OneDrive Business

This section covers the following topics:

• Overview
• Licensing
• Requirements
• Configure Microsoft 365 Account
  • Generate Client ID and Tenant ID Key
  • Generate Client Secret Key
  • Grant API Access
• Set Up and Scan a OneDrive Business Target
• Edit OneDrive Business Target Path
• OneDrive Business Remediation
• Unsupported Types and Folders in OneDrive Business
• User Account in Multiple Groups

Overview

When OneDrive Business is added as a scan Target, ER2 returns all Microsoft 365 groups and user accounts in each group. You can select specific groups or individual users when setting up the scan schedule, and each group will be presented as a separate location for the OneDrive Business Target.

You can also scan all users with OneDrive Business in your organization's domain by selecting the "All Users" group as a scan location.

Example of OneDrive Business structure: OneDrive Business [domain: example.onmicrosoft.com] +- OneDrive Business on target MSONE:EXAMPLE.ONMICROSOFT.COM +- Group Engineering +- Group Design

Licensing

For Sitewide Licenses, all scanned OneDrive Business Targets consume data from the Sitewide License data allowance limit.

For Non-Sitewide Licenses, OneDrive Business Targets require Client Licenses, and consume data from the Client License data allowance limit.

See Target Licenses for more information.

Requirements

Configure Microsoft 365 Account

For ER 2.6.0 and above, you will need to perform the following setup to scan OneDrive Business Targets:

1. Generate Client ID and Tenant ID Key
2. Generate Client Secret Key
3. Grant API Access

Generate Client ID and Tenant ID Key

1. With your administrator account, log in to the Azure app registration portal.
2. In the App registrations page, click + New registration.

3. In the Register an application page, fill in the following fields:

   Field	Description
   Name	Enter a descriptive display name for ER2. For example, Enterprise Recon.
   Supported account types	Select Accounts in this organizational directory only.

4. Click Register. You will be redirected to the Overview page for the newly registered app, Enterprise Recon.

5. Take down the Application (client) ID and Directory (tenant) ID. This is required when you want to Set Up and Scan a OneDrive Business Target.

   

Generate Client Secret Key

1. With your administrator account, log in to the Azure app registration portal.
2. In the App registrations page, go to the Owned applications tab. Click on the app that you registered (e.g. Enterprise Recon) when generating the Client ID and Tenant ID key.
3. In the Manage panel, click Certificates & secrets.
4. In the Client secrets section, click + New client secret.

5. In the Add a client secret page, fill in the following fields:

   Field	Description
   Description	Enter a descriptive label for the Client Secret key.
   Expires	Select a validity period for the Client Secret key.

6. Click Add. The Value column will contain the Client Secret key.

   

7. Copy and save the Client Secret key to a secure location. This is required when you want to Set Up and Scan a OneDrive Business Target.

   Save your Client Secret key in a secure location. You cannot access this Client Secret key once you navigate away from the page.

Grant API Access

To scan OneDrive Business Targets, you will need to grant ER2 permissions to access specific resource APIs.

1. With your administrator account, log in to the Azure app registration portal.
2. In the App registrations page, go to the Owned applications tab. Click on the app that you registered (e.g. Enterprise Recon) when generating the Client ID and Tenant ID key.
3. In the Manage panel, click API permissions.
4. In the Configured permissions section, click + Add a permission.
5. In the Request API permissions page, select Microsoft Graph > Application permissions.

6. Select the following permissions for the Enterprise Recon app:

   API Permissions	Description
   Group.Read.All GroupMember.Read.All Directory.Read.All Files.Read.All Sites.Read.All	Required for probing and scanning OneDrive Business Targets.
   Files.ReadWrite.All	Required for remediating OneDrive Business Targets.

7. Click Add permissions.
8. In the Configured permissions page, click on Grant admin consent for <organization name>.
9. In the Grant admin consent confirmation dialog, click Yes. The Status column for all the newly added API permissions will be updated to "Granted for <organization name>".

Set Up and Scan a OneDrive Business Target

This section describes how to set up OneDrive Business Targets for ER 2.6.0 and above.

1. Configure Microsoft 365 Account.
2. From the New Scan page, Add Targets.
3. In the Select Target Type dialog box, select Microsoft 365 > OneDrive Business.

4. Fill in the following details:

   

   Field	Description
   OneDrive Domain	Enter the Microsoft 365 domain to scan. Example: example.onmicrosoft.com Only accounts where the user principal name (UPN) shares the same domain as specified in the OneDrive Domain field will be scanned and/or listed when probing the Target. For example, if OneDrive Domain is set to example.onmicrosoft.com, user1@example2.onmicrosoft.com will not be scanned and/or listed when probing the Target even if the user belongs to a group in the example.onmicrosoft.com domain. To scan multiple domains within your organization's Microsoft 365 environment, add these domains as separate OneDrive Business Targets.
   New Credential Label	Enter a descriptive label for the OneDrive Business credential set. Example: m365-onedrive-exampledomain
   Client ID	Enter the Client ID. Example: clientid-1234-5678-abcd-6d05bf28c2bf See Generate Client ID and Tenant ID Key for more information.
   Client Secret Key	Enter the Client Secret key. Example: client~secret.key-CHvV1B5YQfr~6zDjEyv See Generate Client Secret Key for more information.
   Tenant ID	Enter the Tenant ID. Example: tenantid-1234-abcd-5678-02011df316f4 See Generate Client ID and Tenant ID Key for more information.
   Agent to act as proxy host	Select a Windows or Linux Proxy Agent host with direct Internet access.

