Data Discovery & Risk Insights 25.4.1 Help Center

OneDrive connection

If you will be creating sources and datasets that process OneDrive or OneDrive Online (O365) data, you must complete additional tasks to enable processing by the processing agent.

NOTE: “OneDrive” is the implementation of personal sites when using on-premises SharePoint. “OneDrive Online” is the implementation of OneDrive personal sites when using SharePoint Online.

Complete the tasks for OneDrive or OneDrive Online as appropriate for the data to be managed by OpenText Core Data Discovery & Risk Insights. If you will process data by both OneDrive and OneDrive Online, complete the tasks for both implementations.

OneDrive connection tasks

Complete the following to process data from OneDrive.

Create SharePoint service user
OpenText Core Data Discovery & Risk Insights performs processes in OneDrive through a SharePoint service user. The SharePoint service user is used by the processing agent to connect to and perform actions in your SharePoint environment related to processing data.

The exact level of permissions required depends on the actions you will be performing through OpenText Core Data Discovery & Risk Insights.
- To process and collect items from a OnceDrive source, the SharePoint service user must have a minimum permission of Reading.
- To delete items from a OneDrive source, the SharePoint service user must have a minimum permission of Collaboration.
- To process, collect, and delete items from OneDrive, the SharePoint service user must be added to the Site Collection Administrators for the OneDrive site to be processed.
When creating a source, you will define the credentials for the SharePoint service user that will be used to process data (read, collect, delete).
Update the logon account for OpenText Core Data Discovery & Risk Insights services

OneDrive Online connection tasks

OpenText Core Data Discovery & Risk Insights requires non-user based access to OneDrive Online using the Microsoft Entra ID access method.

To connect to OneDrive Online (O365) using the Microsoft Entra ID method

Prepare credentials for certificate based authorization. The following must be available.
1. A pkcs12 keystore (.p12 or .pks) containing a single certificate and corresponding private key. The certificate must at least be issued with a maximum expiration of 2 years, and bear the Client Authentication Enhanced Key Usage and Application policy extensions.
2. The public certificate (.pem or .cer) matching the above keystore.
If you do not yet have files that meet the above criteria, create a PowerShell script with the following content. It may then be used to assist in generating self-signed files that are valid for this use.

NOTE: The PowerShell to create the pkcs12 keystore must be generated and run on a Windows Server 2019 or later.

CAUTION: When creating the script, the -TextExtension line must not contain line breaks. Any breaks in the -TextExtension line in the sample below are a result of line wrapping for viewing.

If you copy and paste the contents below into your file, you must manually remove line breaks in the -TextExtension line.
```
# Variables to be used

[string] $certName="<certificateName>"
```
```
#Example: cddri-spo-access-rw-20240530
```
```
[string] $requesterEmail="<requesterEmailAddress>"
```
```
#Example: johnDoe.admin@company.com
```
```
[string] $p12PW="<password>"
```
```
[string] $outputDir="<localPath>\"
```
```
# Example: c:\certificates
```
```
# Create local self-signed client cert, storage in current user's certs.
```
```
# -------------------------
```
```
$Certificate=New-SelfSignedCertificate -Type Custom `
```
```
-Subject "E=$requesterEmail,CN=$certName" `
```
```
-KeyUsage DigitalSignature `
```
```
-KeyAlgorithm RSA -KeyLength 2048 `
```
```
-KeyExportPolicy Exportable `
```
```
-NotAfter (Get-Date).AddYears(2) -HashAlgorithm sha256 `
```
```
-CertStoreLocation Cert:\CurrentUser\My `
```
```
-TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2","1.3.6.1.4.1.311.21.10={text}OID=1.3.6.1.5.5.7.3.2")
```
```
 
```
```
# Export public side of above certificate
```
```
# -------------------------
```
```
Export-Certificate -Cert $Certificate -FilePath "$outputDir$certName.der"
```
```
certutil -encode "$outputDir$certName.der" "$outputDir$certName.pem.cer"
```
```
# Export Private side pkcs12 keystore of above certificate
```
```
# -------------------------
```
```
$mypwd = ConvertTo-SecureString -String $p12PW -Force -AsPlainText
```
```
Export-PfxCertificate -Cert $Certificate `
```
```
-FilePath "$outputDir$certName.p12" `
```
```
-Password $mypwd
```
where
- <certificateName> is the file name for the certificate file that will be generated. Do not include the file extension.
- <requesterEmailAddress> is the email address of the person requesting the certificate and keystore.
- <password> is the password required to access the certificate.
- <localPath> is the location on the local machine where the certificate and pkcs12 keystore are generated.
Open a browser and connect to the Microsoft Entra admin center for your organization as an account with appropriate privileges.

