Chat now with support
Chat with Support

Enterprise Reporter 3.5.1 - Release Notes

Permissions for Enterprise Reporter tenant applications

Enterprise Reporter requires Azure applications for the collection of Azure and Microsoft 365 objects and attributes. These applications must be registered in the Azure portal and consent must be granted for delegated permissions. To manage tenant applications used by Enterprise Reporter, you use the Configuration | Application Tenant Management option.

Azure Active Directory application permissions

For the Azure Active Directory discovery, the Exchange Online discovery, and the collection of nested group members for the OneDrive, Exchange Online, and Azure Resource discovery, an application with a name that begins with “Quest Enterprise Reporter Azure Discovery” is created. To create this application in your tenant, you must specify an account with administrative access to create applications. The account must have the Global Administrator role to be able to create and consent to the application.

Once created, the application must also be delegated permissions and an administrator must consent to the application’s permissions using the Microsoft consent wizard. For the Enterprise Reporter Azure discovery application, the following permissions are required:

 

Table 19. Required permissions
API Name
Permission
Permission Description
Type

Microsoft Graph

User.ReadBasic.All

Read all users' basic profiles

Delegated

Microsoft Graph

Directory.AccessAsUser.All

Access directory as the signed in user

Delegated

Microsoft Graph

Directory.Read.All

Read directory data

Delegated

Microsoft Graph

Group.Read.All

Read all groups

 

Microsoft Graph

IdentityRiskyUser.Read.All

Read identity risky user information

Delegated

Microsoft Graph

SecurityEvents.Read.All

Read your organization's security events

Delegated

Microsoft Graph

User.Read.All

Read all users' full profiles

Delegated

Microsoft Graph

Reports.Read.All

Read all usage reports

Delegated

Microsoft Graph

UserAuthenticationMethod.Read.All

Read all users' authentication methods

Delegated

Collecting user activity information

If you want to collect details about Microsoft 365 user activity, such as which licenses are assigned to a user and dates when a user last used a licensed service, the following delegated permission is required:

•
Microsoft Graph: Read all usage reports

Also, you must clear the Microsoft default setting that anonymizes the user-level data. To include user activity data in the Enterprise Reporter reports, do the following steps:

1
Open the Microsoft 365 admin center.
2
Navigate to Settings | Org Settings | Services.
3
Select Reports.
4
Clear the Display concealed user, group, and site names in all reports check box.

For more information, see https://learn.microsoft.com/en-US/microsoft-365/troubleshoot/miscellaneous/reports-show-anonymous-user-name

OneDrive application permissions

For the OneDrive discovery, an application with a name that begins with “Quest Enterprise Reporter OneDrive Discovery” is created. To create this application in your tenant, you must specify an account with administrative access to create applications. The account must have the Global Administrator role to be able to create and consent to the application.

Once created, the application must also be delegated permissions and an administrator must consent to the application’s permissions using the Microsoft consent wizard. For the Quest Enterprise Reporter OneDrive Discovery application, the following permissions are required:

 

Table 20. Required permissions
API Name
Permission
Permission Description
Type

Microsoft Graph

Directory.Read.All

Read directory data

Delegated

Microsoft Graph

Files.Read.All

Read all files that user can access

Delegated

Microsoft Graph

Sites.FullControl.All

Have full control of all site collections

Delegated

Microsoft Graph

Directory.AccessAsUser.All

Access directory as the signed in user

Delegated

Office 365 SharePoint Online

MyFiles.Read

Read user files

Delegated

Azure Resource application permissions

For the Azure Resource discovery, an application with a name that begins with “Quest Enterprise Reporter Azure Resource Discovery” is created. To create this application in your tenant, you must specify an account with administrative access to create applications. The account must have the Global Administrator role to be able to create and consent to the application.

Once created, the application must also be delegated permissions and an administrator must consent to the application’s permissions using the Microsoft consent wizard. For the Enterprise Reporter Azure Resource discovery application, the following permissions are required:

 

Table 21. Required permissions
API Name
Permission
Permission Description
Type

Microsoft Graph

User.ReadBasic.All

Read all users' basic profiles

Delegated

Microsoft Graph

Directory.AccessAsUser.All

Access directory as the signed in user

Delegated

Windows Azure Service Management API

user_impersonation

Access Azure Service Management as organization users

Delegated

Microsoft Teams application permissions

For the Microsoft Teams discovery, an application with a name that begins with “Quest Enterprise Reporter Microsoft Teams Discovery” is created. To create this application in your tenant, you must specify an account with administrative access to create applications. The account must have the Global Administrator role to be able to create and consent to the application.

