From db20c61dd303a5236c933ffa9482723f26cf246f Mon Sep 17 00:00:00 2001 From: Ben Hayman Date: Wed, 9 Sep 2026 12:19:33 +0100 Subject: [PATCH 01/15] Split Exchange instructions into Graph and EWS instructions --- ...changemailbox.md => exchangemailboxews.md} | 24 ++++----- .../addsource/exchangemailboxgraph.md | 50 +++++++++++++++++++ ...exchangeserver.md => exchangeserverews.md} | 23 +++++---- .../addsource/exchangeservergraph.md | 50 +++++++++++++++++++ .../addsource/sharepointonline.md | 2 +- 5 files changed, 125 insertions(+), 24 deletions(-) rename docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/{exchangemailbox.md => exchangemailboxews.md} (84%) create mode 100644 docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md rename docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/{exchangeserver.md => exchangeserverews.md} (87%) create mode 100644 docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailbox.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md similarity index 84% rename from docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailbox.md rename to docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md index fb4bb787ab..e53aa9d5b0 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailbox.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md @@ -1,18 +1,18 @@ --- -title: "Exchange Mailbox" -description: "Exchange Mailbox" +title: "Exchange Mailbox (EWS)" +description: "Exchange Mailbox (EWS)" sidebar_position: 30 --- # Exchange Mailbox -Use the **Exchange Mailbox** source to enable the crawling and classification of content stored in a -single Exchange mailbox on the on-premises Exchange server or Exchange Online. +Use the **Exchange Mailbox (EWS)** source to enable the crawling and classification of content stored in a +single Exchange mailbox on the on-premises Exchange server or Exchange Online using the Exchange Web services (EWS). **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. -**Step 2 –** Select **Exchange Mailbox** source type and in the properties window specify the +**Step 2 –** Select the **Exchange Mailbox (EWS)** source type and in the properties window specify the necessary settings. ## Authentication type: Modern authentication @@ -22,11 +22,11 @@ specify the following: | Option | Description | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Authentication type | Select **Modern (Exchange Online)** | +| Authentication type | Select **Modern (O365)** | | Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | -| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (it can be found in the Azure AD app properties >**Overview**). | ![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) @@ -36,7 +36,7 @@ If you plan to use this authentication type, you will need to specify the follow | Option | Description | Comments | | ------------------------ | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Email Address / Password | **Administrator** account that has been assigned both: 1. **Impersonation** right 2. **Discovery Management** role | See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details on the rights assignment. | +| Email Address / Password | An **Administrator** account that has been assigned both: 1. **Impersonation** right 2. **Discovery Management** role | See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details on the rights assignment. | ## Other configuration settings @@ -47,13 +47,13 @@ By default, only basic settings are displayed. To view advanced options, click t | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Basic settings** | | | | Mailbox | Mailbox to be crawled. | When using impersonation, the settings can be like the following example: | -| Crawl Range | Define what portions of data should be retrieved from the Exchange server: | | +| Crawl Range | Define the time period to be crawled: | | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | Applies to Exchange Online. | -| OCR Processing Mode | Set the processing mode for document images: | The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | -| Source Group | Select the source group (if any). | | +| OCR Processing Mode | Set the processing mode for document images: | The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images do not contain text. | +| Source Group | Select the source group to add this source to (if any exist). If no source groups exist, a new source group will be automatically created | | | Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | | **Advanced settings** | | | | Build Search Index | Select if you want search index to be created. | | | Re-Index Period | Specify how often the source should be checked for changes. Default is **7** days. | Netwrix recommends using default values. | | Priority | Set priority for this data source to be crawled. Select the priority level from the list values: | | -| Document Type | Specify a value that you can use to restrict queries when using the Netwrix Data Classification search index. | | +| Document Type | Specify a value which can be used to restrict queries when utilizing the Netwrix Data Classification search index. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md new file mode 100644 index 0000000000..3be5f0bc5c --- /dev/null +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -0,0 +1,50 @@ +--- +title: "Exchange Mailbox (Graph)" +description: "Exchange Mailbox (Graph)" +sidebar_position: 30 +--- + +# Exchange Mailbox (Graph) + +Use the **Exchange Mailbox (Graph)** source to enable the crawling and classification of content stored in a +single Exchange mailbox on Exchange Online. + +**Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click +**Add**. + +**Step 2 –** Select **Exchange Mailbox (Graph)** source type and in the properties window specify the +necessary settings. + +## Authentication + +You must specify the following: + +| Option | Description | +| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it in order to crawl Exchange. | +| Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | +| Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (it can be found in the Azure AD app properties >**Overview**). | + +![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) + +## Other configuration settings + +By default, only basic settings are displayed. To view