ControlPoint 8.9 - for Microsoft 365 Installation Guide

Using Microsoft Modern Authentication with ControlPoint Online

As of version 8.3.1, ControlPoint Online uses Microsoft Modern Authentication to connect to SharePoint Online.  This requires a one-time registration of an app, ControlPoint Online, in Microsoft Azure, and involves the use of SSL certificates both in IIS (which Microsoft requires to secure the ControlPoint application and allows ControlPoint users to authenticate with Microsoft Entra ID).

NOTE:  Once the app is registered, the only time it should ever have to be re-registered is if the app owner and/or certificate information needs to be changed.

First Time Installation and Configuration

Quest® ControlPoint for Microsoft 365 SharePoint Administration (ControlPoint Online) is installed and runs as a .NET application. During installation:

·a dedicated application pool is created in IIS for the primary ControlPoint Configuration site, which is installed under the root site of a hosted site collection

·the ControlPoint Service database (xcAdmin) is created for configuration information and analysis data

Before You Begin

·The site collection that will host the ControlPoint Configuration Site must exist on the host and be in the English language.

·The machine on which you are installing ControlPoint must meet System Requirements.

·Make sure the machine on which you are installing ControlPoint has access to the Internet if you want to be able to activate your ControlPoint license online.

Have the following information ready (you may wish to record it in the spaces provided):

§The URL for the site collection that will host the primary ControlPoint Configuration Site* and the URL of the SharePoint Administration site hosting the site collection.

ControlPoint Configuration Site Collection URL: ______________________________________

SharePoint Administration Site URL:        _____________________________________________

*REMINDER: The ControlPoint Configuration Site must be created in an English-language site collection.

§The name and port number that you want IIS to use to manage the ControlPoint Configuration Site (The default port number is 2828, but you can set it to any available value.)

Web Site Name:______________________________

Port Number:         _____________________________

§The account under which you want the application pool for the ControlPoint Configuration Site to run (This is normally a domain account, but if you are running an evaluation version of the product—and the database is on the same machine as ControlPoint—you may use a local account.)

App Pool Service Account: ____________________________________

Password:                ____________________________________

§The email credentials that you want to use as the "from" account for correspondence sent on behalf of ControlPoint.

Local SMTP Server:                ___________________________________                

Email address:                        ___________________________________

§The name of the SQL server that will host the ControlPoint Service (xcAdmin) database, as well as the authentication method to be used:

(This is where the content database for the ControlPoint application will reside.)

Database Server Name:  __________________________

Windows Authentication

OR

SQL Server ID ___________________________ Password _______________________

§The ControlPoint Online license activation code: ________________________________

§The Site Collection Administrator account that will be used to create the ControlPoint Configuration Site.

Site Collection Administrator Account:        _____________________________________

Password:                                _____________________________________

NOTE:  If you do not already have a license activation code, contact Quest to obtain one.

First Time Installation and Configuration Process

The ControlPoint Online first time installation and configuration process consists of the following stages:

A.Installing the ControlPoint Online Files.

B.Configuring the ControlPoint Online Application (which includes registering the ControlPoint Online Azure application).

C.Optionally, configuring ControlPoint Services.

Installing ControlPoint Online Files

It is recommended that you temporarily disable virus checkers on all Web front end servers in the farm as they can slow the solution deployment enough to trigger timeout errors.

To install ControlPoint Files:

REMINDER:  If UAC enabled on your server, you may have to "Run as Administrator."

1Unzip the downloaded zip file then launch the installer (Quest ControlPoint Installer.exe).

NOTE: Make sure you keep the entire downloaded folder intact as there are files that are required by the installer.

A splash screen displays, followed by the ControlPoint Installer Welcome screen.

2Click Install ControlPoint.

The License Agreement dialog displays.

3Read the license agreement. Click I accept the terms of the license agreement, then click [Next].

4Select Install ControlPoint Online.

NOTE:  If SharePoint is not installed or configured on the server, this will be the only selectable option.  

5 When the ControlPoint InstallShield Welcome dialog displays, click [Next].

The InstallShield Wizard specifies a default install directory (C:\Program Files\Metalogix\ControlPoint Online), but you can click [BROWSE] and select a different one.  

NOTE:  This directory is where the installer will place the files needed to complete the installation.  

6Click [Install].

The Configuration Wizard installs the ControlPoint files to the specified Destination Folder.  When completed, a pop-up displays asking whether you want to configure ControlPoint.

NOTE:  If you want to configure the ControlPoint Online application at a later time, click [No].  You can launch the ControlPoint Online Configuration Wizard from the Start menu or a Desktop shortcut.

7Click [Finish].

Configuring the ControlPoint Online Application

Summary of ControlPoint Configuration Process

The ControlPoint Configuration Wizard carries out the following tasks:

A.ControlPoint Online Application registration:  To allow the use of Microsoft Modern Authentication, an app called ControlPoint Online is registered in Azure.

B.Account validation: Authenticates the account that will be used to create the ControlPoint Online Configuration site and creates/registers the ControlPoint Online app.  This also allows for the use of Multi-Factor Authentication (MFA).

C.ControlPoint Installed Components check.

D.ControlPoint License validation:  Checks the validity of the license key you enter as well as the terms of the license.

E.ControlPoint Service database creation:  Creates the ControlPoint Service database (xcAdmin) on the selected database server.  This database is where administrative information and cached data used for analysis and reporting is collected.  (Note that in a multi-farm installation, this database is shared among farms.)

F.Creation of ControlPoint Online application pool, website, and virtual directory in IIS.

G.ControlPoint Online website configuration.

