Arctera™ Data Insight

February 2025
Arctera Data Insight
Legal Notice
Copyright ©2025 Arctera US LLC. All rights reserved.

Arctera and the Arctera Logo are trademarks or registered trademarks of Arctera US LLC
or its affiliates in the U.S. and other countries. Other names may be trademarks of their
respective owners. This product may contain third-party software for which Arctera is
required to provide attribution to the third party (“Third-party Programs”). Some of the
Third-party Programs are available under open source or free software licenses. The License
Agreement accompanying the Software does not alter any rights or obligations you may
have under those open source or free software licenses. Refer to the Third-party Legal
Notices document accompanying this Arctera product or available at:

https://www.arctera.io/license-agreements

The product described in this document is distributed under licenses restricting its use,
copying, distribution, and de-compilation/reverse engineering. No part of this document
may be reproduced in any form by any means without prior written authorization of
Arctera US LLC and its licensors, if any.

THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED

CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED
WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR
NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH
DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. ARCTERA US LLC SHALL NOT BE
LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH
THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE
INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE
WITHOUT NOTICE.

The Licensed Software and Documentation are deemed to be commercial computer software
as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19
"Commercial Computer Software - Restricted Rights" and DFARS 227.7202, et seq."
Commercial Computer Software and Commercial Computer Software Documentation," as
applicable, and any successor regulations, whether delivered by Arctera as on premises or
hosted services. Any use, modification, reproduction release, performance, display or
disclosure of the Licensed Software and Documentation by the U.S. Government shall be
solely in accordance with the terms of this Agreement.

Arctera US LLC | www.arctera.io

Technical Support
Technical Support maintains support centers globally. Technical Support’s primary
role is to respond to specific queries about product features and functionality.
The Technical Support group also creates content for our online Knowledge Base.
The Technical Support group works collaboratively with the other functional
areas within the company to answer your questions in a timely fashion.
Our support offerings include the following:
■ A range of support options that give you the flexibility to select the right
amount of service for any size organization
■ Telephone and/or Web-based support that provides rapid response and
up-to-the-minute information
■ Upgrade assurance that delivers software upgrades
■ Global support purchased on a regional business hours or 24 hours a day, 7
days a week basis
■ Premium service offerings that include Account Management Services
For information about our support offerings, you can visit our website at the
following URL:
www.arctera.io/support
All support services will be delivered in accordance with your support agreement
and the then-current enterprise technical support policy.

Contacting Technical Support

Customers with a current support agreement may access Technical Support
information at the following URL:
www.arctera.io/support
Before contacting Technical Support, make sure you have satisfied the system
requirements that are listed in your product documentation. Also, you should be
at the computer on which the problem occurred, in case it is necessary to replicate
the problem.
When you contact Technical Support, please have the following information
available:
■ Product release level
■ Hardware information
■ Available memory, disk space, and NIC information
 ■ Operating system
■ Version and patch level
■ Network topology
■ Router, gateway, and IP address information
■ Problem description:
■ Error messages and log files
■ Troubleshooting that was performed before contacting Technical Support
■ Recent software configuration changes and network changes

Licensing and registration

If your product requires registration or a license key, access our technical support
Web page at the following URL:
www.arctera.io/support

Customer service
Customer service information is available at the following URL:
www.arctera.io/support
Customer Service is available to assist with non-technical questions, such as the
following types of issues:
■ Questions regarding product licensing or serialization
■ Product registration updates, such as address or name changes
■ General product information (features, language availability, local dealers)
■ Latest information about product updates and upgrades
■ Information about upgrade assurance and support contracts
■ Advice about technical support options
■ Nontechnical presales questions
■ Issues that are related to CD-ROMs, DVDs, or manuals
Support agreement resources
If you want to contact us regarding an existing support agreement, please contact
the support agreement administration team for your region as follows:

Worldwide [email protected]
 Contents

Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Chapter 1 About Arctera Data Insight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

About Arctera Data Insight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Chapter 2 Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
About Arctera Data Insight Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Storage Utilization Trends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Chapter 3 Workspace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
About Arctera Data Insight Workspace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Chapter 4 Installing Collector Node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

About Collector node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Downloading and Installing Arctera Data Insight Collector . . . . . . . . . . . . . . . . . 26

Chapter 5 Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
About servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Chapter 6 Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Filers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Adding filers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Viewing configured filers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Editing filer configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Managing filers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Monitored Shares . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
About disabled shares . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
 Contents 7

SharePoint Online . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
About SharePoint Online account monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Registering Data Insight with Microsoft to enable SharePoint
Online account monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Configuring application without user impersonation for Office
365 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Creating an application in the SharePoint Admin Center . . . . . . . . . . . . . . 51
Add SharePoint Online accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Managing Site Collections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Monitored Site Collections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
OneDrive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Configuring OneDrive account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Registering Data Insight with Microsoft to enable OneDrive
account monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Configuring application without user impersonation for Office
365 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Add/Edit OneDrive account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Monitored Cloud Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

Chapter 7 Directory Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

About Active Directory Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Registering Data Insight with Microsoft to scan Azure AD . . . . . . . . . . . . . . . . . . 70
Add/Edit Azure active directory service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Chapter 8 Health and Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

Scan Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

Chapter 9 Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Setting up Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

Chapter 10 File Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

About File group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

Configuring File group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

Chapter 11 Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
About Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
 Contents 8

Chapter 12 Workflows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Workflows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Chapter 13 Data Remediation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

Delete Files Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

Chapter 14 Users and Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Users and Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
 Chapter 1
About Arctera Data Insight
This chapter includes the following topics:

■ About Arctera Data Insight

About Arctera Data Insight

Understanding Arctera Data Insight
Many organizations struggle with identifying data users and owners for their
unstructured data. This challenge is compounded with the fact that organizations
lack visibility into the types of content and data that is spread across their
computing environment.
With Arctera Data Insight, users can monitor file access to automatically identify
the data user of a file based on the access history. This method enables more
efficient remediation and data management.
Data Insight scans the unstructured data systems and collects full access history
of users across the data. It helps organizations monitor and report on access to
sensitive information.
Data Insight provides the following information:
■ Who is responsible for remediation
■ Who has access to the data
■ What data is most at-risk
■ Frequency of usage of data
■ Access details on folders and files
■ Data custodians to remediate risks
■ Identify obsolete and stale data
 About Arctera Data Insight 10
About Arctera Data Insight

■ Identify obsolete and stale data

The ownership and the usage information from Data Insight can be used for the
following purposes:
■ Data custodian identification
Data Insight enables the assignment of one or more users as custodians of a
data repository. Custodian tagging is typically used to determine the person
responsible for remediation. The assigned custodian need not have made any
accesses on the files and folders. Assigning custodian is a recommended action.
When you create any workflow, it will be sent to the assigned custodian for
approval. A task will be created for the assigned custodian and only after
custodian's approval, the workflow will be executed. If you assign a custodian
at the Data Source level, it will be inherited by all files and folders listed under
that data source. If you do not want specific folder to inherit custodian, you
can assign a different custodian by following the same procedure. When you
assign a custodian
■ Content classification
Data Insight lets you classify content by providing means to define
classification rules (policies) that let you specify values (tags) that you can
assign to any matching items. The classification feature works in conjunction
with the policy framework provided by Arctera Insight Classification to assign
tags to files. For example, a content scan may search for items whose contents
include a credit card number and assign a tag of "PII" (for "personally
identifiable information") to any that do.
■ Data Ageing
Data becomes stale if it is not updated frequently. This can happen when you
do not have regular processes to classify your data. The lack of timely updates
may lead to storing of outdated information, resulting in ineffective business
strategies.Data Insight flags obsolete and stale data, helping you in identifying
and cleaning outdated data.
 Chapter 2
Dashboard
This chapter includes the following topics:

■ About Arctera Data Insight Dashboard

■ Storage Utilization Trends

About Arctera Data Insight Dashboard

The Dashboard page provides a snapshot of your entire environment. You can
visualize insights of all the data that has been processed and show different
statistics. When you log in to Data Insight, you will land on this page by default.
This page will have multiple tiles.

Title and information about each tile is as follows:

 Dashboard 12
About Arctera Data Insight Dashboard

■ Monitored Content, which shows the total size of storage that is being
monitored. You can see the storage trend as a percentage, indicated by an
upward or downward arrow, below the total size of the monitored content.
■ Devices, which displays total devices or accounts that are being monitored.
■ Repositories, which displays number of Shares, Sites or Accounts that are
being monitored.
■ Scan, which shows number of files scanned till date.
■ Sensitive Content, which displays number of files with classification tags.

■ Top Data Sources tile will list your top data sources and their details like
number of files, storage utilization and classification tags attached to the
device. In the Storage Utilization column, you can see the storage trend as a
percentage, indicated by an upward or downward arrow. For more
information, See “Data Sources” on page ?.
After clicking More Information at the bottom of this tile, you will be redirected
to the Data Sources page.

■ Potential Redundant Data will provide information about redundant data

based on the file groups and file types. You can monitor and delete unwanted
files from the devices. You can filter or sort the data by selecting File Size or
File Count from the drop-down.
 Dashboard 13
About Arctera Data Insight Dashboard

■ File Aging gives you information about last accessed time of the files. If the
file was not accessed for last 3 years, it will be marked as Obsolete. If the file
was not accessed over 6 months but was accessed in 3 years will be marked
as Stale. If the files was accessed in last 6 months, it will be marked as Active.
File Aging is computed every midnight and you can generate a report to know
more details.
You can use drop-downs on the tile to select specific data source, either file
size or count, and select either all files or files with sensitive data. Once you
select desired values, the information on the tile will be updated accordingly.
 Dashboard 14
About Arctera Data Insight Dashboard

■ Access Intelligence will provide information about the activities (audit events)
executed on registered M365 devices. You can filter the data by time or by
sensitive data. The color bar will display information about the type of event,
total number of events and comprehensive file or folder count.
 Dashboard 15
Storage Utilization Trends

■ Data Remediation will display number of active workflows and tasks. To

modify existing data or to complete a task, you can navigate to Workflows
tab and create a workflow to assign a ownership or delete existing files.
After clicking More Information at the bottom of this tile, you will be redirected
to the Workflows page.