advanced options, click the "wrench" icon at +**Settings** in the bottom. + +| Option | Description | Comments | +| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **Basic settings** | | | +| Cloud Environment | Select the Azure instance the Exchange Online server is hosted on. | | +| Mailbox | Mailbox to be crawled. | When using impersonation, the settings can be like the following example: | +| Crawl Range | Define what portions of data should be retrieved from the Exchange server: | | +| Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | | +| OCR Processing Mode | Set the processing mode for document images: | The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images do not contain text. | +| Source Group | Select the source group (if any). | | +| Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | +| **Advanced settings** | | | +| Build Search Index | Select if you want search index to be created. | | +| Re-Index Period | Specify how often the source should be checked for changes. Default is **7** days. | Netwrix recommends using default values. | +| Priority | Set priority for this data source to be crawled. Select the priority level from the list values: | | +| Document Type | Specify a value which can be used to restrict queries when utilizing the Netwrix Data Classification search index. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserver.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md similarity index 87% rename from docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserver.md rename to docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md index 672ebb45df..b5d8a5d71e 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserver.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md @@ -1,30 +1,31 @@ --- -title: "Exchange Server" -description: "Exchange Server" +title: "Exchange Server (EWS)" +description: "Exchange Server (EWS)" sidebar_position: 40 --- # Exchange Server -Use the Exchange Server source configuration screen to enable the crawling and classification -of multiple Exchange mailboxes from the same Exchange server. +The Exchange Server (EWS) source configuration screen allows you to enable the crawling and classification +of multiple Exchange mailboxes from the same Exchange server using the Exchange Web services (EWS). -**IMPORTANT** Automatic detection, crawling, and classification of multiple Exchange mailboxes from +**IMPORTANT!** Automatic detection, crawling and classification of multiple Exchange mailboxes from the same Exchange server (and, respectively, _Exchange Server_ content source configuration) is only supported for Exchange Server 2013 or later due to limitations in the Microsoft APIs. For earlier versions, consider using _Exchange Mailbox_ content source. You can use Match Rules to include and exclude the certain mailboxes. -To configure an Exchange Server source, follow these steps. +Follow the steps to configure an Exchange Server (EWS) source. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. -**Step 2 –** Select **Exchange** source type and in the properties window specify the necessary +**Step 2 –** Select **Exchange (EWS)** source type and in the properties window specify the necessary settings. -**Step 3 –** To display all settings, click the "wrench" icon next to **Settings**. +**Step 3 –** Remember to click the "wrench" icon next to **Settings** in the bottom-left corner to +display all settings. ## Authentication type: Modern authentication @@ -40,10 +41,10 @@ If you plan to use this authentication type, specify the following: | Option | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Authentication type | Select **Modern (Exchange Online)** | -| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | +| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it in order to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | -| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (it can be found in the Azure AD app properties >**Overview**). | ![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) @@ -61,7 +62,7 @@ The following settings are also required in both cases: | Option | Description | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Exchange API URL | By default, the crawling engine will attempt to locate the necessary URL of Exchange Web Services API by using the _Exchange AutoDiscover_ functionality. So, typically, you can leave this field blank. If, however, the _Exchange AutoDiscover_ isn't available, then you should specify the Exchange API URL explicitly as follows: `https:///EWS/Exchange.asmx`. | +| Exchange API URL | By default, the crawling engine will attempt to locate the necessary URL of Exchange Web Services API by using the _Exchange AutoDiscover_ functionality. So, typically, you can leave this field blank. If, however, the _Exchange AutoDiscover_ is not available, then you should specify the Exchange API URL explicitly as follows: `https:///EWS/Exchange.asmx`. | | Crawl Range | Define what portions of data should be retrieved from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| | Match Rules | Define which mailboxes will be crawled as part of an Exchange Server source. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter if you want all mailboxes to be crawled | | Detection Period | Specify how often the source should be checked for changes. Default period is 1 day. | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md new file mode 100644 index 0000000000..4fdbddef3f --- /dev/null +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md @@ -0,0 +1,50 @@ +--- +title: "Exchange Server (Graph)" +description: "Exchange Server (Graph)" +sidebar_position: 40 +--- + +# Exchange Server (Graph) + +The Exchange Server (Graph) source configuration screen allows you to enable the crawling and classification +of multiple Exchange mailboxes from the same Exchange server. + +You can use Match Rules to include and exclude the certain mailboxes. + +Follow the steps to configure an Exchange Server source. + +**Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click +**Add**. + +**Step 2 –** Select **Exchange (Graph)** source type and in the properties window specify the necessary +settings. + +**Step 3 –** Remember to click the "wrench" icon next to **Settings** in the bottom-left corner to +display all settings. + +## Authentication + +You must specify the following: + +| Option | Description | +| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it in order to crawl Exchange. | +| Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | +| Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (it can be found in the Azure AD app properties >**Overview**). | + +![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) + +## Other configuration settings + +The following settings are also required: + +| Option | Description | +| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Cloud Environment | Select the Azure instance the Exchange Online server is hosted on. | +| Crawl Range | Define what portions of data should be retrieved from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| +| Match Rules | Define which mailboxes will be crawled as part of an Exchange Server source. