Enterprise Reporter 3.5.1 - Configuration Manager User Guide

Configuring Tenant Applications for Cloud Discoveries

You must register the tenant applications that are used by Enterprise Reporter for cloud discoveries in your Azure environment. You can complete this process using the Configuration | Tenant Application Management option in the main menu before you create discoveries.

If the tenant applications are not registered in your Azure environment, the Names page of the discovery displays a warning message above the Azure Tenant name. If you have configured the required tenant application and it indicates the option to Reconfigure, nothing further is necessary.

However, when you upgrade to Enterprise Reporter, the workflow for creating cloud discoveries has been changed. You are prompted to reconfigure the tenant for each cloud discovery type (with the exception of Exchange Online). You must do this before the existing cloud discoveries can be run.

NOTE: If you make changes to Azure applications outside of Enterprise Reporter (for example, if you remove permissions or delete applications), Enterprise Reporter does not receive these updates. Use the Reconfigure link beside an application to recreate the application and grant consent to the application permissions again.

NOTE: For more information, see Permissions for Enterprise Reporter tenant applications .

NOTE: For more information, see Permissions for Enterprise Reporter tenant applications .

Step 2. Choose what to include in your discovery (Scopes)

In this section, we will explore what targets (scopes) you can define for each discovery.

See the following sections:

See also:

Scopes: An Overview

Scopes define the targets of the discovery. Options vary depending on the type of discovery you are creating. When you choose scopes for on-premises collections, the node credentials or alternate credentials you specify on the Name page of the Create Discovery wizard determine the available targets. If you are using default node credentials, only the targets that the logged-in user can access are shown.

If you provided alternate credentials when you created the discovery, those credentials are used to enumerate your scopes. For more information, see Node Credential and Alternate Credential Details for On-Premises Discoveries .

TIP: It is recommended that you only include a target (computer) in a single discovery for each type.

Use care when changing credentials. Credentials must have read access to all targets of the discovery or tasks will fail. If this is not possible for all targets in one large discovery, break the discovery into smaller discoveries.

Some discovery types have additional options to collect related information that adds value to your reports. For example, if an NTFS discovery encounters Active Directory groups in the security settings on an object, you can collect and report on the nested members of the groups. The data is collected for all scopes in the discovery and will add time to your discovery, so take this into consideration when selecting this option.

You may be able to enable this in a subset of your discoveries. For example, if you have six different discoveries with varying schedules that could potentially collect the same group members, you could enable it in only the discovery that is scheduled once a week, assuming that is sufficient to meet your reporting needs. In this way, performance is maximized, and reports have the data they need. It does not matter what discovery type is used to collect the data, as long as you are sure the data will be complete. Results are available for any report that includes the field.

How Scopes Affect Tombstoning

The concept of tombstoning refers to the process of comparing the objects found in previous collections with those found in current collections and subsequently marking objects that are no longer found in the current collection as tombstoned in the database. Tombstoned objects in the database will not be shown in library reports.

Enterprise Reporter makes the best assumptions it can based on what is collected. For some on-premises discovery types such as Computer, SQL Server, NTFS, and Registry, use caution when changing collection options between collection runs on the same target (same computer). If these options are changed, objects that are not found in resulting collections will be marked as tombstoned in the database.

For example:

Other discovery types such as Active Directory, Azure Active Directory, Azure Resource, SharePoint Online and Microsoft Teams allow for collection of different object types from the same target without tombstoning the objects.

For example:

For the SharePoint Online discovery type, all site collections that are part of the include list are stored in the database while other previously collected site collections are not tombstoned. All site collections that are part of the exclude list are tombstoned while all other site collections are collected.

The following table describes how each discovery type works with tombstoning.

*Yes indicates that objects will be tombstoned when subsequent collections run on the same target with different collection options.

Note: All discovery types have a root object that is not tombstoned by Enterprise Reporter. For example, in Computer, File Storage Analysis, MS SQL, and Registry discoveries, the computer is the root object, so computers will never be tombstoned.