Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

Clouds

Office 365: Exchange Online

search

Please Note:

Office 365: Exchange Online

This section covers the following topics:

Prerequisites

ComponentDescription
Proxy AgentProxy Agent host with direct internet access. Recommended Proxy Agents:
• Windows Agent
• Linux Agent
TCP Allowed ConnectionsPort 443

Configure Microsoft 365 Account

This topic describes how to generate the client ID, tentant key ID, and client secret key. These are required to register DDC with Microsoft 365 account. The topic also describes how to grant API permisisons to DDC to access specific resource APIs.

  1. Generate Client ID and Tenant ID

  2. Generate Client Secret Key

  3. Grant API Access

Generate Client ID and Tenant ID

To generate the client ID and tenant ID:

  1. Log on to the Azure app registration portal as an administrator account. After you log on successfully, you are redirected to the home page.

  2. In the left pane, select the Microsoft Entra ID service. Alternatively, you can search for Microsoft Entra ID in the search bar.

  3. Under Manage, click App registrations. The App registrations page is displayed.

  4. Click + New registration. The Register an application page is displayed.

  5. Specify the following:

    • Name: Display name for your application.

    • Supported account types: Select Accounts in this organizational directory only.

  6. Click Register. The Overview page of the newly registered application is displayed.

  7. Note down the values of Application (client) ID and Directory (tenant) ID. These values will be required when configuring a connection for the data store.

Generate Client Secret Key

  1. Under Manage, click Certificates & secrets.

  2. On the Client secrets tab, click + New client secret. The Add a client secret dialog box is displayed.

  3. Specify the following:

    • Description: Description for the client secret key.

    • Expires: Validity for the client secret key. The recommended validity is 180 days (6 months).

  4. Click Add. The client secret key is added. The Value column displays the client secret key.

  5. Copy the client secret key and save it to a secure location. This secret key will be required when configuring a connection for the data store.

Warning

Save the client secret key in a secure location. You cannot access this client secret key after you navigate away from the page.

Grant API Access

To scan Exchange Online targets, you need to grant permissions to DDC to access specific resource APIs.

  1. Under Manage, click API permissions.

  2. In the Configured permissions section, click + Add a permission. The Request API permissions dialog box is displayed.

  3. On the Microsoft APIs tab, click Microsoft Graph > Application permissions.

  4. Select the following API permissions for your app:

    PermissionsDescription
    • Group.Read.All
    • User.Read.All
    • Directory.Read.All
    • Mail.Read
    • Contacts.Read
    • Calendars.Read    		Permissions required for scanning Exchange Online targets.
    • Group.ReadWrite.All
    • User.ReadWrite.All
    • Directory.ReadWrite.All
    • Mail.ReadWrite
    • Contacts.ReadWrite
    • Calendars.ReadWrite    		Permissions required for remediating Exchange Online targets.

    Tip

    To add permissions:

    1. In the search box, type the permission you want to add.

    2. Select the check box to the left of the permission. Similarly, select all the required permissions.

    3. Click Add permissions.

  5. In the Configured permissions section, click Grant admin consent for <organization name>. The Grant admin consent confirmation dialog box is displayed.

  6. Click Yes.

The Status column for all the newly added API permissions is updated to Granted for <organization name>.

Add Exchange Online Data Store

To add the Exchange Online data store:

