Cloud App Security - Admin Quarantine with SharePoint

[NiklasM]

We want to setup the admin quarantine in Cloud App Security pointing to SharePoint. Unfortunately we see only OneDrive locations and only 2-3 SharePoint sites.

Is there a known configuration for the SharePoint sites, that they get available in MCAS? I couldn't find any information on the docs or other blogs.

[#2]

Hi @NiklasM! The SPO sites that are missing... were those names changed ever? Or, are they the names that were first assigned to those sites when they were created? 

[#3]

@Sarahzin_ShaneWe have two scenarios:

1.) Our customer created a new site only for this and the name was not changed after the creation. The site is not visible in MCAS. But sites that are created the same way (maybe different permissions) are available.

2.) I also tested it with the Contoso Test Tenant and there are only the sites "https://m365x123456.sharepoint.com" and "https://m365x123456.sharepoint.com/portals/hub" available. I have not changed anything in the Contoso Tenant yet.

I will create a new site in my Contoso Tenant to see if I can get deeper in this topic. But at the end it would be important, also for the Docs, to have a clear answer how to configure the SharePoint Site.

[#4]

@NiklasM @Sarahzin_Shane I've also ran into this issue in multiple M365 tenants.  Initially only OneDrive user sites appear in the list when searching for an Admin quarantine folder location, but over time SharePoint sites start to appear in the results.  I don't recall the exact timing, but it did take several days before the dedicated SpO site that was created specifically for the Admin Quarantine appeared in the search results for assignment of the Admin Quarantine folder location.  

Questions

• Could this be some type of indexing delay (within MCAS or SpO/O365 Graph, etc.) that follows initial service integration (AIP/O365 Connector - Files)? 
• If so, could the Docs be updated to set a reasonable expectation for how long it may take once a new SpO site is created until it's available to actually assign to the Admin Quarantine folder location (via search results)? 
• Is there any way to speed up the process?

[#5]

@NiklasM @Sarahzin_Shane 

UPDATE:  Found this info in a previous thread 

MCAS detects new folders only after some file activity has been performed in them.

I suggest you upload a single file to the new folder, which will cause MCAS to pick it up.

Questions

• Could this be some type of indexing delay (within MCAS or SpO/O365 Graph, etc.) that follows initial service integration (AIP/O365 Connector - Files)? 
• If so, could the Docs be updated to set a reasonable expectation for how long it may take once a new SpO site is created until it's available to actually assign to the Admin Quarantine folder location (via search results)? - The info above would be helpful to include in the Docs article on Admin Quarantine.
• Is there any way to speed up the process? - Yes, see above.

[#6 · Accepted solution]

@ialvan @NiklasM 

Documentation has been updated.

Cloud App Security only detects new SharePoint and OneDrive folders, including if they are set as the admin quarantine folder, after some file activity has been performed in them.

Protect files with Cloud App Security admin quarantine | Microsoft Docs

[#7]

@ialvan @Sarahzin_Shane @NiklasM 

I have created new tenant and it been about more than a month and still I could not see any folder of sites being detected and when when try to add any new location then also i get an error.