Enterprise Reporter 3.5.1 - Configuration Manager User Guide

Table 21. Required permissions
API Name	Permission	Permission Description	Type
Microsoft Graph	User.ReadBasic.All	Read all users' basic profiles	Delegated
Microsoft Graph	Directory.AccessAsUser.All	Access directory as the signed in user	Delegated
Microsoft Graph	Directory.Read.All	Read directory data	Delegated
Microsoft Graph	Group.Read.All	Read all groups
Microsoft Graph	IdentityRiskyUser.Read.All	Read identity risky user information	Delegated
Microsoft Graph	SecurityEvents.Read.All	Read your organization's security events	Delegated
Microsoft Graph	User.Read.All	Read all users' full profiles	Delegated
Microsoft Graph	Reports.Read.All	Read all usage reports	Delegated
Microsoft Graph	UserAuthenticationMethod.Read.All	Read all users' authentication methods	Delegated

Collecting user activity information

If you want to collect details about Microsoft 365 user activity, such as which licenses are assigned to a user and dates when a user last used a licensed service, the following delegated permission is required:

•

Microsoft Graph: Read all usage reports

Also, you must clear the Microsoft default setting that anonymizes the user-level data. To include user activity data in the Enterprise Reporter reports, do the following steps:

Open the Microsoft 365 admin center.

Navigate to Settings | Org Settings | Services.

Select Reports.

Clear the Display concealed user, group, and site names in all reports check box.

For more information, see https://learn.microsoft.com/en-US/microsoft-365/troubleshoot/miscellaneous/reports-show-anonymous-user-name

OneDrive application permissions

For the OneDrive discovery, an application with a name that begins with “Quest Enterprise Reporter OneDrive Discovery” is created. To create this application in your tenant, you must specify an account with administrative access to create applications. The account must have the Global Administrator role to be able to create and consent to the application.

Once created, the application must also be delegated permissions and an administrator must consent to the application’s permissions using the Microsoft consent wizard. For the Quest Enterprise Reporter OneDrive Discovery application, the following permissions are required:

Table 22. Required permissions
API Name	Permission	Permission Description	Type
Microsoft Graph	Directory.Read.All	Read directory data	Delegated
Microsoft Graph	Files.Read.All	Read all files that user can access	Delegated
Microsoft Graph	Sites.FullControl.All	Have full control of all site collections	Delegated
Microsoft Graph	Directory.AccessAsUser.All	Access directory as the signed in user	Delegated
Office 365 SharePoint Online	MyFiles.Read	Read user files	Delegated

Azure Resource application permissions

For the Azure Resource discovery, an application with a name that begins with “Quest Enterprise Reporter Azure Resource Discovery” is created. To create this application in your tenant, you must specify an account with administrative access to create applications. The account must have the Global Administrator role to be able to create and consent to the application.

Once created, the application must also be delegated permissions and an administrator must consent to the application’s permissions using the Microsoft consent wizard. For the Enterprise Reporter Azure Resource discovery application, the following permissions are required:

Table 23. Required permissions
API Name	Permission	Permission Description	Type
Microsoft Graph	User.ReadBasic.All	Read all users' basic profiles	Delegated
Microsoft Graph	Directory.AccessAsUser.All	Access directory as the signed in user	Delegated
Windows Azure Service Management API	user_impersonation	Access Azure Service Management as organization users	Delegated

Microsoft Teams application permissions

For the Microsoft Teams discovery, an application with a name that begins with “Quest Enterprise Reporter Microsoft Teams Discovery” is created. To create this application in your tenant, you must specify an account with administrative access to create applications. The account must have the Global Administrator role to be able to create and consent to the application.

Once created, the application must also be delegated permissions and an administrator must consent to the application’s permissions using the Microsoft consent wizard. For the Quest Enterprise Reporter Microsoft Teams Discovery application, the following permissions are required:

Table 24. Required permissions
API Name	Permission	Permission Description	Type
Microsoft Graph	Directory.Read.All	Read directory data	Delegated
Microsoft Graph	User.ReadBasic.All	Read all users' basic profiles	Delegated
Microsoft Graph	Files.Read	Read user files	Delegated
Microsoft Graph	Sites.FullControl.All	Have full control of all site collections	Delegated
Microsoft Graph	Directory.AccessAsUser.All	Access directory as the signed in user	Delegated
Microsoft Graph	Group.Read.All	Read all groups	Delegated
Office 365 SharePoint Online	MyFiles.Read	Read user files	Delegated

SharePoint Online application permissions

For the SharePoint Online discovery, an application with a name that begins with “Quest Enterprise Reporter SharePoint Online Discovery” is created. To create this application in your tenant, you must specify an account with administrative access to create applications. The account must have the Global Administrator role to be able to create and consent to the application.