Create a new app registration.

In the left pane, expand Identity > Applications, and then click App registrations.

Click New registration and complete the options as follows.

Option	Description
Name	Type FAS-DD_OneDrive_Collection as the application name.
Support account types	Select Accounts in this organizational directory only.
Redirect URI	make no selections or entries

Click Register. The overview page for the new app registration displays.

Take note of the resulting Application (client) ID and Directory (tenant) ID values. These will be required when defining the source in the Connect UI.

Set permissions for the new app registration.
1. In the left pane of the new application registration page, expand Manage and then click API permissions.
  
  Click Add a permission.
  1. In the Request API permissions pane, click Microsoft Graph.
  2. For the permission type, click Delegated permissions.
  3. In the list of permissions, expand Users and select the check box for User.Read.
  4. Click Add Permissions.
2. On the API permissions page, click Add a permission.
  1. In the Request API permissions pane, click Microsoft Graph.
  2. For the permission type, click Application permissions.
  3. In the list of permissions, expand Sites and select the check box for Sites.Read.All.
  4. Click Add permissions.
3. On the API permissions page, click Add a permission.
  1. In the Request API permissions pane, click SharePoint.
  2. For the permission type, click Application permissions.
  3. In the list of permissions, expand Sites and select the check box for Sites.Read.All.
  4. Click Add permissions.
Define the access credentials.
1. In the left pane of the new application registration page, expand Manage and then click Certificates & secrets.
2. Click Upload certificate.
3. In the Upload certificate pane, click the folder selection button. Navigate to and select the certificate (public key, .cer) file from of step 1.

When you create OneDrive Online (O365) sources in OpenText Core Data Discovery & Risk Insights, you will need to provide the Client Id (listed in OpenText Core Data Discovery & Risk Insights as Application ID), the pkcs12 keystore file, and the password for the keystore.

Configure web proxy settings (optional)

OneDrive uses the SharePoint processor. This processor service controlled by the processing agent requires connectivity to the OpenText Core Data Discovery & Risk Insights cloud components, often located away from the local network where the agent host servers are located. Although direct connectivity is ideal, use of a web proxy may be required in some environments for the agent systems to reach the OpenText Core Data Discovery & Risk Insights cloud.

NOTE: Authenticated proxies are supported for OneDrive Online (O365) only.

To configure the web proxy for the SharePoint processor for OneDrive

On the machine hosting the OpenText Core Data Discovery & Risk Insights processing agent, log on to the agent administration UI.

From the Start menu, click OpenText Core Data Discovery & Risk Insights Agent > Agent Admin.
In the navigation pane, click Advanced Settings.
In the Category list, click SharePoint Processor.

Complete the following options.

Option	Description
Proxy address URL	Type the URL of the web proxy.
Proxy bypass list	Type a comma separated list of addresses that do not use the proxy server..
Proxy Bypass on Local	Specify whether to bypass the proxy for local addresses. Select True to bypass for local addresses. Select False to not bypass for local addresses.
Proxy Password	If the proxy requires authentication, type the password for the user account that will access the proxy server. IMPORTANT: Authenticated proxies are only supported for OneDrive Online (O365) resources. If not connecting to OneDrive Online (O365), leave this field blank.
Proxy Username	If the proxy requires authentication, type the username for the user account that will access the proxy server. IMPORTANT: Authenticated proxies are only supported for OneDrive Online (O365) resources. If not connecting to OneDrive Online (O365), leave this field blank.

Click Save. You can close the agent administration UI.

OneDrive processing

When processing Microsoft Office items from OneDrive, OpenText Core Data Discovery & Risk Insights uses the last modified date in the de-duplication calculation. Due to the way modified dates are handled in Office items and in OneDrive, OpenText Core Data Discovery & Risk Insights will not identify documents with different dates as duplicates.

When an Office item is uploaded to a OneDrive site web interface, the item's modified date is changed.
When an Office item is added to a local system and is then synchronized to the OneDrive site, the item's modified date is not changed.

SharePoint Lists are comprised of form records, called items in OneDrive, that contain various text fields and can have attachments. When deleting OneDrive files, OpenText Core Data Discovery & Risk Insights does not delete attachments to items from SharePoint Lists.

