Enterprise Reporter 3.2.2 - Configuration Manager User Guide

Table 2. Types of on-premises Discoveries included in Enterprise Reporter
Type	Description
Active Directory	Collects information about your domains and Active Directory® objects within the domains, such as users, groups, sites and trusts.
Computer	Collects information specific to a computer, such as printers, shares and security policies.
Exchange	Collects information about your Exchange organization and permission information about your organization's mailboxes, stores, public folders, contacts, groups, and group members.
File Storage Analysis	Collects information about your network’s file storage capacity and usage.
Microsoft SQL	Collects information about your Microsoft® SQL Servers®.
NTFS	Collects information about your NTFS structure— files, folders, and permissions.
Registry	Collects registry keys and values from available registry hives.


	NOTE: The remote registry service needs to be enabled for the collection of some attributes.

Enterprise Reporter includes the following types of Office 365™ discoveries:

Table 3. Types of Office 365 Discoveries included in Enterprise Reporter
Type	Description
Azure Active Directory	Collects information about your Office 365™ tenant information about your Azure™ users and groups.
Azure Resource	Collects information about your Azure subscriptions.
Exchange Online	Collects information about your Office 365™ tenant and permission information about your Exchange Online™ mailboxes, public folders, contacts, groups (static, dynamic, and unified) and group members.
Microsoft Teams	Collects information about your Microsoft Teams.
OneDrive	Collects information about your Office 365™ tenant and permission information about your OneDrive® files and folders for licensed OneDrive users.

Multi-Factor Authentication Discovery Credential Limitations

Office 365 discoveries support both Multi-Factor Authentication enabled and disabled credentials. However, using Multi-Factor Authentication enabled credentials on Office 365 discoveries may result in an incomplete collection that omits one or more of the following objects and attributes.


	NOTE: The following list may not be comprehensive.

Table 4. Office 365 discoveries that may be excluded due to Multi-Factor Authentication
Type	Omitted objects and attributes
Exchange Online	All Exchange Online Permissions, Mailbox Folders, Mailbox Statistics, Public Folders, Dynamic Groups and Members
Azure Active Directory	Risky users
Azure Resources	Classic Resources

Best Practices for Creating Discoveries

To get the best performance, and meet the needs of your reporting users, there are a number of things you should consider.

For On-Premises and Office 365 Discoveries

•

The default settings of a discovery are designed to optimize performance. If you are going to change them, ensure that your reporting users require the data you are going to collect.

•

Schedule your discoveries to collect data only as frequently as required to satisfy the needs of your reporting users.

For On-Premises Discoveries

•

Group together targets in a discovery based on the data you are collecting. A discovery should collect generally the same data from all targets. For example, if you have some targets from which you only want to collect the Windows folder, and other targets from which you want to collect both the Windows and Program Files folders, you should create two different discoveries. This makes it easier to design and maintain discoveries.

•

Each discovery must be assigned to a cluster. Assign the discovery to the cluster geographically closest to the targets. If necessary, break a discovery into smaller discoveries to accomplish this. By assigning each discovery to a cluster, you can also control which nodes are used for each discovery. For example, you can create one cluster with two nodes for running your Active Directory discoveries and create a second cluster with 5 nodes for running NTFS discoveries.

•

Understand how each discovery type works with tombstoning. For example, you cannot collect SQL information from a single SQL Server using multiple discoveries; however, you can collect NTFS information for a single computer using multiple discoveries. Refer to Table 3. On page 48.

•

The following table contains sample collection timings for on-premises discoveries.

Table 5. Sample collection timings for on-premises discoveries
Discovery Type	Number of Objects	Number of Nodes	Collection Time
Active Directory	100,000 users	1	40 minutes
Active Directory	500,000 users, groups, and computers (includes 10 million group members)	2	11 hours
Computer	200 computers	12	25 minutes
File Storage Analysis	1 server with 1 million files and folders	1	2 hours 25 minutes
Exchange	1,000 mailboxes and 15,000 mailbox folders	1	40 minutes
Exchange	10,000 mailboxes with permissions	1	1 hour 20 minutes
NTFS	5 million files and folders with permissions	6	5 hours 50 minutes
NTFS	31 million files and folders with permissions	10	20 hours

Note: All collection times are affected by hardware specifications and network activity.