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter if you want all mailboxes to be crawled | +| Detection Period | Specify how often the source should be checked for changes. Default period is 1 day. | + + +Having specified all the necessary settings, click the **Save** button. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md index c6a746c0fc..18fd8d3017 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md @@ -27,7 +27,7 @@ Complete the following fields: | Option | Description | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| SharePoint URL | The root of the site collections to be added, by clicking the “(Multiple Urls)” link you can add multiple SharePoint Online Site Collections to be crawled against the same credentials. | +| Cloud Environment | Select the Azure instance the Exchange Online server is hosted on. | | Username | Enter username in the following formats: DOMAIN\USERNAME and USERNAME@DOMAIN. | | Password | Enter your password for SharePoint Online. | | Match Rules | Enter the site collections' path for crawling the documents. At least one match rule must be included. Match rules are regular expressions, for example, https:\/\/example.sharepoint.com\/sites\/. | From 6d25cf9d7147cc144ab466b7e12ca8ecbed5f871 Mon Sep 17 00:00:00 2001 From: Ben Hayman Date: Wed, 9 Sep 2026 12:23:33 +0100 Subject: [PATCH 02/15] Added service stop step to upgrade instructions --- docs/dataclassification/5.7/introduction/upgrade.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/dataclassification/5.7/introduction/upgrade.md b/docs/dataclassification/5.7/introduction/upgrade.md index 41f3381356..5353538806 100644 --- a/docs/dataclassification/5.7/introduction/upgrade.md +++ b/docs/dataclassification/5.7/introduction/upgrade.md @@ -31,6 +31,8 @@ Classification resides. If not, download it from Microsoft website: - Locate the folder containing index files (the default location is _C:\Program Files\Netwrix\Data Classification\Index_) and back it up. +**Step 4 -** Stop all NDC services. If upgrading a DQS Environment, make sure all services on all instances are stopped before upgrading any instance. If the services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for assistance with remediation. + :::note For versions of 5.7 before 5.7.10, all NDC services and the NDC IIS Application Pool had to run as the same service account. For 5.7.10 onwards this is no longer necessary, but if upgrading from an earlier version of 5.7, complete the upgrade to 5.7.10 _before_ changing the service account to prevent any possible issues with the upgrade process. ::: From b5c19811ef169bfaf7a6bd672f4e8335d90eee0d Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 11:42:11 +0000 Subject: [PATCH 03/15] fix(vale): auto-fix style issues (Vale + Dale) --- .../addsource/exchangemailboxews.md | 26 +++++------ .../addsource/exchangemailboxgraph.md | 24 +++++------ .../addsource/exchangeserverews.md | 43 ++++++++++--------- .../addsource/exchangeservergraph.md | 22 +++++----- .../addsource/sharepointonline.md | 16 +++---- .../5.7/introduction/upgrade.md | 22 +++++----- 6 files changed, 77 insertions(+), 76 deletions(-) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md index e53aa9d5b0..43d830a113 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md @@ -6,7 +6,7 @@ sidebar_position: 30 # Exchange Mailbox -Use the **Exchange Mailbox (EWS)** source to enable the crawling and classification of content stored in a +Use the **Exchange Mailbox (EWS)** source to crawl and classify content stored in a single Exchange mailbox on the on-premises Exchange server or Exchange Online using the Exchange Web services (EWS). **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click @@ -26,34 +26,34 @@ specify the following: | Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | -| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (it can be found in the Azure AD app properties >**Overview**). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | ![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) ## Authentication type: Basic -If you plan to use this authentication type, you will need to specify the following: +To use this authentication type, specify the following: | Option | Description | Comments | | ------------------------ | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Email Address / Password | An **Administrator** account that has been assigned both: 1. **Impersonation** right 2. **Discovery Management** role | See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details on the rights assignment. | +| Email Address / Password | An **Administrator** account with both: 1. **Impersonation** right 2. **Discovery Management** role | See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details on the rights assignment. | ## Other configuration settings -By default, only basic settings are displayed. To view advanced options, click the "wrench" icon at +By default, only basic settings appear. To view advanced options, click the "wrench" icon at **Settings** in the bottom. | Option | Description | Comments | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Basic settings** | | | -| Mailbox | Mailbox to be crawled. | When using impersonation, the settings can be like the following example:
  • Email Address
  • administrative account granted Impersonation right, e.g. _administrator@cs.com_
  • Mailbox
  • target mailbox, e.g. _test@cs.com_.