NOTE:  If you change the host name, the Configuration Wizard will also create the bindings in IIS, update the redirect URI in the registered ControlPoint Online Application, and updates the ControlPoint Setting 'Inbound ControlPoint Url' to use the host header.

H. License Activation:  Activates your ControlPoint license.

I.Windows Service Configuration (optional):  If you elect to use server-side Windows Services for Discovery and/or Sensitive Content Manager, installs and configures the service(s) you selected.

To configure the ControlPoint Online application:

1Use the information in the following table to determine the appropriate action to take..

2To create the ControlPoint Online application in Microsoft Azure for modern authentication:

a)Select the applicable M365 Service Endpoint: Global (Default), GCC, or GCC High.

b)Enter the information for the certificate that will be used to authenticate to Entra ID.

c)  Click [Register] then, when the registration is complete click [Next].

d)  Click [Consent] to be redirected to the Azure application Consent screen.

e)  Read the permissions that the app requires then click [Accept].

3When a pop-up with the message that the registration was successful displays, dismiss it then click [Next].

The SharePoint online account validation dialog displays.

4Provide the following information:

§For SharePoint Administration URL,the url of the primary page for configuring the hosted SharePoint environment.

§For Primary ControlPoint Configuration Site URL, the url of the hosted site collection in which the ControlPoint Configuration site will be created.

5Click [Authenticate].

You will be prompted once again to sign into the Microsoft Azure portal, this time for account authentication.

Remember that the signed-in account must be both a Global Administrator and a Site Collection Administrator for the site collection that will host the ControlPoint Online Configuration site.

If the authentication is successful, the Office 365 account will display as the Logged In Account for the remainder of the installation.

/sp-2

6Click [Next].

The installer checks your environment for the presence of installed components.

NOTE:  For a first time installation, once the components check is complete only the Fetching ControlPoint Configuration Data box should be checked ().  All other options will appear with a right-facing arrow.  ()

7Click [Continue].

8Click [Configure ControlPoint].

9Enter the license key provided by Quest.

10.Use the information in the following to determine the appropriate License Validation option to select.

NOTE:  Most systems can use the Online activation method as long as the system has internet access. If you are unable to use the online activation method due to security settings or lack of internet access, the Offline activation option can be used. This option will still require some internet access, but allows for the authentication to be done from another machine that is not as restricted by security or has a connection to the internet.

11Click [Validate].

If the license is validated successfully a License Validation pop-up displays the terms and current status of the license.

12Dismiss the pop-up and click [Next].

The System Prerequisite check begins. Any item that  fails the check is identified by a red X.

NOTE:  If you fix the problem immediately, you can then Rerun the System Check.  If you choose to Quit and fix the problem at a later time,  the next time you launch the ControlPoint Configuration Wizard, it will start from the beginning.

13When all system prerequisites checks have completed successfully, click [Next] to display the IIS Configuration dialog.

14Complete the dialog as follows:

a)For Web Site Name, if different from the default (ControlPoint Online), enter the name that you want IIS to use to manage the site.

NOTE:  The name that is entered in this field is for IIS purposes only.  The name of the site will appear in SharePoint and ControlPoint under the name ControlPoint Configuration Site.

b)For Port number, either:

§accept the default value (2828)

OR

§enter a different, unused Port number.  

c)For Host Name, if different from the default (the machine name), enter the host header (alias) that will be used.

NOTE:  If a host header is entered, the installer will also create the bindings in IIS.

d)Enter the name and password of the Service Account under which you want the application pool that will host the ControlPoint Configuration Site to run.

REMINDER:  If your databases reside on a different server, then the Service Account must be a domain account.

e)For SSL Certificate (which Microsoft requires to secure the ControlPoint application), use one of the options described in the following table.

NOTE: The certificate must be located in either the Personal or WebHost store.

15Click [Next] to display the Create the ControlPoint Service (xcAdmin) Database dialog.

16Specify the Database Server where you want to host the ControlPoint Service (xcAdmin) database:

§enter the server name

OR

§click [Browse] to choose a different database server.

17If you want to view, update, and/or test the xcAdmin database connection string

a)Click the (Advanced) Edit Connection String Directly box.

NOTE:  If you are choosing to reuse an existing xcAdmin database, you will be unable to update the connection string and the field will be disabled.  If you need to update the connection string after completing the installation, you can do so by updating the parameter <connectionStrings>  in the CPConfiguration.exe.config file  Refer to the ControlPoint for Microsoft 365 Administration Guide for details.

IMPORTANT:  Update the connection string only if your SQL connection requires the addition of one or more custom keywords.  For example, if you are using authentication with encryption and a self-signed server certificate, you would need to add Encrypt=yes;TrustServerCertificate to the string.  Refer to the Microsoft article Using Connection String Keywords with SQL Server Native Client for more information.

b)Click [Test Connection.].

Note that if the connection is not successful, the parameter that caused it to fail will be identified.

18Click [Create] (or if you are using an existing xcAdmin database, [Update]).After the Configuration Wizard has successfully created the new database (or updated an existing database), click [Continue Installation] then click [Next].

19Enter the email information for the O365 Email Address  or Local Email Address (including local SMTP Server Address) that will be used as the "from" account for any correspondence sent on behalf of ControlPoint.

20Click [Next] to display the Deploy ControlPoint dialog.

21Click [Start Deployment].

22When the deployment has successfully completed, click [Finish].

23If you want to configure Discovery and/or SCM services, click [Yes] and follow the instructions for Configuring ControlPoint Services.  

NOTE:  You can also configure services at a later time by launching the installation from the Start menu or desktop shortcut.