Note: Only User and Server Administrator roles will have access to the
dashboard

If there is no device added, a message will appear on the page. Click Add Device
on the page to configure a device and start using Data Insight

Storage Utilization Trends

The Storage Utilization Trends feature provides insights into data growth by
displaying how much data has increased compared to earlier amounts, allowing
for a clear view of trends over the last 30 days.
 Dashboard 16
Storage Utilization Trends

This feature allows users to track data growth by comparing the current data
volume with a previous baseline, helping to identify patterns of expansion.
Whether monitoring storage usage, database sizes, or other data metrics, it equips
users with clear, actionable information on how much the data has increased
within a specific time-frame. Such tracking is crucial for planning, capacity
management, and understanding system or application behavior over the last 30
days.
 Chapter 3
Workspace
This chapter includes the following topics:

■ About Arctera Data Insight Workspace

■ Data

■ Users

■ Groups

About Arctera Data Insight Workspace

The Workspace tab is available only to the Server Administrator and users with
valid credentials. You can view all the information about Data Sources,
Repositories, Folder, Files, Users, and Groups in this tab.

Data
This tab provides in-depth analysis of the configured data sources. The Data tab
will enable you to view the file system hierarchy and analytics for configured
data sources. You can assign a custodian, export the details or refresh the table
from this page.
The Summary section on the right side will display all details of the configured
data source. Refer to the following table for more information.

Device Type Type of device like Generic, OneDrive or

SharePoint.

Size On Disk Size of saved files. This field will not be

available for OneDrive and SharePoint data
source.
 Workspace 18
Data

Size Size of files. This option is available only for

SharePoint and OneDrive data sources. This
excludes the recycle bin stage 1 and stage 2
data for Sharepoint.

Recycle Bin Cumulative size of all files in Stage 1 and

Stage 2 recycle bin of the SharePoint Site
Collection. This option is available only for
SharePoint data source at repository level.

Files Total number of files.

Repositories Total number of repositories.

Folders Total number of folders.

Sensitive files Total number of sensitive files, which will

be updated after classification. A file is
considered sensitive if it has one or more
classification tags.

Custodian Details of the custodian

Activity Summary Period of activity. It is 7 days by default, but

you can change the period by using the
drop-down.

Tags Names and number of tags associated with

the data source/repositories/folder/file.

On folder and file level, there are more details in the Summary. Refer to the
following table for more information.
 Workspace 19
Data

Device Name Name of the device

Size Size of the file/folder.

Repository Name Name of the parent repository

Sensitive Yes / No

Inherited From If the custodian is inherited from data source

or folder level.

Created on Time of creating file or folder

Accessed on Last accessed time

Accessed By Name of the user who accessed it

Modified on Last modified time

Modified By Name of the user who modified it

Classified on Time of last classification

Created By Name of the user who created it

On the same page, you can view, filter, and download audit events by clicking
the Audit Activities tab. You can find detailed information about each event in
the filter, allowing you to see which task was performed and by which user.
Audit events will also play a crucial role in identifying and resolving any issues
related to a specific data source. Audit events of last 30 days appear by default.
The date range can be changed using the filter. The start and end dates for fetching
audit events can not be more than 365 days. Detailed report of audit events can
be downloaded by clicking the Download icon.
 Workspace 20
Data

If you apply filter in Audit Activities, you can have multiple options to sort data.
Use Operations drop-down to select audit action like create, write or write. You
can check the Sensitive Files Only check-box to fetch audit reports of sensitive
only. You can also specify start and end date.
Click Apply and list of audit activities, as per your selected values will appear in
the section.
 Workspace 21
Data

Note: The Audit Activities feature is available for SharePoint and OneDrive data
sources only

On the Workspace > Data tab:

■ Select a data source and click Actions drop-down to assign a custodian, classify
(at repository level), delete files (at file level), export the details or refresh the
table.
■ To assign a custodian, select a path and click Assign Custodian. A Create
Workflow pop-up will appear. Enter a unique name, description, select a user
to be assigned as a custodian from the drop-down and click Save. When you
assign a custodian, a workflow and task is created. You can check the status
for the same in the Workflows tab. For more information, See “Workflows”
on page 89.

Note: Assigning custodian is a recommended action. When you create any

workflow, it will be sent to the assigned custodian for approval. If you assign
a custodian at the Data Source level, it will be inherited by all files and folders
listed under that data source. If you do not want specific folder to inherit
custodian, you can assign a different custodian by following the same
procedure. Assigning custodian at file level is not supported.

■ After clicking Actions drop-down, select Delete Files to delete files from the
data source. Enter a unique name and description. If you want to use already
assigned custodian, check the Use assigned custodian box. If you check the
box, existing custodian will be used in this workflow. Click Save to create a
workflow. Once the workflow is created, a task will be created for the
custodian and only after custodian approves that task, file will be deleted
from the data source.

Note: To delete files, you must setup delete configuration and enable it for this
action to work.

■ Use the Search bar to search the list by name.

■ Use the toggle selection icon to display or hide columns.
■ The Summary section will be available for data sources, repositories, folders
and files.
■ Click the plus sign to drill down to repository /folder/file level and see more
details.
 Workspace 22
Users

■ At Data Source/Share /file/ folder level, you can click Actions to export the
table data or refresh the table. If you click Export on any level, all files and
folders at that level will be exported in the CSV format. For SharePoint data
sources, exported file at repository level will have an additional recycle bin
size column.
■ At repository /folder/file level, you can click Actions to classify the selected
paths or to export and refresh the data. If you select files or folders and click
Classify, a Classification Configuration pop up will appear. Classify only
new or modified files option will be selected by default. This option will
enable you to classify only modified files but if you want to classify all files,
uncheck the box. Click Classify to proceed.

Users
The Users tab will enable you to view a list of users for the configured directory
services. You can search a particular user by using the Search box at the top. You
can also sort users alphabetically by clicking column header Name.
For detailed information about the user, click Expand Profile in the right pane.
 Workspace 23
Groups

All details about the user like Name, Login Name, and Email appear in the
Summary tab. Additional information like if the user is Disabled or Deletedwill
appear in the same section on the right side. If the user is disabled or deleted, the
entry will be marked in red with a strike-through. Click Audit Activities to view
all audit entries for all the shares assigned to the user. You can download the
details or filter the data using respective options in the tab.

If you click >> next to the Search by Name field, Deleted and Disable filters will
appear on the page. You can check the required box and list of deleted or disabled
users will be visible in the right pane.

Groups
The Groups tab will enable you to view a list of groups associated with the
configured directory services. You can search a particular group by using the
Search box at the top. You can also sort groups alphabetically by clicking column
header Name.
Group Name and current status of the group, is it Disabled or Deleted, will appear
in the Summary section on the right side. If the group is disabled or deleted, it
will be marked in red with a strikethrough.
For detailed information about a particular group, click Expand Profile in the
right pane.
 Workspace 24
Groups

All details about the group like Name, SID, Member of groups, Users and other
group details appear on the page. You can also find additional information like
if the group is part of any other group or member of this group are part of any
other groups.
 Chapter 4
Installing Collector Node
This chapter includes the following topics:

■ About Collector node

■ Downloading and Installing Arctera Data Insight Collector

About Collector node

The Collector node scans data source and collects access events from the data
sources SharePoint, OneDrive or generic devices. Data Insight uses this
information to perform advanced reporting on the business owners of data and
the access history of the data. By scanning for file metadata and security
descriptors, it reports on the loopholes of permissions on files and folders. The
details that are captured by the collector node also help you find stale and orphan
files in the scanned data repositories.
The Collector node enables you to collect and parse access events from various
storage repositories. The Collector examines the access events available on these
storage systems to parse the events that report the read, write, create, delete,
and rename activity on files or folders. The access events are processed in batches
that consist of several thousand events. Each batch of events that are collected
in a cycle is stored in a separate file with appropriate timestamp that indicates
the ending time of the last entry in that batch. This data is pruned based on
exclude rules or events that are not from the configured shares, site collections
or equivalent data sources, and is then segregated on a per-share basis.
 Installing Collector Node 26
Downloading and Installing Arctera Data Insight Collector

Downloading and Installing Arctera Data Insight

Collector
To download and install Arctera Data Insight,
1 Visit https://www.veritas.com/content/support/en_US/downloads
2 Search the list by Veritas Alta Archiving and expand Base and Upgrade
installers section.
3 Download and save
ArcteraDataInsight_collector_windows-x64_1_0_0_<version>.exe file.
4 Double click and run the .exe file.
Installation wizard will appear on the screen.
 Installing Collector Node 27
Downloading and Installing Arctera Data Insight Collector

5 After brief interval, Setup pop-up appears on the screen. Click Next.

6 On the License Agreement pop-up, review and select I accept the agreement
radio button and click Next.
 Installing Collector Node 28
Downloading and Installing Arctera Data Insight Collector

7 On the Configuration Details pop-up, check if the destination directory is

C:\Program Files\ArcteraDataInsight. You can also change the installation
directory as per your choice.
 Installing Collector Node 29
Downloading and Installing Arctera Data Insight Collector

8 On the Configuration Details pop-up, check if the data directory is

C:\DataInsight\data. You can change the data directory later.
 Installing Collector Node 30
Downloading and Installing Arctera Data Insight Collector

9 On the Configuration Networking pop-up, check if Scheduler service port

number is 443 and Classification client service port number is 8383 and
click Next.
 Installing Collector Node 31
Downloading and Installing Arctera Data Insight Collector

10 On the Cloud Agent Configuration Details pop-up, select the Arctera

DataInsight Data Center from the drop-down, enter Username and Password,
and click Next. The data center, username and password will be provided
by Data Insight
 Installing Collector Node 32
Downloading and Installing Arctera Data Insight Collector

11 On the Cloud Scheduler Service Details pop-up, add FQDN/IP shared by

Arctera. Do not change the Scheduler Service Port in Cloud, which is 443
by default. Click Next.

Installation process will be initiated.

 Installing Collector Node 33
Downloading and Installing Arctera Data Insight Collector

12 On Services pop-up, check if Start Arctera Data Insight Collector Services

now box is checked and click Next.
13 Click Finish on the Completing the Setup Wizard to complete the installation
process.