| -| Crawl Range | Define the time period to be crawled:
  • Select **Date Range** to crawl a static set of data within the specified interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date onwards, taking into account the last crawl date for each object.
| | +| Mailbox | The mailbox to crawl. | When using impersonation, the settings can be like the following example:
  • Email Address
  • administrative account granted Impersonation right, e.g. _administrator@cs.com_
  • Mailbox
  • target mailbox, e.g. _test@cs.com_.
| +| Crawl Range | Define the time period to crawl:
  • Select **Date Range** to crawl a static set of data within the specified interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date onwards, taking into account the last crawl date for each object.
| | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | Applies to Exchange Online. | -| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • document images will not be processed
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images do not contain text. | -| Source Group | Select the source group to add this source to (if any exist). If no source groups exist, a new source group will be automatically created | | +| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | +| Source Group | Select the source group to add this source to (if any exist). If no source groups exist, Netwrix Data Classification automatically creates one | | | Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | | **Advanced settings** | | | -| Build Search Index | Select if you want search index to be created. | | -| Re-Index Period | Specify how often the source should be checked for changes. Default is **7** days. | Netwrix recommends using default values. | -| Priority | Set priority for this data source to be crawled. Select the priority level from the list values:
  • Highest
  • High
  • Normal
  • Low
  • Lowest
| | -| Document Type | Specify a value which can be used to restrict queries when utilizing the Netwrix Data Classification search index. | | +| Build Search Index | Select to create a search index. | | +| Re-Index Period | Specify how often to check the source for changes. Default is **7** days. | Netwrix recommends using default values. | +| Priority | Set the crawl priority for this data source. Select the priority level from the list values:
  • Highest
  • High
  • Normal
  • Low
  • Lowest
| | +| Document Type | Specify a value to restrict queries when using the Netwrix Data Classification search index. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md index 3be5f0bc5c..486acb7f5e 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -6,7 +6,7 @@ sidebar_position: 30 # Exchange Mailbox (Graph) -Use the **Exchange Mailbox (Graph)** source to enable the crawling and classification of content stored in a +Use the **Exchange Mailbox (Graph)** source to crawl and classify content stored in a single Exchange mailbox on Exchange Online. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click @@ -21,30 +21,30 @@ You must specify the following: | Option | Description | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it in order to crawl Exchange. | +| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | -| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (it can be found in the Azure AD app properties >**Overview**). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | ![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) ## Other configuration settings -By default, only basic settings are displayed. To view advanced options, click the "wrench" icon at +By default, only basic settings appear. To view advanced options, click the "wrench" icon at **Settings** in the bottom. | Option | Description | Comments | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Basic settings** | | | -| Cloud Environment | Select the Azure instance the Exchange Online server is hosted on. | | -| Mailbox | Mailbox to be crawled. | When using impersonation, the settings can be like the following example:
  • Email Address
  • administrative account granted Impersonation right, e.g. _administrator@cs.com_
  • Mailbox
  • target mailbox, e.g. _test@cs.com_.
| -| Crawl Range | Define what portions of data should be retrieved from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each object.
| | +| Cloud Environment | Select the Azure instance hosting the Exchange Online server. | | +| Mailbox | The mailbox to crawl. | When using impersonation, the settings can be like the following example:
  • Email Address
  • administrative account granted Impersonation right, e.g. _administrator@cs.com_
  • Mailbox
  • target mailbox, e.g. _test@cs.com_.
