Configuration of SharePoint Online Inventory - Not Applicable if using EmpowerID SaaS

If you are not using EmpowerID SaaS and want EmpowerID to manage one or more of your SharePoint tenants, you need to configure one of those tenants as described in this article for EmpowerID to inventory your SharePoint Online (SPO) data. Please note that you must also deploy the SharePoint online microservice in each of your SharePoint tenants as depicted in the Deploying the SharePoint Online microservice topics.

Step 1 – Create a CosmosDB account

1. Create a Cosmos DB account with the following settings:

   • Account Name – Enter a name for database account

   • API – Core (SQL)

   • Location – Select the appropriate geographic location

   • Capacity mode – Provisioned throughput

Step 2 – Create a Storage Account

1. Create a storage account with the following settings:

   • Secure transfer required – Enabled

   • Allow Blob public access – Enabled

   • Allow storage account key access – Enabled

   • Minimum TLS version – Version 1.2

   • Blob access tier (default) – Hot

   • Large file shares – Disabled

   • Replication – Read-access geo-redundant storage (RA-GRS)

   • Azure Active Directory Domain services (Azure AD DS) – Disabled

   • Data Lake Storage Gen2 – Disabled

   • NFS v3 – Disabled

2. Copy the connection string for later use.

Step 3 – Create a Service Bus

1. Create a service bus with the basic pricing tier and copy the connection string for later use.

Sep 4 – Create an App Service for the AzGeneralServices Microservice

1. Create a Linux app service plan.

2. Add an app service for the AzGeneralServices microservice to the Linux app service plan with the following general settings:

   • Stack – .NET

   • Major version – .NET Core 3

   • FTP state – All allowed

   • HTTP version – 1.1

   • Web sockets – Off

   • Always on – Off

   • ARR affinity – Off

   • Debugging – Off

   • Client certificate mode – Ignore

3. Turn on system managed identity for the app service and download the publish profile from the overview blade.

4. In EmpowerID, publish the AzGeneralServices microservice to Azure.

5. Create a service principal in Azure active directory with the following settings:

   • Secret – Create a secret for the service principal and copy the value for later use.

   • Configure the service principal for Azure AD authentication.

6. Return to the Cosmos DB account created earlier and create a new container and DB for the AZ General Services microservice with the below settings. The DB will be used by the service to persist data whenever EmpowerID makes a call to the service.

   • Database Id – AzureGeneralService

   • Container Id – AzureGeneralService

   • Partition key – id

Step 5 – Create a Key Vault

1. Create an Azure Key Vault for the Azure General app service with all the default setting.

2. Create an access policy for the key vault with the following settings:

   • Key permissions

     • Get

     • Decrypt

     • Unwrap

     • Verify

   • Secret permissions

     • Get

     • List

     • Set

     • Delete

     • Purge

   • Service principal – Azure General service app

3. Add the following config settings to the AzGeneral service app service:

   • CosmosDbAuthKey – Primary key of the cosmos db account

   • CosmosDbContainerId – Container Id that was created in the above steps

   • CosmosDbEndpoint – URI of Cosmos db account

   • CosmosDbDatabaseId - Container Id that was created in the above steps

   • KeyVaultUrl – Vault Uri of the Key vault created in the above steps

4. Create config necessary for SPO Inventory using Azure General service.

   • Generate a unique GUID and keep it for reference. This Id is called config settings id.

   • Request URL of the Azure General service to call: <Azure general service app service url>/app/config/GetById/<unique guid generated above>

   • Body of the request is shown below – Please change the details according to the comments.

   • Add a new item to the Cosmos DB
     
     Currently, there is no UI for making this call in EmpowerID; therefore use a tool like Postman to make the call.