Once you complete the process, the installed server will appear in the Servers
tab. See “Servers” on page 35.

Post-installation
Steps to verify that Data Insight has been installed properly.
■ Check if following services are running
■ ArcteraDataInsightSchedulerService
■ ArcteraDataInsightTokenManagerService
■ ArcteraDataInsightVICClientService
■ ArcteraDataInsightVICServerService

■ Check if C:\ArcteraDataInsight\data\cloudconfig.properties is showing a

non-zero Tenant ID.
 Installing Collector Node 34
Downloading and Installing Arctera Data Insight Collector

■ Log in to Data Insight with Admin user credentials. Click Servers tab in the
left pane. Newly installed on-prem collector agent name should be visible.
■ Check the following Log locations and confirm that there is no error.
■ <InstallDIR>\log\scheduler\schedulerservice.log
■ <InstallDIR>\log\tokenmanager\tokenmanager.log
■ <InstallDIR>\log\vicclient\vicclient.log
■ <InstallDIR>\log\vic.log

Uninstalling Data Insight Collector Agent

To uninstall Data Insight from the Collector Agent
1 Log in to the Windows machine on which Collector Agent is installed.
2 Navigate to the install directory. For example C:\Program
Files\ArcteraDataInsight and double click uninstall.exe.
3 On the confirmation page, click Next.
4 On the Delete Data page, uncheck the box only if you want to retain any
product data.
5 Click Begin Uninstall
6 After completing the uninstall process, click Finish.
You can also uninstall by going to Add/Remove Programs, search Arctera Data
Insight 1.0.0.<version> and clicking Uninstall.
 Chapter 5
Servers
This chapter includes the following topics:

■ About servers

■ Servers

About servers
To monitor on-premises data sources, you’ll need to deploy Arctera Data Insight
collectors on servers within your environment. This approach ensures data
sovereignty by scanning, classifying, and monitoring your on-premises data
sources entirely within your infrastructure. The collectors communicate with
the Arctera Data Insight cloud-based management pane to maintain and update
the metadata index. You can manage connected servers and monitor their health
using the server module.

Servers
You can perform multiple actions on the installed servers by clicking Servers in
the left pane. List of the installed servers, along with Server Name, Role and
Update status is visible on this page. If there are multiple servers installed, you
can search specific server by typing the name in the Search bar and pressing
enter. You can also refresh the list by using the refresh icon next to the search
bar.
 Servers 36
Servers

Click Server Name or click server to know more details. The Server Information
page will have Server Name, Role and Product Update information.
By clicking the Actions menu on the right side, and clicking View, you can view
details like roles assigned to the server, server name and product update. You
can also remove server from your environment by clicking Delete. However,
even if you remove the server virtually from the interface, you need to manually
uninstall it from the environment to complete the process. After clicking Delete,
a pop-up will appear on the screen which will have details about uninstalling it
manually.

Click Yes and uninstall the server manually by following the steps. Before
initiating delete, make sure that there are no devices connected to the server. If
there are any devices connected, you will not be able to delete the server from
your environment. Once you initiate delete action, Data Insight will validate the
details and remove the server only after successful validation.
 Servers 37
Servers

Note: If you restart the Scheduler service on the collector server node, then
server re-registers itself with cloud node automatically and it will start appearing
on the Servers page. So, if you delete a server from this page, make sure that you
uninstall the collector.
 Chapter 6
Data Sources
This chapter includes the following topics:

■ Data Sources

■ Filers

■ SharePoint Online

■ OneDrive

Data Sources
A data source is a location or system that stores and manages data. A data source
can refer to the digital location where data can be stored as a data table, data
object, or another storage format, which can be used to analysis, processing, and
classifying.
Data Insight currently supports following data sources:
■ Generic device
■ SharePoint
■ OneDrive

Filers
Add New Generic Device
Data Insight supports scanning varied file systems for generic devices.
The Filers page will list all the configured generic device. You can click the Action
menu on the right to View, Edit, Delete or Disable an existing generic device.
 Data Sources 39
Filers

Credentials required for scanning a generic device

Table 6-1 Credentials for scanning a generic device

Credential Details

Credentials required for scanning of shares. Required for scanning of shares from the
filer.

When scanning CIFS shares, this credential

belongs to the user in the domain of which
the filer a part. While the exact set of
permissions depends on the generic device
being scanned, this user must generally
belong to the Administrator's group on the
device.

Typically, to scan CIFS shares, you must

have the share-level READ permission.
Additionally, the folder within the share
must have the following file system ACLs
enabled for the scan credential:
■ Traverse Folder/Execute File
■ List Folder/Read Data
■ Read Attributes
■ Read Extended Attributes
■ Read Permissions

Adding filers
You must add filers that you want Arctera Data Insight to monitor.
To add filers
1 In the console, click Data Sources and click sub menu Filers in the left pane.
The Filers page displays the list of configured filers.
2 On the Filers page, click Add New Generic Device.
3 On the Add New Generic Device pop-up. Refer to the table for details.
 Data Sources 40
Filers

Field Details

Filer hostname or IP address Enter the hostname or IP address of the filer

that you want to monitor.

Enable CIFS Monitoring Check the box to monitor CIFS shares.

Filer administrator credentials Select the credentials from the drop-down.

Discover shares automatically Check the box if you want Data Insight to
discover newly added shares. You can also
exclude specific shares by adding it in the
provided space.

Enable Filer Scanning This box will be selected by default. It is

recommended not to uncheck the box.

Scanner credentials Select scanner credentials from the

drop-down.

Scanning Schedule The option will be selected be default. You

will not be able to deselect it.

After entering the required information, click Save to complete the process.

Viewing configured filers

To view configured filers
1 In the left pane, click Data Sources > Filer.
The list of configured filers appears on the page.
2 Review the following information about the filers:
■ The name of the filer.
■ The number of shares monitored by the filer.
■ The type of filer. Only generic devices are supported currently.
■ Status of the filer.
■ The Collector node for the filer.
■ The scanning schedule for the filer.

Editing filer configuration

After you add a filer to Data Insight, you can edit the filer's configuration. For
example, you might need to edit any of the following:
 Data Sources 41
Filers

■ The IP address or hostname of the filer.

■ Administrator Credentials for the Filer.
■ The IP address or hostname of the Collector worker node configured to scan
the filer.
■ The scanner credentials.

To edit filer configuration,

1 In the left pane, click Data Sources > Filer.
List of available filers appears.
2 Click the filer you want to edit or click the Action menu on the right side of
the filer and click Edit .
3 Make the necessary changes.
4 Click Save to complete the process.

Changing the Collector

It is recommended that you initiate migration during the maintenance window.
Prior to initiating the collector migration, make sure the following conditions are
met:
■ There is a low latency network connectivity between the filer and the new
collector.
■ There is a low latency network connectivity between the old and the new
collector.
■ There is enough storage space on the new collector.

To change the Collector,

1 In the left pane, click Data Sources > Filer.
2 Click the filer or click the Action menu on the right side of the filer and click
Edit .
3 On the Connections Details dialogue, click Change Collector.
4 Select the radio button next to the desired collector and click Confirm.
5 Click Save on the Connections Details dialogue.
You can identify the changed collector on the Filers page.

Managing filers
On the Filer Details page, you can view detailed information about a configured
filer. To go to the Filer Details page, click Data Sources > Filer in the left pane.
 Data Sources 42
Filers

Click the filer that you want to review or click Action menu next to the filer and
click View.
The Configuration tab on the filer details page displays the following information
about a filer:
You can view, edit or disable the filer by navigating to Filers and clicking the
filer or clicking the Action menu on the right side.
You can view events specific to the configured filer such as the status of scans
on the filer.
To disable a filer
1 Follow the path given above and click Disable.
2 Click OK on the confirmation message.
Once you disable a filer, no new scan will be triggered. Data for already scanned
shares will be visible for the disabled filers.

Monitored Shares
To monitor configured shares, click Filers in the left pane and click configured
device. On the filer details page, click Monitored Shares. On this page, all shares
are listed with details like Share Name, Type, Status, and Scanning Schedule.
You can perform various operations on individual or multiple shares. You can
scan, enable and disable shares by selecting the required share/s and using menu
options or Actions menu on the right side of shares. You can also set discovery
of new shares by configuring it at the filer level.
Next to the menu options, there is a Search bar to search share by name. This
option will help you in finding the required share quickly, when the list contains
very large number of shares. You can also refresh the list and toggle selection
list by using subsequent options next to the search bar.
 Data Sources 43
SharePoint Online

To review filer details

1 In the left pane, click Data Sources > Filer.
2 Click the filer that you want to review or click Action menu next to the filer
and click View.
The filer configuration details page appears. You can check Connection
Details, Scanner Details, and Monitoring Details.
3 Click Monitored Shares for reviewing share details.
On this page, you can perform following operations on each share by clicking
the share or by clicking Action menu next to the share.
■ Scan
■ Disable

About disabled shares

You can enable/disable shares by checking the box and clicking respective options
on the top ribbon. If you enable the disabled share(s), a new full scan will be
initiated.

SharePoint Online
Data Insight provides the ability to monitor the unstructured data that resides
in SharePoint Online, a cloud-based service from Microsoft. Data Insight discovers
the site collections configured for that account. You can also configure Data
Insight to exclude certain site collections from being monitored. This might be a
requirement when you have personal data that you do not want to be monitored.

About SharePoint Online account monitoring

The SharePoint Online storage hierarchy consists of account, site collection, sites,
or document or picture library. Data Insight logically maps to these descendants
as filers, repository, and folders or files.
Data Insight scans the site collections and the sites in the hierarchy to collect the
metadata properties such as the file creation date or created by.
Data Insight scans the sites and document libraries available in a SharePoint
Online account.
You must perform the following steps to enable Data Insight to monitor a
SharePoint Online account:
 Data Sources 44
SharePoint Online

■ Configure an administrator account in SharePoint Online (in Office 365); make

sure that this administrator account has full control over the site collections
and is an owner for team site collections. Data Insight uses this account to
impersonate a user account to query the site collections.
■ Make sure that the site collections are configured for the SharePoint Online
account. You can configure Data Insight to automatically discover the site
collections.