Item counts

The document and item counts in OpenText Core Data Discovery & Risk Insights may differ from the "item" count as seen in the OneDrive site interface. This difference relates to the following.

In OpenText Core Data Discovery & Risk Insights, a document is an original file processed by OpenText Core Data Discovery & Risk Insights and an item is an attachment to an original file. In OneDrive, an item is a row in a table, or a record in a database and a document is a type of item.
In OneDrive, item counts are derived from the total number folders, documents, and items (each entry in a SharePoint Item List). In OpenText Core Data Discovery & Risk Insights, document counts are derived from the total number of documents from SharePoint Document Libraries and attachments in a SharePoint Item List. OpenText Core Data Discovery & Risk Insights does not process the field, or entry, in an Item List, only the attachments from the Item List.

For example, if a SharePoint Item has zero attachments, OneDrive records this as one item. If a SharePoint Item has 10 attachments, OneDrive also records this as one item.
The item count listed on the OneDrive Site Contents page for libraries includes all items in the library, including folders. Folders in which files exist in OneDrive are not included in counts in OpenText Core Data Discovery & Risk Insights.
When processing OneDrive content, OpenText Core Data Discovery & Risk Insights does not process library items that include the UIVersion field. These SharePoint items are SharePoint UI elements and are skipped. For example, the Form Templates and List Template Gallery library items are UI elements and therefore not processed by OpenText Core Data Discovery & Risk Insights. However, when viewing the OneDrive Site Contents page, these items are included in the item count.

Deletion tracking

OpenText Core Data Discovery & Risk Insights tracks the deletion of managed OneDrive items made at the original source location using the SharePoint change logs. Each time processing is run on a dataset—on a schedule, or on demand—OpenText Core Data Discovery & Risk Insights checks the SharePoint change logs for deleted items. For each managed item that is deleted in OneDrive, that item is deleted from OpenText Core Data Discovery & Risk Insights. If an item within a container file (such as ZIP) is deleted in OneDrive, the item is removed from the application as part of updating the container file when the job run occurs.

To ensure accurate tracking of items deleted from OneDrive, ensure that the OneDrive datasets in OpenText Core Data Discovery & Risk Insights are updated more often than the maximum number of days SharePoint change logs are kept. OpenText Core Data Discovery & Risk Insights uses information from the SharePoint change logs to identify deleted OneDrive items to be removed from the application. Without this information, items deleted from your SharePoint environment cannot be removed from the application. OneDrive items that have been added or modified are appropriately updated in OpenText Core Data Discovery & Risk Insights.

For example, if your SharePoint change logs are configured to be stored for 60 days, verify that your OneDrive datasets are updated at least every 59 days.

CAUTION: Failure to rescan OneDrive datasets before SharePoint change logs are purged will result in items being tracked incorrectly in OpenText Core Data Discovery & Risk Insights. Using the same example, if your SharePoint change logs are configured to be stored for 60 days and your OneDrive datasets are updated every 90 days, you will lose 30 days of important information about deleted items—items deleted during this 30 day time frame will not be removed from the application.

The loss of information cannot be reconciled in OpenText Core Data Discovery & Risk Insights; you would have to create a new dataset and start over.

Capture owner information from OneDrive Online (optional)

If you are processing documents from OneDrive Online (O365) datasets using Microsoft Entra ID authentication, you can choose to capture document owner information. For OneDrive, the user is the owner.

To capture owner information from OneDrive Online datasets using Microsoft Entra ID authentication

Identify the agent host machines assigned to an agent cluster that is responsible for processing OneDrive Online datasets using Microsoft Entra ID authentication.
On each agent host machine in the identified cluster, log on to the agent administration UI.

From the Start menu, click OpenText Core Data Discovery & Risk Insights Agent > Agent Admin.
In the navigation pane, click Advanced Settings.
In the Category list, click SharePoint Processor.

Complete the following option.

Option	Description
Enable Additional Fields Capture	Specify whether to capture additional metadata fields. Select True to capture additional fields. Select False (default) to capture only the standard fields.

Option

Description

Enable Additional Fields Capture

Specify whether to capture additional metadata fields.

Select True to capture additional fields.
Select False (default) to capture only the standard fields.

Click Save. You can close the agent administration UI.
Repeat on each agent host machine in the agent clusters that will process OneDrive Online datasets using Microsoft Entra ID authentication.