For Office 365 Discoveries

•

Microsoft will throttle traffic when they determine the need for it. This means that when an Azure or Office 365 discovery is running, Microsoft will send throttle warnings and force the collection to slow down or stop and wait for a specific period of time. In testing, we have seen a throttling delay period of 2 minutes. We have implemented methods to handle throttle warnings and keep the collection going. The use of multiple credentials can help minimize throttling.

For large collections, it is highly recommended to provide multiple properly-provisioned credentials per discovery. For Azure discoveries, the credentials are alternately used to query the data from the tenant, so using multiple credentials will reduce the number of calls per minute. For OneDrive discoveries, throttling is handled differently and the collection will only switch to an alternate credential if a throttling message is received.

In general, for large Office 365 discoveries, testing has shown that providing 3 or more credentials works very well.If the Enterprise Reporter node log files indicate that the discovery credentials are consistently locked, try adding a credential to the discovery to assist collection.

•

Selecting smaller discoveries improves performance.

For OneDrive discoveries, select only the drives that contain information you need.

For Azure Active Directory discoveries, only collect Office 365 object attributes if they are needed. For large Azure discoveries, we recommend creating multiple discoveries for the same tenant and spitting up discoveries by object type. It is recommended to collect users and groups in one discovery and remaining Azure objects in different discoveries. For Azure Active Directory discoveries, the reason to collect users and groups together is that users are group members and, therefore, will not have to be collected twice.

For Azure Resource discoveries, select only the subscriptions that contain information you need. For large subscriptions, we recommend creating multiple discoveries for each subscription.

•

Understand how each discovery type works with tombstoning. For example, you can collect Azure AD objects from a single tenant across multiple discoveries and data will not be tombstoned. For more information, see How Scopes Affect Tombstoning .

•

Understanding how your discovery will resolve to collection tasks is very important.

For Azure discoveries, as show in Table 6, the scoped tenant will resolve to a single collection task for the tenant. This means that if you want to utilize more nodes for the collection of a single tenant, you should create a discovery by object type for optimal performance. For Azure discoveries, there are 5 object types (users, groups, contacts, roles, and service principals) that can be collected so a maximum of 5 nodes can be used at one time.

For OneDrive discoveries, as shown in Table 6, the scoped tenant will resolve to a single collection task for the tenant, but the discovery will be tombstoned based on the drives, not the object type like Azure AD discoveries. This means that if you want to utilize more nodes for the collection of a single tenant, you must create a discovery for each drive or group of drives. For example, if your tenant has 10 drives, you can create 10 discoveries so a maximum of 10 nodes can be used at the same time.

•

The following table contains sample collection timings for Office 365 discoveries.

Table 6. Sample collection timings for Office 365 discoveries
Discovery Type	Number of Objects	Number of Nodes	Number of Discovery Credentials	Number of Threads (OneDrive only)	Collection Time
Azure AD	30,000	1	2	N/A	30 minutes
Azure AD	300,000	1	1	N/A	5.5 hours
Azure Resource	7 subscriptions with 7,000 resources	1	3	N/A	30 minutes
Exchange Online	1,000 mailboxes	1	1	N/A	8 minutes
Exchange Online	1,000 mailboxes with permissions and delegates	1	1	N/A	3 hours 59 minutes
Exchange Online	1,000 mailboxes with folders	1	1	N/A	1 hour 12 minutes
Exchange Online	1,000 mailboxes with folders	1	3	N/A	24 minutes
Exchange Online	5,000 mailboxes	1	1	N/A	15 minutes
Exchange Online	5,000 mailboxes with permissions	1	1	N/A	4 hours 35 minutes
Microsoft Teams	1,000 teams with 10,000 files and folders	1	1	N/A	1 hour 30 minutes
Microsoft Teams	1,000 teams with 200,000 files and folders	1	1	N/A	5 hours
OneDrive	Drives: 1 Files/Folders: 400,000	1	11	10	17 hours
OneDrive	Drives: 5 Files/Folders: 20,000	1	5	10	1
OneDrive	Drives: 100 Files/Folders: 500,000	1	11	10	21 hours

Note: All collection times are affected by hardware specifications and network activity.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Enterprise Reporter 3.2.2 - Configuration Manager User Guide

Understanding Discoveries

Defining the Data Collection (Discoveries)

Multi-Factor Authentication Discovery Credential Limitations

Best Practices for Creating Discoveries