Once created, the application must also be delegated permissions and an administrator must consent to the application’s permissions using the Microsoft consent wizard. For the Quest Enterprise Reporter SharePoint Online Discovery application, the following permissions are required:

Table 25. Required permissions
API Name	Permission	Permission Description	Type
Microsoft Graph	Directory.Read.All	Read directory data	Delegated
Microsoft Graph	Sites.FullControl.All	Have full control of all site collections	Delegated

CM Understanding Discoveries.04.12.html

Creating Discoveries

•

Step 1. Create the Discovery (Name)

•

Step 2. Choose what to include in your discovery (Scopes)

•

Step 2a. Choose scopes for your on-premises discoveries

•

Step 2b: Choose scopes for your cloud discoveries

•

Step 3. Schedule your Discovery

•

Step 4: Review the summary

There are several steps for creating a discovery. A wizard guides you through the process, which varies slightly depending on the type of discovery.

Step 1. Create the Discovery (Name)

When you are creating a discovery, it is important to consider which cluster is running a discovery. A discovery can only belong to one cluster. When you run the discovery, the collection is performed by the nodes in the cluster.

By default, for on-premises collections, the credentials used to access the targets and read the data are those that were provided when creating the node. If required, you can specify alternate credentials during the creation of your on-premises discovery. For more information, see Node Credential and Alternate Credential Details for On-Premises Discoveries .


	TIP: It is recommended that you assign a discovery to the cluster that is closest to the data.

Before you specify the credentials for a cloud discovery (Azure Active Directory, Azure Resource, Exchange Online, Microsoft Teams, OneDrive, and SharePoint Online), you must register and configure the application used by Enterprise Reporter in your Azure environment. You can complete this process using the Configuration | Tenant Application Management option in the main menu before you create discoveries.

If the Enterprise Reporter cloud applications are not yet registered and configured in your Azure environment, the Name page of the discovery displays a warning message above the Azure Tenant name. For more information, see Configuring Tenant Applications for Cloud Discoveries .

If you have already configured the required tenant application and it indicates the option to Reconfigure, nothing further is necessary.

To create a discovery

On the Manage Discoveries pane, click New Discovery.

- OR -

Select an existing discovery on the Manage Discoveries pane and click Duplicate to create an exact copy. Click OK to confirm that you want to duplicate the selected discoveries and edit the copy to meet your needs. For more information, see Modifying a Discovery .

Select the type of discovery. On the Name page of the Create Discovery wizard, type a unique name for your discovery.

Provide an optional description that outlines the data you collect with this discovery.

Select the assigned cluster.

Your change history status is indicated. For more information, see Best Practices for Creating Discoveries .


	NOTE: A cluster with a red icon is currently disabled. Your discovery cannot be run until you resolve the issue with your cluster.

For on-premises discoveries (Active Directory, Computer, Exchange, File Storage Analysis, Microsoft SQL, NTFS, and Registry), you enter the credentials to be used for the discovery.
For cloud discoveries (Azure, Exchange Online, Microsoft Teams, and OneDrive, Azure Resource, and SharePoint Online), you enter the tenant name and the credentials to be used for the discovery.

For on-premises discoveries select Use default node credentials to target computers that the logged-in user can access.

For access to additional targets, use alternate credentials and choose an account from the Credential Manager. For more information, see Using the Credential Manager .

- OR -

For cloud discoveries, enter the name of the Azure tenant from which the discovery will gather data. You must have configured your Azure tenant before you can specify credentials.

After you have configured the Azure tenant, you enter the credentials. At this point, Enterprise Reporter can ensure that the tenant app is registered and configured so the credentials you enter are properly authenticated.

For details about configuring your Azure tenant see Configuring Tenant Applications for Cloud Discoveries .

Click Add to use the Credential Manager and select (or Add) an Microsoft 365 administrator account within the target tenant and click OK. For more information, see Using the Credential Manager .