| +| Crawl Range | Define which portions of data to retrieve from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each object.
| | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | | -| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • document images will not be processed
  • **Default**
  • defaults to the source setting (if configuring a path) or the global setting (if configured on a source)
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images do not contain text. | +| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the source setting (if configuring a path) or the global setting (if configured on a source)
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | | Source Group | Select the source group (if any). | | | Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | | **Advanced settings** | | | -| Build Search Index | Select if you want search index to be created. | | -| Re-Index Period | Specify how often the source should be checked for changes. Default is **7** days. | Netwrix recommends using default values. | -| Priority | Set priority for this data source to be crawled. Select the priority level from the list values:
  • Highest
  • High
  • Normal
  • Low
  • Lowest
| | -| Document Type | Specify a value which can be used to restrict queries when utilizing the Netwrix Data Classification search index. | | +| Build Search Index | Select to create a search index. | | +| Re-Index Period | Specify how often to check the source for changes. Default is **7** days. | Netwrix recommends using default values. | +| Priority | Set the crawl priority for this data source. Select the priority level from the list values:
  • Highest
  • High
  • Normal
  • Low
  • Lowest
| | +| Document Type | Specify a value to restrict queries when using the Netwrix Data Classification search index. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md index b5d8a5d71e..5813230434 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md @@ -6,17 +6,19 @@ sidebar_position: 40 # Exchange Server -The Exchange Server (EWS) source configuration screen allows you to enable the crawling and classification -of multiple Exchange mailboxes from the same Exchange server using the Exchange Web services (EWS). - -**IMPORTANT!** Automatic detection, crawling and classification of multiple Exchange mailboxes from -the same Exchange server (and, respectively, _Exchange Server_ content source configuration) is only -supported for Exchange Server 2013 or later due to limitations in the Microsoft APIs. For earlier -versions, consider using _Exchange Mailbox_ content source. +Use the Exchange Server (EWS) source configuration screen to crawl and classify +multiple Exchange mailboxes from the same Exchange server using the Exchange Web services (EWS). + +:::warning +Automatic detection, crawling, and classification of multiple Exchange mailboxes from +the same Exchange server (and, respectively, the _Exchange Server_ content source configuration) works +only with Exchange Server 2013 or later, due to limitations in the Microsoft APIs. For earlier +versions, consider using the _Exchange Mailbox_ content source. +::: -You can use Match Rules to include and exclude the certain mailboxes. +You can use Match Rules to include or exclude specific mailboxes. -Follow the steps to configure an Exchange Server (EWS) source. +To configure an Exchange Server (EWS) source: **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. @@ -30,9 +32,8 @@ display all settings. ## Authentication type: Modern authentication :::note -For Email Address / Password, the Administrator account that has been assigned the right -of the Discovery Management role and be given the Mailbox Search and MailboxSearchApplication -permissions. +For Email Address / Password, use an Administrator account that has the Discovery Management +role and the Mailbox Search and MailboxSearchApplication permissions. ::: @@ -41,20 +42,20 @@ If you plan to use this authentication type, specify the following: | Option | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Authentication type | Select **Modern (Exchange Online)** | -| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it in order to crawl Exchange. | +| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | -| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (it can be found in the Azure AD app properties >**Overview**). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | ![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) ## Authentication type: Basic -If you plan to use this authentication type, you will need to specify the following: +To use this authentication type, specify the following: | Option | Description | | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Email Address / Password | Administrator account that has been assigned the right of Impersonation as well as the Discovery Management role. See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details on the rights assignment. | +| Email Address / Password | Administrator account with the Impersonation right and the Discovery Management role. See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details on the rights assignment. | ## Other configuration settings @@ -62,10 +63,10 @@ The following settings are also required in both cases: | Option | Description | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Exchange API URL | By default, the crawling engine will attempt to locate the necessary URL of Exchange Web Services API by using the _Exchange AutoDiscover_ functionality. So, typically, you can leave this field blank. If, however, the _Exchange AutoDiscover_ is not available, then you should specify the Exchange API URL explicitly as follows: `https:///EWS/Exchange.asmx`. | -| Crawl Range | Define what portions of data should be retrieved from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| -| Match Rules | Define which mailboxes will be crawled as part of an Exchange Server source. