Forum Discussion
Solved
Cloud App Security - Admin Quarantine with SharePoint
We want to setup the admin quarantine in Cloud App Security pointing to SharePoint. Unfortunately we see only OneDrive locations and only 2-3 SharePoint sites.
Is there a known configuration for the SharePoint sites, that they get available in MCAS? I couldn't find any information on the docs or other blogs.
Documentation has been updated.
Cloud App Security only detects new SharePoint and OneDrive folders, including if they are set as the admin quarantine folder, after some file activity has been performed in them.
Protect files with Cloud App Security admin quarantine | Microsoft Docs
- Sarahzin_Shane
Microsoft
Hi NiklasM! The SPO sites that are missing... were those names changed ever? Or, are they the names that were first assigned to those sites when they were created?
Sarahzin_ShaneWe have two scenarios:
1.) Our customer created a new site only for this and the name was not changed after the creation. The site is not visible in MCAS. But sites that are created the same way (maybe different permissions) are available.
2.) I also tested it with the Contoso Test Tenant and there are only the sites "https://m365x123456.sharepoint.com" and "https://m365x123456.sharepoint.com/portals/hub" available. I have not changed anything in the Contoso Tenant yet.
I will create a new site in my Contoso Tenant to see if I can get deeper in this topic. But at the end it would be important, also for the Docs, to have a clear answer how to configure the SharePoint Site.
NiklasM Sarahzin_Shane I've also ran into this issue in multiple M365 tenants. Initially only OneDrive user sites appear in the list when searching for an Admin quarantine folder location, but over time SharePoint sites start to appear in the results. I don't recall the exact timing, but it did take several days before the dedicated SpO site that was created specifically for the Admin Quarantine appeared in the search results for assignment of the Admin Quarantine folder location.
Questions
- Could this be some type of indexing delay (within MCAS or SpO/O365 Graph, etc.) that follows initial service integration (AIP/O365 Connector - Files)?
- If so, could the Docs be updated to set a reasonable expectation for how long it may take once a new SpO site is created until it's available to actually assign to the Admin Quarantine folder location (via search results)?
- Is there any way to speed up the process?
