How to Create a Single Tenant App for OneDrive and Exchange Online Searches

Overview

Spirion now supports creating an app for the search of Microsoft OneDrive and Exchange.

This enables Spirion Administrators to manage searching two locations with a single Entra App.

High-Level Steps

• How to Create the Azure App
• How to Create a OneDrive Target
• How to Create an Exchange Online Target

Before You Start

• An Entra Administrator is needed to create the tenant app
• The API permissions below are needed to scan BOTH OneDrive and Exchange Online.
• All of these permissions are REQUIRED for Spirion Sensitive Data Platform agents to function properly. An explanation of these permissions can be found here. 
• • Directory.Read.All
  • Directory.ReadWrite.All
  • Files.ReadWrite.All
  • Mail.Read
  • Mail.ReadWrite
  • Sites.ReadWrite.All
  • User.Read.All
• For instructions on how to create searches after authenticating Microsoft OneDrive and Exchange see How to Search OneDrive for Business.
• Be sure to record both the Application ID and the Directory ID while creating the Azure App as they will be used in a later step.
• Be sure to remove the User.Read permissions from the Azure app.

How to Create the Azure App

Use the following steps to create your Azure app:

1. Log into: https://entra.microsoft.com/ 
2. • NOTE: An administrator must perform all the steps below to create the single tenant app with the permissions required (for example, the permissions Spirion Sensitive Data Platform requires must have admin consent as shown in the steps below).
2. In the Microsoft Entra admin center, from the left-side navigation menu select Enterprise apps, then All Applications under "Manage" on the right, and then click + New Application.
   
   
3. The Browse Microsoft Entra Gallery page opens.
4. Select the + Create your own application link in the top-middle of the page.
   
   
5. In the field "What's the name of your app?" enter your application name and select the radio button Register an application to integrate with Entra ID (App you're developing).
6. Click the Create button at the bottom of the page.
   
   
7. The "Register an application" page opens.
8. Select the radio button Accounts in this organizational directory only
9. Click the Register button.
   
   
10. From the left side navigation select the Enterprise apps entry.
11. Select "All applications" under the "Manage" heading.
12. 1. In the search field on the right search for the app you just created.
    2. The app details appear in the window below the search field. 
    3. Note the application ID in the Application ID table column at far right, as this is required later. 
12. Under the Name column click your app name, which is linked.
    
    
13. The Azure app page opens.
14. Under the "Security" heading click “Permissions.”
    
    
15. Sign-in to portal.azure.com to assign permissions to your Azure app.  
16. 1. Search for the app name that was created in previous steps. 
    2. Choose the app that is labeled “Application”
       
       
    3. Note the Application ID, and Directory ID: these are required later in this procedure. 
    4. Select “API Permissions”
       
       
    5. Note that User.Read permissions are pre-assigned.  Remove this permission.
       
       
    6. Select the following action path: Add a permission > Microsoft Graph > Application permissions > Search for permission on the list below > Select each permission after searching > Add Permission
    7. NOTE: The list below are all of the “application” permissions that are needed to scan BOTH OneDrive and Exchange Online.  It is assumed that all of these are required for Sensitive Data Platform agents to function properly when searching these targets.  Explanations of these permissions are published by Microsoft here 
    8. • Directory.Read.All
       • Directory.ReadWrite.All
       • Files.ReadWrite.All
       • Mail.Read
       • Mail.ReadWrite
       • Sites.ReadWrite.All
       • User.Read.All
         
         
16. After you’ve added all the permissions, your app resembles the screenshot below. Under the Status column, the status for all permissions should be “Not granted for the…..”
    
    
17. Select “Grant Admin Consent” > Select Yes.  
18. 1. The status for each permission, displayed in the Status column, changes to “Granted…” 
    2. To understand what granting admin consent does, see the explanation published by Microsoft - Link
       
       
       
18. Create a Client Secret: 
19. 1. Under Manage on the left side navigation menu, select “Certificates & secrets.”
    2. Next select Client Secrets > + New client secret.
    3. In the Description field, enter the client secret name.
    4. Enter a custom start and end date that creates a two year duration.
    5. Click the Add button at the bottom of the screen.
    6. Copy the value under the "Value" column shown in the second screenshot below.