■ When adding a SharePoint Online account, Data Insight excludes the following
site collections from getting discovered.
■ <companyname>.sharepoint.com/portals/community
■ <companyname>.sharepoint.com/search
■ <companyname>.sharepoint.com/sites/CompliancePolicyCenter
■ <companyname>-my.sharepoint.com

Prerequisites for configuring SharePoint Online account

For Data Insight to access the SharePoint Online account, make sure that the
following prerequisites are met:
■ Ensure you have sufficient network connectivity for configuration.
■ Ensure that you are aware of the SharePoint Online Account Administration
Center Site URL that you want Data Insight to monitor.
■ The Minimum Privileged user account is configured in the Office 365 admin
center. This account should have administrative privileges on the target site
collections and should be an owner for team site collections.
■ Enable auditing in Microsoft 365 Admin Center.
To enable auditing, in Microsoft 365 Admin Center navigate to Security and
Compliance > Search and investigation > Audit log search. Click Start
recording user and admin activities.
Note that it takes 24 hours for the audit logs to start appearing on the Audit
log search page.

Registering Data Insight with Microsoft to enable SharePoint Online

account monitoring
To authorize Data Insight to access the Microsoft SharePoint Online account, you
must create an application and register it with Microsoft Azure Active Directory.
This step involves associating a set of credentials with the application and
providing the application with the required permissions, which enables
communication between Data Insight and Microsoft. This step also creates an
 Data Sources 45
SharePoint Online

authorization token that is stored as a named credential in the Data Insight

configuration.
To create and register an application with Microsoft
1 Login as a global admin user or minimum privilege user to
https://portal.azure.com/#home and search App Registrations.
2 On the Register an application page, enter a desired name for the app.
3 In Supported account types select Accounts in this organizational directory
only (<organization-name> only - Single tenant)
4 On the Register an application page, click Register to register the app.
(Redirect URI can be provided later.)
Your new application is created and the app Overview page is displayed.
5 Copy-save the Application (Client ID) and Directory (Tenant) ID. You will
be required to provide it later while adding an account in Data Insight.
6 On the left sidebar of your app dashboard, click Certificates and Secrets.
7 In the Client secrets section, click New client secrets to generate the access
token required for calling the required APIs
8 Set the expiry to 180 days and click Add.
9 Copy the Client Secret Value is generated. You will be required to provide
it later while adding an account in Data Insight.
10 Then you need to grant permissions to the app to use the Microsoft Graph
and Microsoft 365 APIs.
On the left sidebar of your app, click API permissions, and then click Add
a permission.
 Data Sources 46
SharePoint Online

11 On the Request API permissions panel that opens, select Microsoft Graph
and Microsoft 365 respectively, click Application permissions and grant
the permissions as per the table given below:

API Permission name

Microsoft Graph Files.Read.All

Group.Read.All

RoleManagement.Read.Directory

Sites.Read.All

User.Read.All

Files.ReadWrite.All

SharePoint

Sites.ReadWrite.All

Microsoft 365 Management APIs ActivityFeed.Read

ActivityFeed.ReadDlp

SharePoint Sites.FullControl.All

Note: As per Microsoft guidelines, while using minimum permissions

application, few advanced permissions like limited access permissions given
to Limited Access System Group for the folder, permissions of sites, Site
collections, Document Library will not be visible. To fetch those permission,
add Sites.FullControl.All scope to MS Application

12 Then click Grant admin consent for.., and confirm.

13 Now add the redirect URI. For example, https://datainsight.us3.archive.
veritas.com/api/SharePoint/spOnline

Go to the Overview page of the app and click Add redirect URI. The
Authentication page opens
14 Click Add a platform
15 On the Configure platforms panel that opens, click Web
16 Click Configure to save it.
Once the app is created, anybody in the organization can access the app. As per
Microsoft recommendation, restrict the access to specific users.
 Data Sources 47
SharePoint Online

For information on how to require the user assignment for an app via the Azure
portal, refer to Configure an application to require user assignment Azure
documentation
For information on how to assign users or groups to an app via the Azure portal,
refer to Assign users to an app Azure documentation

Configuring application without user impersonation for Office 365

Setting DisableCustomAppAuthentication property for the
tenant
To set the property DisableCustomAppAuthentication,
1 Install Module Pnp.Powershell using command in PowerShell Install-Module
-Name PnP.PowerShell on the same machine where you have registered
Data Insight with Microsoft in the earlier section.
2 Run the command Register-PnPManagementShellAccess and provide
credentials of Global Administrator Account

Note: This step is done to provide PnP PowerShell Authentication with Service
Principal. If we do not do this then we will get error : Connect-PnPOnline :
AADSTS65001: The user or administrator has not consented to use the
application with ID'31359c7f-bd7e-475c-86db-fdb8c937548e' named 'PnP
Management Shell'. Send an interactive authorization request for this user
and resource
 Data Sources 48
SharePoint Online

3 Copy the following script in Notepad and save it as

DisableCustomAppAuthentication.ps1 file.

param (
[parameter(Mandatory=$true)]
[string]$Organization)

Import-Module PnP.PowerShell
$url = 'https://'+$Organization+'-admin.sharepoint.com'
Write-Output $url
$userCredential = Get-Credential
Connect-PnPOnline -Url $url -Credential $userCredential
get-PnPTenant
Set-PnPTenant -DisableCustomAppAuthentication $false

Note: This is required for normal functioning of fetching of Advanced

Permission, classification of data and scanning local user for SharePoint
Online and OneDrive.

4 Run the script using .\DisableCustomAppAuthentication.ps1

5 When prompted, provide organization name.

6 In the Windows Powershell Credential Request pop up, provide Global
Administrator credentials and click Ok
7 In the list of output, verify if the CustomAppAuthentication property is set
to False.
After configuring application, you need to add the created application to the
lookup
To add created application to the lookup,
1 Copy the Client ID of the app created in the Azure portal App
2 Navigate to
https://<organization-name>-admin.sharepoint.com/_layouts/15/appinv.aspx
3 Paste the Client ID copied from the Azure portal App in the App Id field
4 Click Lookup
5 Add localhost.com in the App Domain field
6 Add https://localhost.com/default.aspx in the Redirect URL field
 Data Sources 49
SharePoint Online

7 Add following XML in the App's Permission Request XML

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest Scope="http://sharepoint/content/tenant"

Right="FullControl"/>

</AppPermissionRequests>
 Data Sources 50
SharePoint Online

8 Click Create
9 Click Trust It
You will be redirected to the SharePoint admin center.

Configuring an administrator account for Data Insight

Data Insight uses a Global administrator account to discover the site collections
and scan metadata and a SharePoint administrator account to fetch the access
events from the configured SharePoint Online account. Global administrator
accounts must have full control over the site collections that you want Data
Insight to monitor. You must configure the Global administrator, as owner for
team site collections, on the Office 365 interface and assign the administrative
privileges for the target site collections.
To add a SharePoint administrator
1 Log on to Office 365 using the Global admin credentials.
2 On the SharePoint admin center page, click Users > Active users > Add a
user.
The New User pop-up windows opens.
3 Enter the name of the user and other properties as appropriate.
4 In the Roles section, select Customized administrator > SharePoint
administrator.
5 Click Add.
The SharePoint administrator account collects metadata about site collection
content , and gathers audit data from SQL Server databases for SharePoint when
it is assigned administrative privileges for the target site collections. It must also
have full control permissions on the configured site collections and the site
collections that are incrementally included to the SharePoint account. For team
site collections, the SharePoint administrator should be an owner.
The Minimum Privilege user has access to all features in the Admin center and
can perform all tasks in the Office 365 Admin center.
To assign owners for team site collections
1 On the SharePoint admin center page, go to Groups > Groups, and select the
Group Name to which you want to assign owners.
2 In the Group details pane on the right-hand-side, click Edit for the Owners
entry.
 Data Sources 51
SharePoint Online

3 In the Edit pane, click Add owner and select a user having Minimum Privilege
user credentials.
4 Click Save.

Creating an application in the SharePoint Admin Center

To create an application in the SharePoint Admin Center,
1 Copy the Client ID of the app created in the Azure portal App
2 Navigate to
https://<organization-name>-admin.sharepoint.com/_layouts/15/appinv.aspx
3 Paste the Client ID copied from the Azure portal App in the App Id field
4 Click Lookup
5 Add localhost.com in the App Domain field
6 Add https://localhost.com/default.aspx in the Redirect URL field
 Data Sources 52
SharePoint Online

7 Add following XML in the App's Permission Request XML

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest Scope="http://sharepoint/content/tenant"

Right="FullControl"/>

</AppPermissionRequests>

8 Click Create
9 Click Trust It
You will be redirected to the SharePoint admin center.
 Data Sources 53
SharePoint Online

Add SharePoint Online accounts

Click Data Sources > SharePoint, to open SharePoint page. On this page,
configured SharePoint accounts will be listed. You can see SharePoint Online
Account URL, number of monitored site collection and status. Click the Action
menu to view, edit or disable the configured account.

The configuration details page appears. You can check Connection Details, Site
Collections Configuration, and Scanning Details. Click Monitored Site
Collections to see the site collection details. You can select site collection for
SharePoint Online and initiate scan, discover, enable or disable shares from this
tab.
To add a new SharePoint Online account
1 In the left pane, click Data Sources > SharePoint.
The SharePoint page displays the list of configured Online accounts.
2 Click Add SharePoint Online Account.
 Data Sources 54
SharePoint Online

3 Use the dialog box to add a new SharePoint Online account to Data Insight.
Refer the table below for details:

4 Click Save after adding required details.

Table 6-2 Add/Edit SharePoint Online account options

Field Description

SharePoint Online Account Enter the SharePoint Online URL that you want Data Insight
URL to monitor. For example,
https://myaccount.sharepoint.com
 Data Sources 55
SharePoint Online

Table 6-2 Add/Edit SharePoint Online account options (continued)

Field Description

Client ID The client ID is the unique application ID assigned when

you create and register an app with Microsoft. You can add
Client Secret Key
up to 5 client IDs.
Tenant ID
Client Secret Key: In the SharePoint App, navigate to the
Certificates & secrets page. There is a code in the Value
column under the Client secret section. You need to use
that code as a Client Secret Key while configuring a
SharePoint account in Data Insight.