  1. Log on to the CipherTrust Manager GUI.

  2. Open the Data Discovery & Classification application.

  3. Click Data Stores > Data Stores > Add Data Store. The Add Data Store wizard is displayed.

  4. Complete the following steps:

    1. Select Store Type

    2. Configure Connection

    3. General Info

    4. Add Tags & Access Control

Select Store Type

  1. Under Select Data Store Category, select Cloud.

  2. From Select Cloud Type, select Office 365: Exchange Online.

  3. Click Next.

Configure Connection

  1. Specify the credentials of the Exchange Online domain:

    FieldDescription
    Exchange Online DomainMicrosoft 365 domain to scan (for example, example.onmicrosoft.com).
    Only accounts where the user principal name (UPN) shares the same domain as specified in the Exchange Online Domain field will be scanned.
    For example, if Exchange Online Domain is set to example.onmicrosoft.com, user1@example2.onmicrosoft.com will not be scanned even if the user belongs to a group in the example.onmicrosoft.com domain.
    To scan multiple domains within your organization's Microsoft 365 environment, add these domains as separate Exchange Online targets.
    Client IDClient ID (application ID) of Exchange Online. For example, clientid-1234-5678-abcd-6d05bf28c2bf. Refer to Generate Client ID and Tenant ID for the client ID.
    Client Secret KeyExchange Online client secret key. For example, client~secret.key-CHvV1B5YQfr~6zDjEyv. Refer to Generate Client Secret Key for the client secret key.
    Tenant IDTenant ID of Exchange Online. Your Microsoft 365 tenant ID is a globally unique identifier (GUID) that is different than your organization name or domain. For example, tenantid-1234-abcd-5678-02011df316f4. Refer to Generate Client ID and Tenant ID for the tenant ID.

  2. In the Select Number of Agents field, set the minimum and maximum number of agents for the data store. Refer to Agents for more information.

    Warning

    • As there is no limit on the number of minimum and maximum agents that you can set, you should exercise caution so that you do not impact the system performance by using too many resources for a single scan.
    • You will not be able to add a datastore if the minimum number of agents cannot be assigned.
    • A scan will fail if the assigned agent is unavailable after adding the datastore.
    • The minimum number of agents must be less than or equal to the maximum number of agents.

  3. (Optional) In the Add Label field, enter a label. You can also remove an existing label.

  4. Click Next.

General Info

  1. Specify the following details:

    • Name: Name for the data store.

    • Description (Optional): Description for the data store.

    • Location: Location of the data store. Refer to Managing Branch Locations for details.

    • Sensitivity Level (Optional): Sensitivity level for the data store. Refer to Sensitivity Levels for details.

    • Enable Data Store: Whether to enable the newly added data store. Select the check box to enable the data store.

  2. Click Next.

Add Tags & Access Control

  1. (Optional) Grant the All groups (default) access for reports. Alternatively, select a group.

  2. Click Save.

The data store is added to the Data stores page. If the Ready to Scan column shows Ready, then data store is properly configured.

For more information on tags and access control, expand the section below.

Tags and Access Control

The Add Tags & Access Control screen in the Add Data Store wizard allows you to grant access rights to your data store and add tags. More details below:

  • ACCESS - select user groups that can access the data store. Access to a data store provides ability to see reports that include scans of that data store. The available options are:

    • All groups: All groups of users can access the data store through reports. This is the default setting.

    • Selected group/s: Specified user defined groups can access the data store through reports. When this option is selected, select a group from the drop-down list. This list shows existing user defined groups. The user defined groups must already exist on CipherTrust Manager. If no user defined groups exist, ask the administrator to create a group. If needed, you can select multiple groups. Start typing the name of the desired group and select from the suggested groups.

  • TAGS - select a tag from the Add Tag drop-down list. Please check the list of prebuilt tags in Predefined Tags.

    Tip

    • New tags can also be added. Start typing a new tag, and click the New: <new_tag> link that appears below the drop-down list.

    • Add as many tags as needed.

    • To remove a tag, click the close icon in the tag name.

  • In the General Info screen of the wizard, specify the name, description, branch location, and sensitivity level for your data store. See "Configuring a Data Store - General Information" for details.

  • In the Add Tags & Access Control screen of the wizard, grant access rights to your data store and add metadata. See "Configuring a Data Store – Tags and Access Control" for details.

  • Click Save to create the data store. At any time during the configuration you can click Back to go to any of the previous wizard screens to update the configuration. The newly created data store appears on the Data Stores page. By default, data stores are displayed in alphabetic order by name. Depending on the number of entries per page, you might need to navigate to other pages to view the newly created data store.

Note

  • Only accounts where the user principal name (UPN) shares the same domain as specified in the Exchange Online Domain field will be scanned.

  • To scan multiple domains, you need to add the domains in a new data store and add this data store in the scan setting.

  • A group can have an email associated with it. If the group has a domain similar to the configured Exchange Online Domain, then only the group will be scanned.

  • A group may not have an email configured. The group will be scanned if the users in the group have the same domain as configured in Exchange Online Domain. Users with a different domain won't be scanned.

    For example, security groups don't need an email, they will still be scanned. However, the users that belong to this group should have the same domain as the group domain to be scanned. Users that belong to this group, but have a different domain, will not be scanned.

