Trellix DLP Discover can crawl SharePoint Online and OneDrive for Business repositories to discover and classify sensitive data stored in Microsoft 365 environment.
Microsoft has discontinued the legacy username-and-password (Basic Authentication) method for accessing SharePoint Online. Organizations still using Basic Authentication will lose connectivity to their Microsoft 365 repositories once Microsoft disables the legacy standard. Trellix DLP Discover has been updated to support Modern Authentication (OAuth 2.0) to ensure uninterrupted scanning and compliance with Microsoft's new security requirements.
With Modern Authentication, Trellix DLP Discover authenticates as a registered Microsoft Entra ID application using a certificate, not as an individual user. No user passwords are stored or transmitted. The crawler obtains a short-lived access token from Microsoft Entra ID and uses it to connect to SharePoint and OneDrive APIs.
Note
On-premises SharePoint environments are not affected by this change and continue to use existing credentials.
Benefits
Uninterrupted Scanning: SharePoint Online crawls continue working after Microsoft enforces the Basic Authentication deprecation.
Improved Security: Trellix DLP Discover never stores or transmits user passwords. Certificate-based authentication reduces credential exposure risk.
Least-Privilege Access: The Microsoft Entra ID app is granted only the API permissions Trellix DLP Discover needs, scoped to read access for scanning.
Enable SharePoint Online and OneDrive in Trellix ePO
Link the Entra ID app registration to a Trellix DLP Discover repository. This step activates OAuth 2.0 authentication for all scans targeting SharePoint Online and OneDrive for Business.
Prerequisites:
Install .Net version 4.8 if you are running Windows Server version 2012, 2016 and 2019.
Create a Microsoft Entra ID App Registration and obtain a certificate.
Task:
In Trellix ePO, navigate to DLP Discover → Definitions → Repositories → SharePoint → New.
From the Authentication drop-down, select OAuth 2.0 certificate credentials (Entra ID App).
Enter the following values from your Azure AD App Registration:
Client ID— Application (client) ID from the app registration
Tenant ID— Directory (tenant) ID from the app registration
Upload the password-protected .pfx certificate file (the private key matching the certificate uploaded to Azure AD) and enter the certificate password.
Click Save.
Result:
The repository is now available for use in SharePoint Online scan configurations.