Tenant ID: This is the unique application ID assigned to an

organization

If you have missed copying the code, go back to the

Certificates & secrets page in the SharePoint app and click
+ New client secret. Copy the code in the Value column
and use it as a Client Secret Key in Data Insight.

You can add up to 5 apps. Follow the procedure described

in the following topic to get these details:
Note: Microsoft servers might briefly block certain client
credentials for initiating frequent requests. In such scenarios,
Data Insight fails to retrieve data from the Microsoft servers.
To eliminate such delay, you can add up to 5 client
credentials to the SharePoint Online account. If one client
credential is blocked by Microsoft, another client credential
will be used to fetch data.

Add one client ID, Client Secret Key, authorize the app and
click Add More Apps to add another set of client
credentials.
 Data Sources 56
SharePoint Online

Table 6-2 Add/Edit SharePoint Online account options (continued)

Field Description

Authorize access Do the following:

1 Click Authorize. This invokes the application

authorized to access the SharePoint Online account.
Note: Ensure that you use the credentials of a Office
365 user with Microsoft Global administrator role for
authorizing Data Insight.

This step creates an authorization token that is stored

as a named credential in the Data Insight configuration.
You will be redirected to the Data Insight console to
complete the rest of the configuration.

2 Data Insight can access folder and file metadata and

the information about the activities performed on
these files and folders.

Note: After authorization, do not update the same set of

client and secret key.

Automatically discover and This check box is selected by default. This option allows
add site collections in this you to automatically include all site collections in the
SharePoint Online account selected SharePoint Online account for the purpose of
monitoring.

Clear the check box to add site collections manually. You

can do this from the SharePoint Online account details page.

Discovery of site collections takes place as soon as you add

a SharePoint Online account and then at 2:00 AM every
Saturday.

Exclude following site Enter the details of the site collections which should not be
collections from discovery included during discovery.

This option is available when you select Automatically

discover and add site collections in the added SharePoint
Online Accounts. Specify comma separated patterns that
you want to ignore. Patterns can have 0 or more wildcard
* characters.

For example, https://onlineaccount1/sites/test* ignores site

collections https://onlineaccount1/sites/testsite1 and
https://onlineaccount1/sites/testsite2.

Enable Scanning for this This check box will be selected by default and option will
SharePoint Online account be grayed out.
 Data Sources 57
SharePoint Online

Table 6-2 Add/Edit SharePoint Online account options (continued)

Field Description

Monitor SharePoint accesses This check box will be selected by default and option will
to this SharePoint Online be grayed out.
account

Managing Site Collections

After the site collections are added, you can view the configured site collection,
modify the properties of the site collection, start an unscheduled scan of the site
collection, delete the site collection, view the event log or scan history of the site
collection.
To manage Site Collections,
1 Navigate to Data Sources > SharePoint
2 If you want to manage site collections at account level, click the Action menu
in line.
3 You can view, edit, enable, or disable the account.
4 To know more about the configuration details, click the online account link
and you will be redirected to the Configuration page.
5 This page will display information about Connection Details, Site Collections
Configuration and Scanning Details.
6 If you want to manage site collections at share level, click the online account
link.
7 After clicking the link, you will be redirected to the configuration page.
8 Click Monitored Site Collections.
9 You can perform multiple actions like scan, discover, enable and disable from
this page. You can also use the Action menu next to each share for same
operations. You can also find out discovered shares, and their scanning
schedule.

Monitored Site Collections

To monitor site collections, click SharePoint in the left pane and click SharePoint
Online account. On the SharePoint Online details page, click Monitored Site
Collections. On this page, all Site / Site Collection are listed with details like Title,
URL, Status, and Scanning Schedule.
 Data Sources 58
OneDrive

You can perform various operations on individual or multiple sites. You can
enable or disable Site / Site Collection by selecting the required site/s and using
menu options on the top ribbon or Actions menu on the right side of shares. If
you enable already disabled site, full scan will be initiated. You can also initiate
incremental scan or discover site collections from this page. In case of scanning,
you can opt to scan selected or all filtered records.
Next to the menu options, there is a Search bar to search site by name. This option
will help you in finding the required site quickly, when the list contains very
large number of sites. You can also refresh the list and toggle selection list by
using subsequent options next to the search bar.
You can sort the list alphabetically by clicking the arrow next to Title.

OneDrive
Data Insight monitors Microsoft OneDrive cloud accounts to provide information
about who owns the data, and what data should be archived or deleted. OneDrive
uses the Open Authorization 2 (OAuth2) protocol to permit access to a third-party
application.
In the Data Insight configuration, the OneDrive tenant account (your organization's
OneDrive account) corresponds to a file server and the individual user accounts
correspond to repository on a Data Source. To scan the OneDrive tenant account
and the underlying user accounts, Data Insight uses the access token provided
by the Microsoft app. To get the access token from the app, you must provide
the credentials of an Office 365 Minimum Privilege user on the redirect URL
page.

Click Data Sources > OneDrive, to open OneDrive page. On this page, configured
OneDrive accounts will be listed. You can see OneDrive Account URL, number
of monitored account and status. Click the Action menu to view, edit, enable or
disable the configured account.
 Data Sources 59
OneDrive

Configuring OneDrive account

About configuring OneDrive account monitoring
Data Insight monitors Microsoft OneDrive cloud accounts to provide information
about who owns the data. OneDrive uses the Open Authorization 2 (OAuth2)
protocol to permit access to a third-party application.
Data Insight scans the OneDrive account for metadata such as path of the file or
folder, created by, modified by, and modified date for the OneDrive user accounts.
In the Data Insight configuration, the OneDrive tenant account (your organization's
OneDrive account) corresponds to a file server and the individual user accounts
correspond to repositories on a Data Source. To scan the OneDrive tenant account
Data Insight uses the access token provided by the Microsoft app. To get the
access token from the app, you must provide the credentials of an Office 365
Minimum Privilege user on the redirect URL page.

Registering Data Insight with Microsoft to enable OneDrive account

monitoring
To authorize Arctera Data Insight to access the Microsoft OneDrive account, you
must create an application and register it with Microsoft Azure Active Directory.
This step involves associating a set of credentials with the application and
providing the application with the required permissions, which enables
communication between Data Insight and Microsoft.

Prerequisite
An Office 365 user with the Microsoft Global administrator role or with a role
which has lesser admin privileges than the Global administrator can create and
register an application with Microsoft. However, the user must be granted the
following four roles at the minimum:
1. Application Administrator : To create a Microsoft application
2. User Administrator: To get the access to OneDrive account of all the users
in tenant
 Data Sources 60
OneDrive

3. SharePoint Administrator: To fetch the data in OneDrive and SharePoint

Online
4. Privileged Role Administrator: To give admin consent to Azure Application
5. A custom role (View-Only Audit Logs) in the Exchange Admin Center

Note: To assign the first three roles, refer to the Azure documentation and to
create a custom role (View-Only Audit Logs), access Azure Portal with Global
Administrator credentials and create a custom role (View-Only Audit Logs) and
assign it to the created user .

To create and register an application with Microsoft

1 Login as a global admin user or minimum privilege user to
https://portal.azure.com/#home and search App Registrations.
2 On the Register an application page, enter a desired name for the app.
3 In Supported account types select Accounts in this organizational directory
only (<organization-name> only - Single tenant)
4 On the Register an application page, click Register to register the app.
(Redirect URI can be provided later.)
Your new application is created and the app Overview page is displayed.
5 Copy-save the Application (Client ID) and Directory (Tenant) ID. You will
be required to provide it later while adding an account in Arctera Data Insight.
6 Copy-save the . You will be required to provide it later while adding an
account in Arctera Data Insight.
7 On the left sidebar of your app dashboard, click Certificates and Secrets.
8 In the Client secrets section, click New client secrets to generate the access
token required for calling the required APIs
9 Set the expiry to Never and click Add.
10 Copy the Client Secret Value is generated. You will be required to provide
it later while adding an account in Arctera Data Insight.
11 Then you need to grant permissions to the app to use the Microsoft Graph
and Office 365 APIs.
On the left sidebar of your app, click API permissions, and then click Add
a permission.
12 Then click Grant admin consent for.., and confirm.
 Data Sources 61
OneDrive

13 On the Request API permissions panel that opens, select Microsoft Graph
and Office 365 respectively, click Application permissions and grant the
permissions as per the table given below:

API Permission name

Microsoft Graph Files.Read.All

Group.Read.All

RoleManagement.Read.Directory

Sites.Read.All

User.Read.All

Office 365 Management APIs ActivityFeed.Read

ActivityFeed.ReadDlp

SharePoint Sites.FullControl.All

Note: As per Microsoft guidelines, while using minimum permissions

application, few advanced permissions like limited access permissions given
to Limited Access System Group for the folder, permissions of sites, accounts,
Document Library will not be visible. To fetch those permission, add
Sites.FullControl.All scope to MS Application

14 Now add the redirect URI.

Go to the Overview page of the app and click Add redirect URI. The
Authentication page opens
15 Click Add a platform
16 On the Configure platforms panel that opens, click Web
17 Click Configure to save it.
Once the app is created, anybody in the organization can access the app. As per
Microsoft recommendation, restrict the access to specific users.
For information on how to require the user assignment for an app via the Azure
portal, refer to Configure an application to require user assignment Azure
documentation
For information on how to assign users or groups to an app via the Azure portal,
refer to Assign users to an app Azure documentation
 Data Sources 62
OneDrive

Configuring application without user impersonation for Office 365

Setting DisableCustomAppAuthentication property for the
tenant
To set the property DisableCustomAppAuthentication,
1 Install Module Pnp.Powershell using command in PowerShell Install-Module
-Name PnP.PowerShell on the same machine where you have registered
Data Insight with Microsoft in the earlier section.
2 Run the command Register-PnPManagementShellAccess and provide
credentials of Global Administrator Account

Note: This step is done to provide PnP PowerShell Authentication with Service
Principal. If we do not do this then we will get error : Connect-PnPOnline :
AADSTS65001: The user or administrator has not consented to use the
application with ID'31359c7f-bd7e-475c-86db-fdb8c937548e' named 'PnP
Management Shell'. Send an interactive authorization request for this user
and resource

3 Copy the following script in Notepad and save it as

DisableCustomAppAuthentication.ps1 file.

param (
[parameter(Mandatory=$true)]
[string]$Organization)

Import-Module PnP.PowerShell
$url = 'https://'+$Organization+'-admin.sharepoint.com'
Write-Output $url
$userCredential = Get-Credential
Connect-PnPOnline -Url $url -Credential $userCredential
get-PnPTenant
Set-PnPTenant -DisableCustomAppAuthentication $false

Note: This is required for normal functioning of fetching of Advanced

Permission, classification of data and scanning local user for SharePoint
Online and OneDrive.