  • A group, which has the same email as the group domain, may contain users with different domains. In this case, only the users that share the same domain as the group domain will be scanned.

Add Exchange Online Scan

To add a scan for the Exchange Online:

  1. Open the Data Discovery & Classification application.

  2. Click Scans > Add Scan. The Add Scan wizard is displayed.

  3. Complete the following steps:

    1. General Info

    2. Select Data Stores

    3. Add Targets

    4. Select Profiles

    5. Add Filters

    6. Schedule Run

    Refer to Scans for the description of screens of the Add Scan wizard.

General Info

  1. Specify a Name for the scan.

  2. (optional) Add a Description for the scan.

  3. Expand Advanced Configuration and specify advanced configurations such Scan Priority, Memory Usage Limit, and Amount of Data Object Volume. Refer to Advanced Configuration for details.

  4. Click Next.

Select Data Stores

  1. Under Data Store Name, select the desired data store that is Ready for scanning. You can select multiple data stores, if required.

  2. Click Next.

Add Targets

  1. To add a scan target, do one of the following:

    • Under the Add Target field, specify the correct target path and click Apply.

      If no specific target is added, the entire data store will be scanned.

      The following table lists target paths and syntax to specify them with examples.

      Target Path to ScanSyntaxExample
      Complete data store<Empty_Path>
      All user accounts in a specific group<Group Display Name>TEST_GROUP
      Specific user account in group<Group Display Name>/<User Principal Name>TEST_GROUP/user1@example.onmicrosoft.com
      Specific folder for user account in group (e.g. Calendar, Contacts, Notes etc.)<Group Display Name>/<User Principal Name>/<Mailbox Folder>TEST_GROUP/user1@example.onmicrosoft.com/Inbox
      All user accounts<All Users>All Users
      Specific user account (Recommended for user accounts that do not belong to any group.)< All Users/User Principal NameAll Users/user1@example.onmicrosoft.com
      Specific folder for user account (e.g. Calendar, Contacts, Notes etc.) (Recommended for user accounts that do not belong to any group.)<All Users/<User Principal Name>/<Mailbox Folder>>All Users/user1@example.onmicrosoft.com/Inbox

      Note

      • Target paths are case-sensitive. Target paths can be groups user principal name and specific folders and files.

      • If multiple Microsoft 365 groups with the same display name exist in your domain, then only the first instance of the group will be retrieved. For example, if three groups have the same display name, "TESTGROUP", then the first "TESTGROUP" group for the Exchange Online target will be scanned.

    • Navigate and add target paths.

      1. Click Browse to navigate target paths from the root level.

        Alternatively, provide an initial path in the Add Target Path field and click Browse to navigate targets from that point onward.

      2. In the left pane, navigate and select the desired target path.

      3. Click Add Path to add the target path to the right pane. Similarly, add other target paths.

      4. Click Add.

      Tip

      Either navigate the target paths from the root level (without specifying any path in the Add Target Path field) or make sure you provide the correct path to navigate further locations within it.

  2. Click Next.

Select Profiles

  1. Under Classification Profile Name, select the desired classification profiles to search for in the data store. You can select multiple data stores, if required. Refer to Classification Profiles for details on classification profiles.

  2. Click Next.

Add Filters

This step is optional.

Note

Filters only apply to the scan entities found until the specified folder name in the target path. It doesn't include anything inside that folder or beyond it.

  1. Select the desired filter from the Select Filter drop-down list.

    To filter the locations to scan an Exchange Online data store, consider the following syntax.

    Note

    Exclude locations by prefix, suffix, and expression filters support wildcard characters. See Using Wildcard Characters to learn how wildcards work.

    • Exclude locations by prefix

      Excludes search locations and nested locations with paths that begin with a given string. It can be used to exclude entire directory trees. Specify <string>.

      Filter ItemExample
      GroupAll Users
      User/AccountAll Users/sample@sjcpl.onmicrosoft.com

      Wildcard usage
      *sample@sjcpl.onmicrosoft.com — Applies all paths ending with 'sample@sjcpl.onmicrosoft.com' as prefix.
      FolderAll Users/sample@sjcpl.onmicrosoft.com/inbox

      Wildcard usage
      *inbox — Applies all paths ending with 'inbox' as prefix.