   Recommended Least Privilege User Approach

   Data discovery or scanning of data requires read access. Remediation actions that act directly on supported file systems including Delete Permanently, Quarantine, Encryption and Masking require write access in order to change, delete and overwrite data.

   To reduce the risk of data loss or privileged account abuse, the Target credentials provided for the intended Target should only be granted read-only access to the exact resources and data that require scanning. Never grant full user access privileges or unrestricted data access to any application if it is not required.

5. Click Test. If ER2 can connect to the Target, the button changes to a Commit button.
6. Click Commit to add the Target.
7. Back in the New Scan page, locate the newly added OneDrive Business Target and click on the arrow next to it to display a list of available Microsoft 365 groups for the domain.
8. Select the Target location(s) to scan:

   1. If "All Users" is selected, ER2 scans all user accounts in the Microsoft 365 domain.

      "All Users" is a default, non-configurable virtual group in ER2 that automatically includes all user accounts in the Microsoft 365 domain. If a similar "All Users" group pre-exists in your Microsoft 365 environment, we recommend that you change the display name for that group as it will be viewed as a duplicate group and will not be displayed in ER2.

   2. If only specific groups are selected, ER2 only scans user accounts in the selected groups.

   For OneDrive Business Target location paths that contain special characters (e.g. "#", "%", "&", etc…), probe the Target to add and scan the location.
9. Click Test. If ER2 can connect to the Target, the button changes to a Commit button.
10. Click Commit to add the Target.

11. (Optional) On the Select Locations page, probe the Target to browse and select specific Target locations to scan.

12. Click Next.
13. On the Select Data Types page, select the Data Type Profiles to be included in your scan and click Next.

14. On the Set Schedule page, configure the parameters for your scan. See Set Schedule for more information.

15. Click Next.
16. On the Confirm Details page, review the details of the scan schedule, and click Start Scan to start the scan. Otherwise, click Back to modify the scan schedule settings.

Edit OneDrive Business Target Path

1. Set Up and Scan a OneDrive Business Target.

2. In the Select Locations section, select your OneDrive Business Target location and click Edit.

   For OneDrive Business Target location paths that contain special characters (e.g. "#", "%", "&", etc…), probe the Target instead to add and scan the location.

3. In the Edit OneDrive Business dialog box, enter a (case sensitive) Path to scan. Use the following syntax:

   Folder to Scan	Path
   All user accounts in all groups	Syntax: All Users Example: All Users
   All user accounts in a specific group	Syntax: <Group Display Name> Example: Engineering (SG)
   Specific user account in group	Syntax: <Group Display Name>/<User Principal Name> Example: Engineering (SG)/user1@example.onmicrosoft.com
   Specific folder for user account in group	Syntax: <Group Display Name>/<User Principal Name>/<Folder> Example: Engineering (SG)/user1@example.onmicrosoft.com/ProjectA
   Specific file for user account in group	Syntax: <Group Display Name>/<User Principal Name>/<Folder>/<File> Example: Engineering (SG)/user1@example.onmicrosoft.com/ProjectA/example.html

   If there are multiple Microsoft 365 groups with the same display name in your domain, ER2 will only retrieve the first group occurrence. For example, if there are three groups with the same display name, "Engineering", ER2 will only probe, scan and return results for the first "Engineering" group for the OneDrive Business Target.
4. Click Test and then Commit to save the path to the Target location.

OneDrive Business Remediation

The following remediation actions are supported for OneDrive Business Targets:

• Act Directly on Selected Location

  • Mask all sensitive data
  • Delete Permanently
  • Quarantine
• Mark Locations for Compliance Report
• PRO Delegated Remediation

Unsupported Types and Folders in OneDrive Business

ER2 does not support scanning of the following types and folders for the OneDrive Business Target:

• Notebooks. To scan the Notebooks folder, set up and scan the Microsoft OneNote Target instead.
• OneNote file types and folders stored in OneDrive Business but outside the default Notebooks folder. To scan these files and notebook folders, set up and scan the Microsoft OneNote Target instead.
• Recycle bin.
• User's Preservation Hold library.

User Account in Multiple Groups

A OneDrive Business-enabled user account that belongs to multiple groups

• is scanned each time a group the user belongs to is scanned.
• consumes only 1x data allowance usage regardless of how many times it is scanned as part of different groups.