4 Run the script using .\DisableCustomAppAuthentication.ps1

5 When prompted, provide organization name.

 Data Sources 63
OneDrive

6 In the Windows Powershell Credential Request pop up, provide Global

Administrator credentials and click Ok
7 In the list of output, verify if the CustomAppAuthentication property is set
to False.
After configuring application, you need to add the created application to the
lookup
To add created application to the lookup,
1 Copy the Client ID of the app created in the Azure portal App
2 Navigate to
https://<organization-name>-admin.sharepoint.com/_layouts/15/appinv.aspx
3 Paste the Client ID copied from the Azure portal App in the App Id field
4 Click Lookup
5 Add localhost.com in the App Domain field
6 Add https://localhost.com/default.aspx in the Redirect URL field
 Data Sources 64
OneDrive

7 Add following XML in the App's Permission Request XML

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest Scope="http://sharepoint/content/tenant"

Right="FullControl"/>

</AppPermissionRequests>
 Data Sources 65
OneDrive

8 Click Create
9 Click Trust It
You will be redirected to the SharePoint admin center.

Configuring an administrator account for Data Insight

Data Insight uses a Global administrator account to discover the site collections
and scan metadata and a SharePoint administrator account to fetch the access
events from the configured SharePoint Online account. Global administrator
accounts must have full control over the site collections that you want Data
Insight to monitor. You must configure the Global administrator, as owner for
team site collections, on the Office 365 interface and assign the administrative
privileges for the target site collections.
To add a SharePoint administrator
1 Log on to Office 365 using the Global admin credentials.
2 On the SharePoint admin center page, click Users > Active users > Add a
user.
The New User pop-up windows opens.
3 Enter the name of the user and other properties as appropriate.
4 In the Roles section, select Customized administrator > SharePoint
administrator.
5 Click Add.
The SharePoint administrator account collects metadata about site collection
content , and gathers audit data from SQL Server databases for SharePoint when
it is assigned administrative privileges for the target site collections. It must also
have full control permissions on the configured site collections and the site
collections that are incrementally included to the SharePoint account. For team
site collections, the SharePoint administrator should be an owner.
The Minimum Privilege user has access to all features in the Admin center and
can perform all tasks in the Office 365 Admin center.
To assign owners for team site collections
1 On the SharePoint admin center page, go to Groups > Groups, and select the
Group Name to which you want to assign owners.
2 In the Group details pane on the right-hand-side, click Edit for the Owners
entry.
 Data Sources 66
OneDrive

3 In the Edit pane, click Add owner and select a user having Minimum Privilege
user credentials.
4 Click Save.

Add/Edit OneDrive account

You must add the OneDrive account that you want to monitor to the Data Insight
configuration.
Use this dialog box to add a new OneDrive account to Data Insight or to edit the
configuration of an existing OneDrive account.
To add OneDrive account, click Data Sources > OneDrive, click Add OneDrive
Account and add information as given in the table below.

Table 6-3 Add/Edit OneDrive account options

Field Description

Microsoft This is a free-form field. Enter a name that Data Insight uses to identify
OneDrive account your OneDrive account. The name that you enter in this field
name represents the name of the OneDrive tenant account.

Client ID The client ID is the unique application ID assigned when you create
and register an app with Microsoft. You can add up to 5 client IDs .
Client Secret Key
Client Secret Key: In the OneDrive App, navigate to the Certificates
Tenant ID
& secrets page. There is a code in the Value column under the Client
secret section. You need to use that code as a Client Secret Key while
configuring a OneDrive account in Data Insight.

Tenant ID: This is an unique ID assigned to an organization

If you have missed copying the code, go back to the Certificates &
secrets page in the SharePoint app and click + New client secret.
Copy the code in the Value column and use it as a Client Secret Key
in Data Insight.

You can add up to 5 client secret keys. Follow the procedure described
in the following topic to get these details:
Note: Microsoft servers might briefly block certain client credentials
for initiating frequent requests. In such scenarios, Data Insight fails
to retrieve data from the Microsoft servers. To eliminate such delay,
you can add up to 5 client credentials to the OneDrive Online account.
If one account is blocked by Microsoft, another client credential will
be used to fetch data.

Add one client ID, Client Secret Key, authorize the app and click Add
More Apps to add another set of client credentials.
 Data Sources 67
OneDrive

Table 6-3 Add/Edit OneDrive account options (continued)

Field Description

Authorize access Do the following:

1 Click Authorize. This invokes the application authorized to access

the OneDrive account. .
Note: Ensure that you use the credentials of an Office 365 user
with Microsoft Global administrator role for authorizing Data
Insight.

This step creates an authorization token that is stored as a named

credential in the Data Insight configuration. You will be
redirected to the Data Insight console to complete the rest of the
configuration.

2 Data Insight can now access the user, folder and file metadata
and the information about the activities performed on these file
and folders. .

Discover cloud Select the check box to automatically discover all user accounts that
accounts are part of the OneDrive account.
automatically
Discovery of cloud user accounts takes place as soon as you add a
new user account.
Note: By default, discovery for new cloud accounts will happen every
Saturday at 2 AM.

Exclude following Enter the details of the cloud user accounts which should not be
cloud accounts included during discovery. This option is available when you select
from discovery Discover cloud accounts automatically check box. Specify comma
separated patterns that you want to ignore. Patterns can have 0 or
more wildcard * characters.

Enable Microsoft This box will be checked by default and it will be greyed out.
OneDrive account
scanning

Scanning schedule Default scanning schedule will be selected.

for full scans
Data Insight periodically scans the OneDrive account to obtain file
metadata and security descriptors. Full scan of OneDrive accounts
will start at 7:00 PM on last Friday of each month and incremental
scan will commence at 2.00 AM every day.
 Data Sources 68
OneDrive

Monitored Cloud Accounts

In the Console, click Data Sources in the left pane and sub option OneDrive.
Click the configured account that you want to review. On the details page, click
Monitored Cloud Accounts. On this page, all cloud accounts are listed with details
like Cloud Account Name, Status, and Scanning Schedule.
You can perform various operations on individual or multiple cloud accounts.
You can scan, discover, enable, disable or delete cloud accounts by selecting the
required account/s and using menu options or Actions menu on the right side of
every account.
Next to the menu options, there is a Search bar to search the list by Cloud Account
Name. This option will help you in finding the required account quickly, when
the list contains very large number of accounts. You can also refresh the list and
toggle selection list by using subsequent options next to the search bar.
 Chapter 7
Directory Services
This chapter includes the following topics:

■ About Active Directory Services

■ Registering Data Insight with Microsoft to scan Azure AD

■ Add/Edit Azure active directory service

About Active Directory Services

Data Insight periodically scans the configured directory service domains in your
organization to fetch information about users and user groups. Data Insight
correlates this information with file and folder access logs to provide access and
usage reports. The time it takes to scan a directory service domain depends on
the number of users and groups in the domain.
You can view this scanned active directory users and groups under Workspace
> Users or Workspace > Groups tab.
Click Directory Services in the left pane to view the configured Azure Active
Directory. You can add Azure Active Directory, initiate a partial scan, check the
scan schedule or search the domain by name from this page. You can also click
the Action menu on the right side to edit connection details and client credentials
or enable/disable active directory.
 Directory Services 70
Registering Data Insight with Microsoft to scan Azure AD

Registering Data Insight with Microsoft to scan Azure

AD
To authorize Data Insight to scan Azure AD, you must create an application for
every Data Insight installation and register it with Microsoft Azure Active
Directory. This step involves associating a set of credentials with the application
and providing the application with the required permissions, which enables
communication between Data Insight and Microsoft. This step also creates an
authorization token that is stored as a named credential in the Data Insight
configuration.

Prerequisite
A Office 365 user with the Microsoft Minimum privilege user role or with a role
which has lesser admin privileges than the Minimum privilege user can create
and register an application with Microsoft. However, the user must be granted
the following four roles at the minimum:
1. Application Administrator : To create a Microsoft application
2. User Administrator: To get the access to OneDrive account of all the users
in tenant
3. SharePoint Administrator: To fetch the data in OneDrive and SharePoint
Online
4. Privileged Role Administrator: To give admin consent to Azure Application
5. A custom role (View-Only Audit Logs) in the Exchange Admin Center
To assign the first three roles, refer to the Azure documentation.
 Directory Services 71
Registering Data Insight with Microsoft to scan Azure AD

To create and assign the View-Only Audit Logs role to a non-Global admin user
1 Login to Microsoft Admin Portal with the Minimum privilege user role,
navigate to Exchange Admin Center and click Classic Exchange Admin
Center in the left pane.