Once created, the application must also be delegated permissions and an administrator must consent to the application’s permissions using the Microsoft consent wizard. For the Quest Enterprise Reporter Microsoft Teams Discovery application, the following permissions are required:

 

Table 22. Required permissions
API Name
Permission
Permission Description
Type

Microsoft Graph

Directory.Read.All

Read directory data

Delegated

Microsoft Graph

User.ReadBasic.All

Read all users' basic profiles

Delegated

Microsoft Graph

Files.Read

Read user files

Delegated

Microsoft Graph

Sites.FullControl.All

Have full control of all site collections

Delegated

Microsoft Graph

Directory.AccessAsUser.All

Access directory as the signed in user

Delegated

Microsoft Graph

Group.Read.All

Read all groups

Delegated

Office 365 SharePoint Online

MyFiles.Read

Read user files

Delegated

SharePoint Online application permissions

For the SharePoint Online discovery, an application with a name that begins with “Quest Enterprise Reporter SharePoint Online Discovery” is created. To create this application in your tenant, you must specify an account with administrative access to create applications. The account must have the Global Administrator role to be able to create and consent to the application.

Once created, the application must also be delegated permissions and an administrator must consent to the application’s permissions using the Microsoft consent wizard. For the Quest Enterprise Reporter SharePoint Online Discovery application, the following permissions are required:

 

Table 23. Required permissions
API Name
Permission
Permission Description
Type

Microsoft Graph

Directory.Read.All

Read directory data

Delegated

Microsoft Graph

Sites.FullControl.All

Have full control of all site collections

Delegated

Upgrade and compatibility

 

Upgrade and compatibility

Note the following when upgrading to Enterprise Reporter:

•
Disable clusters to stop discoveries from being sent to the nodes
•
Cancel any jobs running on the nodes to stop data from writing to the Enterprise Reporter database
•
Create a backup of the database
•
Note the port number being used by the Enterprise Reporter server
•
Upgrade the Enterprise Reporter components
•
Upgrade the database
•
Upgrade the nodes
•
Manually upgrade any manually configured nodes
•
Enable any disabled clusters to resume discoveries
•
After upgrade to Enterprise Reporter 3.5.1, you must reconfigure all tenant applications. Open the Tenant Application Manager. For each tenant, click Reconfigure beside each application. Complete the wizard to register the application and reconsent to application permissions.
•
After upgrade, you must authenticate all Azure credentials. Open the Credential Manager, select Azure credential, click Edit and Click Authenticate.

Upgrades to Enterprise Reporter are supported from the following versions:

•
Enterprise Reporter 3.5 HF1
•
Enterprise Reporter 3.5 HF2
•
Enterprise Reporter 3.5
•
Enterprise Reporter 3.2.2 H1
•
Enterprise Reporter 3.2.2
•
Enterprise Reporter 3.2.1 H1
•
Enterprise Reporter 3.2.1
•
Enterprise Reporter 3.2 H1
•
Enterprise Reporter 3.2
•
Enterprise Reporter 3.1
•
Enterprise Reporter 3.0
 
* 
IMPORTANT: After upgrading, it is recommended that you re-publish any reports previously in Quest SSRS to receive all updates and fixes.

Product licensing

To activate a trial or purchased commercial license
1
Copy the license you received from Quest to your Desktop, or another convenient location.
2
Ensure that the Enterprise Reporter Configuration Manager is installed.
3
Launch the Configuration Manager from the Start Menu and connect to the Enterprise Reporter server.
4
For first-time installations, the Licensing dialog box is displayed.
- OR -
Navigate to System | Information and click the View licensing information link.
5
Click Update License in the Licenses dialog box.
6
Navigate to the location of your license file and select it.
7
Click Open to apply the license.
8
Repeat steps 6-7 for each license file supplied by Quest.
9
Click OK to exit the licenses tab.

Getting started with Enterprise Reporter 3.5.1

The following section outlines how to get started with Enterprise Reporter and includes links to the technical documentation and Enterprise Reporter community for additional resources.

See also:

•
Upgrade and Installation instructions
•
Additional resources
•
Upgrade and Installation instructions
•
Additional resources
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating