Registering a Microsoft Entra ID application enables Trellix DLP Discover to authenticate with SharePoint Online and OneDrive for Business using Modern Authentication (OAuth 2.0). This setup provides secure, certificate-based access to your Microsoft 365 tenant without storing user credentials.
To complete the setup, register the application to retrieve its Client and Tenant IDs, assign necessary Microsoft Graph and SharePoint application permissions (Base for scanning/classification, or Advanced for remediation), and generate a certificate pair to link Azure AD with Trellix ePO.
Register an application in Microsoft Entra ID:
Sign in to the Azure Portal and navigate to Microsoft Entra ID → App registrations → New registration.
Enter a name for the application (for example, DLP Discover SharePoint Scanner).
Under Supported account types, select Accounts in this organizational directory only.
Click Register.
On the application's Overview page, record the following values. You will need them when configuring the repository in Trellix ePO:
Application (client) ID
Directory (tenant) ID
Grant API permissions:
Select API permissions → Add a permission.
Add the permissions listed below. Select Application permissions (not Delegated) for all entries, as Trellix DLP Discover runs as a background service.
Note
Add only the Base permissions unless you intend to use advanced remediation actions such as applying sensitivity plain labels or encrypting labels to protect files. In that case, add the Advanced permissions.
Microsoft graph permissions
Base — Scanning & Classification
Permission | Description |
|---|---|
Files.Read.All | Read files in all site collections |
Sites.Read.All | Read items in all site collections |
ServiceActivity.OneDrive.Read.All | Read all OneDrive service activity |
User.Read.All | Read all users' full profiles |
InformationProtectionPolicy.Read.All | Read Information Protection policies |
Directory.Read.All | Read directory data |
Advanced — Remediation Actions
Permission | Description |
|---|---|
Directory.ReadWrite.All | Read and write directory data |
Files.ReadWrite.All | Read and write files in all site collections |
Group.ReadWrite.All | Read and write all groups |
Sites.ReadWrite.All | Read and write items in all site collections |
Sites.FullControl.All | Full control of all site collections |
User.ReadWrite.All | Read and write all users' full profiles |
SharePoint Permissions
Base — Scanning
Permission | Description |
|---|---|
OneDrive.Provision.All | Provision OneDrive for Business drives without a signed-in user |
AllSites.Read | Read items in all site collections |
Sites.Read.All | Read items in all site collections |
User.Read.All | Read user profiles |
Advanced — Remediation Actions
Permission | Description |
|---|---|
Sites.ReadWrite.All | Read and write items in all site collections |
Sites.FullControl.All | Full control of all site collections |
User.ReadWrite.All | Read and write user profiles |
Obtain a certificate
DLP Discover authenticates to Azure AD using a certificate (X.509), You need two files:
Public key file (.cer / .crt / .pem) — uploaded to Azure AD
Private key file (.pfx, password-protected) — supplied to Trellix ePO
Obtain the certificate from your organization's Certificate Authority (CA). If you do not have a CA-issued certificate, you can generate a self-signed certificate using PowerShell. For detailed instructions to create a self-signed certificate, see article 000015305.
Important
Store the .pfx file and its password securely. The password cannot be recovered if lost.
Upload the certificate to Azure AD
In the app registration, select Manage → Certificates & secrets → Certificates → Upload certificate.
Browse to your public key file (.cer / .crt / .pem), optionally add a description (for example, Trellix ePO), and click Add.