Linking OneDrive and Sharepoint

Use this guide to connect your Microsoft OneDrive and SharePoint environments to DataDefender.

Connecting Microsoft 365 allows DataDefender to safely inventory personal and shared drives, run continuous security posture checks, and classify sensitive content across your organization.

Azure Scanning Dependency To scan and classify file content inside OneDrive and SharePoint, you must also connect an Azure Subscription within the same tenant that has OneDrive/SharePoint Scanning enabled. That Azure connection provisions the private compute environment that reads and classifies the data.

Go here for more details: Linking Azure Subscriptions

Before You Begin (Prerequisites)

Connecting OneDrive and SharePoint requires administrative access across your Microsoft 365 tenant and a local deployment environment.

Before starting the setup inside DataDefender, ensure you have:

• Tenant Administrative Access: A Microsoft Entra ID (formerly Azure AD) account with Global Administrator or Privileged Role Administrator privileges to grant tenant-wide admin consent for Graph API permissions.

• Terraform CLI: Terraform (v1.3.0 or higher) installed and configured on your local machine or CI/CD runner.

• Azure CLI: Azure CLI (az) installed and authenticated to your target tenant via az login --tenant <YOUR_ENTRA_TENANT_ID>.

• Microsoft Entra Tenant ID: Your unique directory identifier. If you need help finding this, refer to Microsoft's Tenant ID Guide.

Connection Instructions

Step 1: Navigate to Cloud Connectivity

• Log in to DataDefender.

• In the left navigation menu, go to Settings -> Cloud Connectivity.

• Click Add New Connection.

• Select OneDrive / SharePoint from the provider options to open the connection wizard.

Step 2: Download the Terraform Module

• In the setup wizard, click Download Terraform Package to download the dedicated M365 deployment files.

• Unpack the downloaded .zip file into your local working directory.

Step 3: Deploy the Terraform Module

Deploy the module to register the required enterprise application and configure Federated Identity Credentials (FIC) in your Entra tenant.

1. Authenticate to Azure CLI

Open your terminal and ensure your CLI session targets the correct Microsoft 365 tenant:

az login --tenant YOUR_ENTRA_TENANT_ID

2. Initialize Terraform

Navigate to your unzipped directory and initialize the provider plugins:

terraform init

3. Execute the Deployment

Copy the pre-populated apply command directly from the DataDefender setup page and execute it:

terraform apply -var 'entra_tenant_id=YOUR_ENTRA_TENANT_ID' -var 'organization_id=ORGANIZATION_ID' -var 'fic_subject=datadefender.orgEntra.ORGANIZATION_ID' -var 'fic_issuer=[https://auth.datadefender.io/realms/datadefender](https://auth.datadefender.io/realms/datadefender)'

4. Confirm Execution

Review the proposed resources in your terminal and type yes to perform the deployment and consent registration.

Step 4: Configure Connection Details

Once Terraform finishes applying, populate the setup form fields in the DataDefender console using your deployment outputs:

• Account Name (Optional): Enter a friendly display label for this environment (e.g., Corporate M365 Production).

• Tenant ID: Enter your Microsoft Entra Tenant ID.

• Backend Application Client ID: Enter the backend_app_client_id string printed in your terminal output:

Outputs:
backend_app_client_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

Step 5: Connect and Verify

• Review your entered values for accuracy.

• Click Connect & Verify.

DataDefender will perform an immediate automated handshake via Federated Identity Credentials (FIC) to confirm API connectivity and verify Microsoft Graph permissions across your OneDrive and SharePoint drives.

Troubleshooting & Common Issues

Issue	Likely Cause	Resolution
Admin Consent Missing	Non-admin deployment session	Ensure the user running the Terraform script or approving the app registration holds Global Administrator permissions to grant Microsoft Graph application scopes.
Authentication Failed (FIC Error)	Mismatched Subject or Issuer URL	Confirm that the fic_subject and fic_issuer values used in your terraform apply command match the exact strings shown in your DataDefender portal without trailing spaces.
Content Scanning Inactive	Missing Azure scanning compute	Verify that you have linked at least one Azure subscription within the same tenant with the OneDrive / SharePoint Scanning toggle enabled.
Tenant ID Not Found	Multi-directory account mismatch	Confirm your CLI is pointed to the directory containing your OneDrive/SharePoint instances by running az account show and inspecting the tenantId value.