      Note: Folder name is not case-sensitive.
      Attachment
      • All Users/sample@sjcpl.onmicrosoft.com/Inbox/Mail a/2021-02-22T06:40:18Z/maildir-a.zip
      • All Users/sample@sjcpl.onmicrosoft.com/folder_name/subject — This filters out a specific mail and all its content with a corresponding subject name.
      • All Users/sample@sjcpl.onmicrosoft.com/Inbox/Mail a/2021-02-22T06:40:18Z
      Wildcard usage
      • All Users/sample@sjcpl.onmicrosoft.com/Inbox/Mail a/*/maildir-a.zip — Applies all paths starting with 'All Users/sample@sjcpl.onmicrosoft.com/Inbox/Mail a/' and ending with '/maildir-a.zip' as prefix. It is recommended to the use string to avoid manually checking email's date and time and converting it to required format.
      • *maildir-a.zip — Applies all paths ending with 'maildir-a.zip' as prefix. This filters out all data objects with attachment maildir-a.zip.
      • *subject — Applies all paths ending with 'subject' as prefix.

    • Exclude locations by suffix

      Excludes search locations and nested locations with paths that end with a given string. Specify <string>.

      Filter ItemExample
      GroupAll Users* — Applies all paths starting with 'All Users' as suffix.
      User/Accountsample@sjcpl.onmicrosoft.com* — Applies all paths starting with 'sample@sjcpl.onmicrosoft.com' as suffix
      *sample@sjcpl.onmicrosoft.com* — Applies all paths containing 'sample@sjcpl.onmicrosoft.com' as suffix.
      Folderinbox* — Applies all paths starting with 'inbox' as suffix.
      Attachmentmaildir-a.zip

      Wildcard usage
      • All Users/sample@sjcpl.onmicrosoft.com/Inbox/Mail a/*/maildir-a.zip* — Applies all paths starting with 'All Users/sample@sjcpl.onmicrosoft.com/Inbox/Mail a/' and containing '/maildir-a.zip' anywhere in the followed path as suffix
      • *maildir-a.zip* — Applies all paths containing 'maildir-a.zip' as suffix.

    • Exclude locations by expression

      This filter is majorly used with wildcard characters.

      Excludes search locations and nested locations that matches the given expression. Specify <string>.

      For example, to exclude locations that contain 'blob' in their path, use expression *blob*.

      Filter ItemExample
      GroupAll Users* (Use a trailing * to exclude a given location.)
      User/AccountAll Users/sample@sjcpl.onmicrosoft.com* or *sample@sjcpl.onmicrosoft.com*
      FolderAll Users/sample@sjcpl.onmicrosoft.com/inbox* or *inbox*
      Attachment• All Users/sample@sjcpl.onmicrosoft.com/Inbox/Mail a/2021-02-22T06:40:18Z/maildir-a.zip or
      • All Users/sample@sjcpl.onmicrosoft.com/Inbox/Mail a/*\/maildir-a.zip* or
      • *maildir-a.zip*

    • Include locations modified recently

      Includes search locations modified within N number of days from the current date, where the value of N ranges from 1 to 99 days. After selecting this filter, specify Days from current date.

    • Exclude locations greater than file size

      Excludes files that are larger than a given file size (in MB). After selecting this filter, specify the file size in MB.

    • Include locations within modification date

      Includes search locations modified within a given range of dates. After selecting this filter, specify Start and End dates.

  2. Click Apply.

  3. Repeat the above steps to apply multiple filters. Click Remove to remove any applied filter.

  4. Click Next.

Schedule Run

  1. Specify the scan run frequency. The two options are:

    • Manual: This is the default option. Select this option run the scan manually. Select the Run Now check box to start the scan run after you save the changes.

    • Scheduled: Select this option to configure the scan to run automatically at the specified time.

    Refer to Schedule Scan for more details on scheduling scan runs.

  2. Click Save.

Note

API request default quota for SharePoint Exchange Online is 800 per minute. If this limit is exceeded, API request will fail and scan run may encounter different issues.

Unsupported Mailbox Types and Folders

Currently, DDC doesn't support the following mailbox types and folders for the Exchange Online target:

  • Inactive mailboxes

  • Disabled mailboxes

  • Unlicensed mailboxes

On this page