2 Click Permissions > Admin roles and click the + icon to create a new role.
The Role Group pop-up opens.
3 In the Role Group pop-up, enter a desired role name (ex. AuditReadRole).
 Directory Services 72
Registering Data Insight with Microsoft to scan Azure AD

4 In the Roles section, click + and select the role "View-Only Audit Logs" and
click OK.
 Directory Services 73
Registering Data Insight with Microsoft to scan Azure AD

5 In the Members section, click + and select the member that you want to
assign the minimum privilege role.

6 After selecting the member, click OK and then click Save.

To create and register an application with Microsoft
1 Login as a global admin user or minimum privilege user to
https://portal.azure.com/#home and search App Registrations.
2 On the Register an application page, enter a desired name for the app.
3 In Supported account types select Accounts in this organizational directory
only (<organization-name> only - Single tenant)
4 On the Register an application page, click Register to register the app.
(Redirect URI can be provided later.)
Your new application is created and the app Overview page is displayed.
5 Copy-save the Application (Client ID) and Directory (Tenant) ID. You will
be required to provide it later while adding an account in Data Insight.
6 Copy-save the . You will be required to provide it later while adding an
account in Data Insight.
7 On the left sidebar of your app dashboard, click Certificates and Secrets.
 Directory Services 74
Registering Data Insight with Microsoft to scan Azure AD

8 In the Client secrets section, click New client secrets to generate the access
token required for calling the required APIs
9 Set the expiry to Never and click Add.
10 Copy the Client Secret Value is generated. You will be required to provide
it later while adding an account in Data Insight.
11 Then you need to grant permissions to the app to use the Microsoft Graph
and Office 365 APIs.
On the left sidebar of your app, click API permissions, and then click Add
a permission.
12 Then click Grant admin consent for.., and confirm.
13 Now add the redirect URI.
Go to the Overview page of the app and click Add redirect URI. The
Authentication page opens
14 Click Add a platform
15 On the Configure platforms panel that opens, click Web
16 Provide the Data Insight Management Server IP address, as a redirect URI
in the following format: https://datainsight.us3.archive.veritas.com
/api/DirectoryServices/azureADRedirect

For more details, refer

https://docs.microsoft.com/en-us/azure/active-directory/develop/reply-url.
You can authenticate using FQDN in the redirect URL by setting node Level
property.
To set the node Level property,
■ Navigate to Settings > Servers and click the configured Management
Server and then click Advance Settings tab.
■ In the Advance Settings tab, clickSet custom properties
■ In the Property Name box, add node.azure.ad.auth.via.fqdn
■ In the Property Value box, add true
■ Click Save and Close.

Note: Property value should be set to true for authenticating via FQDN
and false for authenticating via IP.

If you want to modified any existing property value,

 Directory Services 75
Add/Edit Azure active directory service

■ change the redirect URI in the Azure App accordingly.

■ Delete the cookie from
<DATA_DIR>\connectors\sponline\cookie\dataStore on the collector
node.
■ Re-authorize the application.

17 Click Configure to save it.

18 On the same page, set theSupported account types to Accounts in any
organizational directory (Any Azure AD directory - Multitenant).
Once the app is created, anybody in the organization can access the app. As per
Microsoft recommendation, restrict the access to specific users.
For information on how to require the user assignment for an app via the Azure
portal, refer to Configure an application to require user assignment Azure
documentation
For information on how to assign users or groups to an app via the Azure portal,
refer to Assign users to an app Azure documentation

Add/Edit Azure active directory service

To add Azure AD, click Directory Services in the left pane and click Add Azure
AD
Use this dialog box to add Azure active directory service to Data Insight.

Table 7-1 Add/Edit Azure active directory service

Field Description

Azure Active Enter the name of the active directory that you want to scan.
Directory Name

Client ID The client ID is the unique application ID assigned when you create
and register an app with Microsoft. You can add up to 5 client IDs.
 Directory Services 76
Add/Edit Azure active directory service

Table 7-1 Add/Edit Azure active directory service (continued)

Field Description

Client Secret Key Client Secret Key: In the Azure active directory, navigate to the
Certificates & secrets page. There is a code in the Value column under
the Client secret section. You need to use that code as a Client Secret
Key while configuring Azure active directory in Data Insight.

If you have missed copying the code, go back to the Certificates &
secrets page in the Azure active directory and click + New client
secret. Copy the code in the Value column and use it as a Client Secret
Key in Data Insight.

You can add up to 5 client secret keys. Follow the procedure described
in the following topic to get these details:
Note: Microsoft servers might briefly block certain client credentials
for initiating frequent requests. In such scenarios, Data Insight fails
to retrieve data from the Microsoft servers. To eliminate such delay,
you can add up to 5 client credentials to the Azure active directory.
If one account is blocked by Microsoft, another client credential will
be used to fetch data.

Add one client ID, Client Secret Key, authorize the app and click Add
More Apps to add another set of client credentials.

Tenant ID Tenant ID: This is an unique ID assigned to an organization

Authorize Do the following:

1 Click Authorize. This invokes the application authorized to access

the Azure active directory.
Note: Ensure that you use the credentials of a Office 365 user
with Microsoft minimum privilege user role for authorizing Data
Insight.

2 Data Insight can fetch users and groups present in Azure active
directory.

Note: After authorization, do not update the same set of client and
secret key.

Remove App Click Remove App to remove the application from your account.

If you are editing Azure active directory service, you will not be able to change
the Tenant ID. However, Data Insight allows you to add more applications and
change the following:
■ Azure Active Directory Name
 Directory Services 77
Add/Edit Azure active directory service

■ Client ID
■ Client Secret key
■ Re-authorize or remove existing application
 Chapter 8
Health and Monitoring
This chapter includes the following topics:

■ Scan Status

Scan Status
The Scan Status tab provides an overview of the status of the scans for all storage
devices that are being monitored by Arctera Data Insight. The scans include the
scans running on the configured data sources like SharePoint online or generic
device.

On the Scan Status tab:

■ Use the Search bar to search the list by name.
■ Click the Refresh icon to refresh the list.
■ Use the toggle selection icon to select the list columns.
 Health and Monitoring 79
Scan Status

This page will help you in finding out granular details about every individual
scan. It will have information like status, start time, total time taken for completing
the scan, scan type ( full or incremental), and origin of the scan (auto or manual).

Note: In case of SharePoint Online and OneDrive: After adding a device, first
scan will be a full scan.

Refer to the table below to know more about the scan schedules and types.

Data Source Scan Schedule Scan Type

SharePoint 7 PM every alternate Friday Full

OneDrive 7 PM every alternate Friday Full

 Chapter 9
Classification
This chapter includes the following topics:

■ Requests

■ Configuration

■ Setting up Classification

Requests
To view all classification requests, click Classify in the left pane and click
Requests. This page lists all the classification requests with the subsequent details
like Submitted files, Classified files, Tagged File Size, Status and so on. If there
are multiple requests, you can search specific request using the Search bar at the
top of the page. You can click the Refresh icon to refresh the list and use the
toggle selection icon to select the list columns.
Status messages and description is as follows:

Field Description

Pending The classification request is in queue.

In-progress The classification request is in progress.

Success The classification request has been

completed successfully.

Partial-Success Some files are classified and few files failed

to classify.

Failed The classification request failed for some

reason.
 Classification 81
Requests

Note: Only Server Administrator has permissions to configure classify action.

This page will also enable you to Cancel classification request, Download Failed
Paths in CSV format, and reclassify failed paths by clicking the Action menu on
the right.

Depending on the nature of your classification request, use Workspace or

Classification tab for creating a request.
■ Classification tab
■ For creating a request using CSV file.

■ Workspace tab
■ For repository, folder or file level request.

To create request using a CSV file,

1 In the left pane, click Classification and click sub tab Requests below that.
2 Click Create Request Using CSV
3 A dialog box appears. Select the file by clicking Choose file. Ensure that the
file paths adhere to the format that is provided in the CSV template.
Alternatively, you can download the CSV template and make the necessary
changes.
 Classification 82
Configuration

4 Classify only new or modified files since last classification time box will
be checked by default. If checked, only the new or modified files since last
classification run will be classified. Uncheck the box to classify all available
files.
5 Click Upload File to submit the classification requests.
To initiate classification from the Workspace tab,
1 Navigate to Workspace tab.
2 Click + sign next to the data source.
3 If you want to initiate classification at the folder level, select desired folder
or folders.
4 For selecting files, click + next to the folder and select file or files.
5 Click Actions and select Classify.
6 Classify only new or modified files since last classification time box will
be checked by default. If it is checked, only the new or modified files will be
classified. Uncheck the box to classify all available files. It is recommended
to opt for this option as classification process will consume considerably
more time for classifying all available files.
7 Click Classify.

Configuration
This page will display classification configuration settings. Check Enable
Classification to enable classification of the configured data source. Note that
large files (50 MB or more) will not be classified.
You can select file groups that you want to exclude from classification requests
by clicking the drop-down and selecting required groups. The file extensions
excluded in file groups will not be downloaded for classification.

On-Premise Safeguard Settings

You can specify the threshold for disk space utilization in terms of size. It means
when the disk storage reaches the specified percentage, then On Premise Collector
worker node will pause the downloading process.
The collector node initiates the disk space safeguard mode if the free disk space
falls under the configured thresholds, then collector will pause the content
download. Similarly when the free disk space increases above threshold, collector
will resume the content download. You can edit the threshold limits, but we
strongly recommend against changing the default values.
 Classification 83
Setting up Classification

For specifying Safeguard Settings, navigate to Classification in the left pane and
then click Configuration.

Setting up Classification
For more information about setting up classification, click Steps for setting up
classification
 Chapter 10
File Groups
This chapter includes the following topics:

■ About File group

■ Configuring File group

About File group

File group support in Data Insight will help the users to filter data as per the
selected file groups. This filtered data will be used for report generation.

Note: Only Server Administrator will be able to create and manage file group.

Configuring File group

By default, Data Insight will have predefined file groups based on the extension
of the files. You can use the existing file groups but you will not be able to modify
or delete these file groups. If you want some extensions from the file group but
want to remove unwanted ones, copy the predefined file groups and save it by
another name. You can then modify the extensions and create a file group as per
your requirement. You can create a completely new custom file groups and add
required extensions in it. All custom file groups are editable. You can add or
modify extensions or delete those file groups entirely.
The File Groups page will list all predefined file groups. You can see the details
like Name, Type and Extensions.
 File Groups 85
Configuring File group

To add new file group,

1 Click File Groups in the left pane.

2 Click Add New File Group.

3 Enter a logical unique name for the file group.
4 In the Extension field, enter the extension that you want to include in the
file group and click Add Extension.
You can add multiple file extensions to a single file group.

