Logs uploading but Cloud App discovery dashboard not updating

[stuart townsend]

Hi, I have implemented a log collector to send logs from my TMG server to CAS. The log collector is called TMG-02. The logs copied, using FTP, to the log collector which then uploads them to CAS. The first run of this 2 files were uploaded and I could see these where successfully parser by viewing the governance log. After probably 20 minutes the discovery dashboard populated. However, if I change the scope from Global to just view TMG-02 it is blank, which doesn't see right to me. Also, when the same files, which now contain more data are uploaded the Cloud App discovery dashboard doesn't update even though I can see they have been successfully uploaded and parser. Also, if I create a snapshot report from these files I see the information that I expect.

Why am I not seeing any discovery data if I just select the log collector of TMG-02 and more importantly why is the discovery dashboard updating with the information from the updated logs?

Regards,

Stuart

[#2]

Hi Stuart,

As indicated in MCAS documentation (https://docs.microsoft.com/en-us/cloud-app-security/set-up-cloud-discovery), you can see that continuous report data is analyzed twice a day, and might take some time to be populated in case of newly created reports. Could you share some details on how long did you wait before checking the data?

Thanks,

Danny.

[#3 · Accepted solution]

Hi Danny,
Thanks for the reply. I’m out of the office at the moment but I’ll check when I get back. I had only waited a maximum of 3-4 hours so I guess it will be updated now.
Thanks again,
Stuart

[#4]

Thanks Danny that was exactly what my problem was.

As a side note, do you know if there is a way of removing a connected app in the portal? I have accidentally connected to the same Okta organization twice and want to remove one of the connections?

[#5]

Hi Stuart,

API connector can be disabled by our support team.

Please contact them in ceilsupport@microsoft.com.

Danny.

[#6]

Thanks Danny,

I have sent them an e-mail.

Would you mind answering a couple of other questions that I have as I'm currently evaluating CAS  with a view to recommending it to our customers?

My questions are:

1. Is there anyway of changing the account used to connect to Office 365, SharePoint and OneDrive as I connected using my account and I would have thought that you'd be better having a dedicated account as my password will change and also I have MFA enabled. Is the account that you are logged in with used ongoing for connecting to these Microsoft applications. I see that other apps you can specify and change the token.

2. I am just looking at Conditional Access App Control and I see that Office 365 applications are not configured with SAML so they are not currently supported. So does this mean that CAS cannot be used to force encryption on downloaded files or to even block downloads on unmanaged devices from OneDrive for Business and SharePoint Online?

Thanks in advance,

Stuart

[#7]

Hi Stuart,

The connection to Office 365 is created using app credentials and not the user ones. The user is only needed to verify you actually have the required permissions to initiate the connection, once established the connection is independent.

Regards,

Dima

[#8]

Thanks for clearing this up for me. The reason that I asked this is that I have 7 connected apps and 2 of these are OneDrive for Business and SharePoint Online and these keep showing Connection Error (the others are fine). When I look at the error it is the same for both which is: 

Get Users: Failed fetching users from /:
HttpRequestFailure: Server returned: 429
[Content-Type: text/plain; charset=utf-8, Retry-After: 30, Server: Microsoft-IIS/8.5, SPRequestGuid: 41638b9e-2001-0000-2468-b00fd299d6b4, request-id: 41638b9e-2001-0000-2468-b00fd299d6b4, MS-CV: notjQQEgAAAkaLAP0pnWtA.0, Strict-Transport-Security: max-age=31536000, SPRequestDuration: 32, SPIisLatency: 0, X-Powered-By: ASP.NET, MicrosoftSharePointTeamServices: 16.0.0.8029, X-Content-Type-Options: nosniff, X-MS-InvokeApp: 1; RequireReadOnly, P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI", Date: Tue, 04 Sep 2018 10:01:00 GMT, Content-Length: 21]

429 TOO MANY REQUESTS
Get Users: Success
Get Files: Failed listing site collection https://computacenterems-my.sharepoint.com/ (path /):
User email: , Error: HttpRequestFailure: Server returned: 429
[Content-Type: text/plain; charset=utf-8, Retry-After: 30, Server: Microsoft-IIS/8.5, SPRequestGuid: 76638b9e-0002-0000-30d2-2b61bc8ac573, request-id: 76638b9e-0002-0000-30d2-2b61bc8ac573, MS-CV: notjdgIAAAAw0ithvIrFcw.0, Strict-Transport-Security: max-age=31536000, SPRequestDuration: 36, SPIisLatency: 0, X-Powered-By: ASP.NET, MicrosoftSharePointTeamServices: 16.0.0.8029, X-Content-Type-Options: nosniff, X-MS-InvokeApp: 1; RequireReadOnly, P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI", Date: Tue, 04 Sep 2018 10:04:38 GMT, Content-Length: 21]

429 TOO MANY REQUESTS.

I've attached a screenshot of the connection error for OneDrive for Business

[#9]

Its a temporary error caused by reaching the API limits of the service. It resolves itself automatically and doesnt impact any functionality.