see Configuring Integration Credentials.

  3. Provide the credential with a unique name and description.
  4. The Credential Type field will default to Simple_Connect, which will allow you to authenticate with Azure AD without leaving the configuration process.


  5. Click the Login button, which will open a new window to select your account.
  6. Once authenticated, the credential will show as logged in.


  7. You can also mark this new credential as sensitive if used with workflows that work with highly sensitive data. Only users with the Manage Sensitive Classification will have access to this credential if enabled.
  8. Click the Save button to save the credential.
  9. Click the Test button to validate the credential's connection to Azure AD.
  10. In the Select the Managing Organization section, choose the managing organization level.


  11. Click the Next button to advance to the next screen.

    The Configure Trigger screen appears.

  12. In the Schedule Action section, enter either Hourly, Daily, Weekly, Monthly, Yearly, or Quarterly in the Frequency field. Customize the time of day and which days the connection should be triggered.


  13. Click the Next button.

    The Integration Summary screen appears.

  14. Click the Save button. The workflow connection will be created in an initial Inactive state.


  15. You can test the connection by hovering over the workflow row and clicking the Context Menu icon to select Test.


  16. Click the Activate button.

    The Confirm modal appears.

  17. Click the Ok button to activate this integration.


    The Status in the Integration Summary screen will update to Active.
  18. Click the Save button again.

To configure connection

  1. In the Scan Assets screen, provide a unique name and notification email for the new connection in the Name your new connection section.


  2. In the Provide Login Credentials section, you can choose to create new credentials or select existing credentials.
    Note:

    For more on creating credentials in Integrations, see Configuring Integration Credentials.

    Field
    Description
    Credential Name

    Enter a name to identify the credentials.

    Description

    Enter a description of the credentials.

    Credential Type

    Select Custom.

    Connector Type

    Select Web App.

    Auth Type

    Select OAuth 2.

    Protocol

    Defaults to HTTPS.

    Hostname

    Enter the hostname for the credential. When a credential is associated to a workflow action, the hostname will be the default domain for this action. If a previous domain has been specified on the action, the hostname will replace that domain.

    Test URL

    Enter a test URL for the new credential.

    OneTrust recommends using the Test Credential feature to validate TEST URL field.. This is a valid REST GET URL provided by the attempted system integration. For more information, see Testing Workflow Actions and Saving Sample Payloads.

    Key (Default Header)

    Select the type of key which should be used in the header of the call made by the connection.

    You can add additional keys if your credential requires more than one header.

    Value (Default Header)

    Enter the value of the key which should be used in the header of the call made by the connection.

    Grant Type

    Select Client Credentials.

    Access Token URL

    Provide the URL appended with an Access Token from your Azure AD tenant. For more information, see Microsoft's Get a Token section.

    Example: https://login.microsoftonline.com/common/oauth2/v2.0/{token}

    Client ID

    The Application (client) ID that the Microsoft Entra admin center – App registrations experience assigned to your app. You can find this information in the portal where you registered your app.

    Client Secret

    The client secret that you generated for your app in the app registration portal. The client secret must be URL-encoded before being sent.

    Send Authentication Parameters In

    Select Form URL encoded.

    Send Credentials In

    Select HTTPS Headers.

    mTLS enabled

    Enable mutual transport layer security (mTLS) for all credentials using the Web App connector type to establish secure and trusted connections with external servers. This only applies to outbound connections made by actions in integration workflows which use this credential type.

    For more information, see Setting Up Mutual Transport Layer Security.

    Server Certificate Chain

    Post a custom server certificate to any HTTPS credential to establish a secure and trusted connection with external systems not using a certificate issued by a trusted authority.

  3. You can also mark this new credential as sensitive if used with workflows that work with highly sensitive data. Only users with the Manage Sensitive Classification will have access to this credential if enabled.
  4. Click the Save button to save the credential.
  5. Click the Test button to validate the credential's connection to Azure AD.
  6. In the Select the Managing Organization section, choose the managing organization level.


  7. Click the Next button to advance to the next screen.

    The Configure Trigger screen appears.

  8. In the Schedule Action section, enter either Hourly, Daily, Weekly, Monthly, Yearly, or Quarterly in the Frequency field. Customize the time of day and which days the connection should be triggered.


  9. Click the Next button.

    The Integration Summary screen appears.

  10. Click the Save button. The workflow connection will be created in an initial Inactive state.


  11. You can test the connection by hovering over the workflow row and clicking the Context Menu icon to select Test.


  12. Click the Activate button.

    The Confirm modal appears.

  13. Click the Ok button to activate this integration. The Status in the Integration Summary screen will update to Active.


  14. Click the Save button again.

To test logs and asset creation

Once the connection is triggered, you can inspect the connection logs to check the results and inspect Data Mapping Automation to see the newly created Assets. If you encounter any issues with this setup or are not able to create assets as expected, please contact OneTrust Support.

  1. In the Integrations menu, select Connections.
  2. Locate and select the new connection.

    The Connection Details screen appears.

  3. Select the active workflow in the Summary tab.


    The Integration Builder screen appears.
  4. Navigate to the Logs tab.
  5. Check if the message log, which is created when the connection was triggered, was successful. You can click the Event ID to inspect the log's request bodies and results.


  6. To check if assets were created, navigate to Data Mapping Automation > Inventory > Assets.
  7. Use the search bar to locate the new asset. It will be titled using the app name as seen in Azure AD. The Managing Organization column will list the org level you specified in the wizard configuration.
  8. Select the asset name to enter the Inventory Details screen. In the Details tab, you will find under Integration Information section the External ID of the asset will default to the app name with "- Azure AD" appended.