Note: Do not add . while adding the extension. If you want to add pdf or
jpeg, do not add .pdf or .jpeg. Add pdf or jpeg only. In addition to this, note
that extension with * . and _ are not supported. For example _501 or _eml

5 Click Save after adding the required extensions.

The newly created file group will appear on the File Groups page. You can
see Name, Type, and number of Extensions for individual file group.
6 Click the arrow next to the file group to view or delete extensions.

Note: You can delete extensions from custom file group only.

7 You can add Extensions, copy or delete the custom file group by clicking
Action menu on the right.
You can create multiple file groups, as per the data your sources are expected to
generate. Using the predefined file groups or creating custom file groups will help
in report generation and excluding unsupported extensions while classification.
For more details
To know more about Reports See “About Reports” on page 86.
 Chapter 11
Reports
This chapter includes the following topics:

■ About Reports

About Reports
The Reports page will display list of all requests. It will display details like Run
Id, Name, Description, Label,Status, Start Time and End time. You can filter
columns headers like Name, Description or Label by clicking the Toggle Selection
List icon at the top right corner of the page. The File List Report will have list of
files based on the filters applied during report creation.
After a request is successful, click the Action menu and click Download to
download the file or click Delete to delete the request.

Note: Download option will be available only for successful requests.

 Reports 87
About Reports

To Generate File List Report,

1 Click Generate File List Report on the top pane.

2 In the Report Configuration pop-up, select required Data Sources,

Repositories and Classification Tags from the drop-down in the left pane.
When you select any option from the drop-down, other options associated
with that selection will appear in other tabs. For example, if you select a data
source, only repositories and classification tags associated with that data
source will available for selection in other two tabs. In case you select
repository or classification tags, remaining two tabs will display applicable
options only. You can click Clear at the bottom to remove all previous
selections.
 Reports 88
About Reports

3 Enter the required details in the right pane. From the File Group
Configuration section, you can include or exclude file groups by selecting
File Groups from the drop-down.
4 Check the Share with users box if you want to share this report with all
users in the selected file group. If unchecked, only the report creator has
access to the report.
5 Click Submit to complete the process.
Once you create a report, it will be visible on the Reports page. You can download
or delete the report by clicking the Action menu on the right.
 Chapter 12
Workflows
This chapter includes the following topics:

■ Workflows

■ Task

Workflows
This page lists all the workflows created in the Workspace tab. You can view
details like Name, Type, Status, Start Time on this page. You can select columns
like Name, Description or Start Time by clicking the Toggle Selection List icon
at the top right corner of the page.

Note: Only the Server Admin can monitor workflow status from this page.

You can search a particular workflow by using the Search box at the top. You
can search by Name, Description, Status and Created By fields.
You can also click Action menu next to the workflow to view more details,
download or delete the workflow.
To know more, See “About Arctera Data Insight Workspace ” on page 17.
 Workflows 90
Task

You can also create a workflow using through Workspace or by uploading a CSV
file from this page.
To create a workflow,
1 Click Create Workflow in the top ribbon.
2 In the Create Workflow pop-up, enter a unique name, description and select
type of workflow from the drop-down.
There are two types of workflows, Ownership Confirmation and Delete
Files. If you want to assign or change a custodian to the data source or folder,
create a Ownership Conformation workflow. After this workflow is
successfully executed, a custodian will be assigned or changed for the data
source or folder.
If you have configured Delete Action for a specific SharePoint or OneDrive
accounts, Delete Files option will be available for selection. If you want to
delete files from this account but do not see that option, navigate to Data
Remediation > Delete Files Configuration in the left pane and configure
delete action.

Note: Assigning custodian at file level is not supported.

3 Click Download CSV Template and save it on your local drive.

4 Open the file on your local machine.
5 Add desired details and save it.
6 On the Data Insight pop-up, click Choose File and select the file you have
edited and saved on your local drive.
7 Click Save to complete the process.
The newly created workflow will appear on the Workflow page.
Once a workflow is created, a new tasks will be created for the custodians. The
custodians will monitor the task and take action on it. After the action is submitted
by custodians, Data Insight will execute the action and complete the workflow.

Task
This page lists all the tasks assigned to logged in user. You can view details like
Workflow Name, Type, Status, Start Time on this page. This page will list all
pending workflows requests for the user.
 Workflows 91
Task

You can search a particular task by using the Search box at the top. You can filter
columns headers like Type, Status or Start Time by clicking the Toggle Selection
List icon at the top right corner of the page.
You can also click Action menu (three dots) next to the task to view more details
or download it.

To approve or reject a request,

1 click Action menu (three dots) next to the task.
2 Click View
3 Select the pending task and click Actions drop-down.
4 Click Approve or Reject.
5 On the Task Action pop-up, add a comment and click Submit.
In case of Ownership Confirmation task, you can use the Action option to
approve or reject and in case of Delete Files, choose to delete or keep the files.
 Chapter 13
Data Remediation
This chapter includes the following topics:

■ Delete Files Configuration

Delete Files Configuration

Data Insight enables users to delete files and folders from SharePoint and
OneDrive data sources. Only after delete action is configured for files or folders,
Delete option appears while creating a workflow in the Workspace tab.
Delete Files Configuration page will have an option to add configuration. You
can configure delete action for SharePoint and OneDrive. The same page will list
all configured delete actions with details like Data Source Name, Data Source
Type and Status. You can use search and refresh options on the top ribbon to
search a particular configuration and to refresh the list. You can also use the
toggle selection option, next to refresh to select the columns that would appear
on this page.
To configure delete action,
1 Click Data Remediation > Delete Files Configuration in the left pane.

2 Click Add Configuration and select SharePoint or OneDrive.

3 On the configuration details pop-up, select online account URL from the
drop-down.
4 Enter Tenant ID, Client ID and Client Secret Key for the selected online
account.
 Data Remediation 93
Delete Files Configuration

5 Click Authorize. This invokes the application and authorizes it after providing
valid credentials.
6 click Add More Apps if you want to add another set of client credentials.
7 If you want to exclude any sites from delete action, select sites from the
drop-down.
8 Enable Action checkbox will be checked by default. Uncheck this box if you
want to create a delete action configuration but intend keep it disabled. You
can check the box later to enable this delete action.
9 Click Save to complete the process.
After you complete the process, Delete option will appear for the configured
SharePoint or OneDrive account.

Note: Delete action is not supported on generic devices.

Editing or deleting configured delete action

You can edit or delete configured delete action from Delete Files Configuration
page. Click the Action menu next to the required delete action and click Edit or
Delete.

If you click Edit, Edit Configured Delete Action pop-up appears. Edit the desired
field and click Save to confirm. If you click Delete, click Yes on the confirmation
pop-up to permanently remove the delete action.
To know more about workflow, See “Workflows” on page 89.
 Chapter 14
Users and Access
This chapter includes the following topics:

■ Users and Roles

■ Credentials

Users and Roles

This page displays list of registered users along with details like Status, Role, and
Scope. If there are multiple users, you can search specific user by typing the name
in the Search bar.
You will not be able to add user in Data Insight but if you have sufficient
privileges, you can edit roles assigned to the user or disable the user by clicking
the Action menu on the right.

You can edit user role and enable/ disable specific user by clicking the kebab
menu in line with the user details. The Administrator user from Arctera View
Compliance and Governance Portal will be the Server Administrator in Arctera
Data Insight . When the Server Administrator logs in for the first time, all other
users will be in Unassigned role. You will not be able to add users in Data Insight.
All users created in Arctera View Compliance and Governance Portal will be
synced in Data Insight
 Users and Access 95
Users and Roles

Role Based Access Controls

Role Based Access for Data Insight is as follows:

Role name Description

Server Administrator Server Administrator role allows the user

to perform all actions in the Arctera Data
Insight Console. This includes setting up all
infrastructure like data sources, users and
so on.

Product Administrator Product administrator role allows the user

to manage data sources settings but it does
not allow the user to add or delete data
sources.

User Administrator The User Administrator role allows the user

to assign Arctera Data Insight roles to users.
A user with the User Administrator role
cannot set up other infrastructure like data
sources.

User User role allows the user to view workspace

and dashboard data. This role also has access
to selected data sources and repositories

Unassigned Unassigned user can log in and view tasks

by navigating to Workflows > Tasks only
if any workflow is assigned.

All users can see assigned tasks and take action on it.

Note: The logged in user will not be able to edit or disable own account.

To edit user role

1 Click the Action menu next to the role and click Edit.
2 Edit Data Insight User pop-up appears.
3 User Name and Domain Name are not editable.
4 You can change the user role by selecting from Server Administrator,
Product Administrator, User, and User Administrator.
 Users and Access 96
Users and Roles

5 For Product Administrator and User roles, you can grant or revoke access
to data sources and repositories.

6 Click the data sources or repositories to grant access.

7 Click the X mark next to the selected data sources or repositories to revoke
access.

8 Click Save to complete the process.

 Users and Access 97
Credentials

Credentials
About credentials
An authentication credential can be stored as a named credential in a central
credential store. It can be defined once, and then referenced by any number of
filers, and shares. Passwords are encrypted before they are stored. The saved
credential store simplifies management of user name and password changes. You
can add, delete or edit stored credentials.
On the Credentials tab, you can :
■ Add Credentials
■ Search Credentials by using the Search bar at the top.
■ Use the Refresh icon to refresh the list.
■ Delete or edit saved credentials by using the Action menu on the right.

To add credential
1 Click Credentials under Users and Access in the left pane.
List of saved credentials appear.
2 Click Add Credential
3 Enter the following information:

Credential Name The credential name must be unique

within the credential store. The name is
used only to identify the credential.

Username Enter the user name for authentication.

Password Enter the password for authentication.

Confirm Password Re-enter the same password.

Domain Enter the name of the domain to which

the user belongs.

4 Click Save to complete the process.

 Users and Access 98
Credentials

To delete credential
1 Click Credentials under Users and Access in the left pane.
2 Click the Action menu (three dots) on the right side of the credentials and
click Delete.
3 Click OK on the confirmation pop-up to delete credential.
4 A credential can be deleted only if it is not currently used for filers or shares.
To edit credential
1 Click Credentials under Users and Access in the left pane.
2 Click the Action menu (three dots) on the right side of the credentials and
click Edit.
3 Make required changes and click Save to complete the process.