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter if you want all mailboxes to be crawled | -| Detection Period | Specify how often the source should be checked for changes. Default period is 1 day. | +| Exchange API URL | By default, the crawling engine uses the _Exchange AutoDiscover_ functionality to locate the Exchange Web Services API URL, so you can typically leave this field blank. If _Exchange AutoDiscover_ isn't available, specify the Exchange API URL explicitly: `https:///EWS/Exchange.asmx`. | +| Crawl Range | Define which portions of data to retrieve from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| +| Match Rules | Define which mailboxes to crawl as part of an Exchange Server source. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes | +| Detection Period | Specify how often to check the source for changes. Default period is 1 day. | -Having specified all the necessary settings, click the **Save** button. +After specifying all the necessary settings, click **Save**. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md index 4fdbddef3f..9ed740f36b 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md @@ -6,12 +6,12 @@ sidebar_position: 40 # Exchange Server (Graph) -The Exchange Server (Graph) source configuration screen allows you to enable the crawling and classification -of multiple Exchange mailboxes from the same Exchange server. +Use the Exchange Server (Graph) source configuration screen to crawl and classify +multiple Exchange mailboxes from the same Exchange server. -You can use Match Rules to include and exclude the certain mailboxes. +You can use Match Rules to include or exclude specific mailboxes. -Follow the steps to configure an Exchange Server source. +To configure an Exchange Server (Graph) source: **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. @@ -28,10 +28,10 @@ You must specify the following: | Option | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it in order to crawl Exchange. | +| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | -| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (it can be found in the Azure AD app properties >**Overview**). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | ![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) @@ -41,10 +41,10 @@ The following settings are also required: | Option | Description | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Cloud Environment | Select the Azure instance the Exchange Online server is hosted on. | -| Crawl Range | Define what portions of data should be retrieved from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| -| Match Rules | Define which mailboxes will be crawled as part of an Exchange Server source. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter if you want all mailboxes to be crawled | -| Detection Period | Specify how often the source should be checked for changes. Default period is 1 day. | +| Cloud Environment | Select the Azure instance hosting the Exchange Online server. | +| Crawl Range | Define which portions of data to retrieve from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| +| Match Rules | Define which mailboxes to crawl as part of an Exchange Server source. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes | +| Detection Period | Specify how often to check the source for changes. Default period is 1 day. | -Having specified all the necessary settings, click the **Save** button. +After specifying all the necessary settings, click **Save**. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md index 18fd8d3017..77229d10c3 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md @@ -7,13 +7,13 @@ sidebar_position: 100 # SharePoint Online Office 365 customers can configure the collector service to automatically detect and queue their -employees SharePoint Online sites hosted in Office 365. An account with Tenant administration rights -must be supplied, and the frequency of the detection of new SharePoint Online sites must be set. It -is also possible to provide a filter expression to ensure that certain SharePoint Online paths are -included and others excluded as required. +employees SharePoint Online sites hosted in Office 365. You must supply an account with Tenant +administration rights and set how often the service detects new SharePoint Online sites. You can +also provide a filter expression to include certain SharePoint Online paths and exclude others as +required. -Optionally, you can set up the resources necessary to ensure Netwrix Data -Classification is enabled and configured on the detected SharePoint Online sites. Templating allows +Optionally, you can set up the resources needed to enable and configure Netwrix Data +Classification on the detected SharePoint Online sites. Templating allows an administrator to preconfigure classification settings for site collections. For more information, review the associated templating guide. @@ -27,10 +27,10 @@ Complete the following fields: | Option | Description | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Cloud Environment | Select the Azure instance the Exchange Online server is hosted on. | +| Cloud Environment | Select the Azure instance hosting the Exchange Online server. | | Username | Enter username in the following formats: DOMAIN\USERNAME and USERNAME@DOMAIN. | | Password | Enter your password for SharePoint Online. | -| Match Rules | Enter the site collections' path for crawling the documents. At least one match rule must be included. Match rules are regular expressions, for example, https:\/\/example.sharepoint.com\/sites\/. | +| Match Rules | Enter the site collections' path for crawling the documents. You must include at least one match rule. Match rules are regular expressions, for example, https:\/\/example.sharepoint.com\/sites\/. | | Classification template | Specify the required Classification template for writing classifications. See the [Enable Write Classifications](/docs/dataclassification/5.7/contentconfigurationoverview/taxonomies/enablewriteclassifications.md) and [Working with SharePoint templates](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/introduction/workwithtemplates.md) topics for more information. | | Detection Period | Specify how often you will detect new site collections. Default period is 1 day. | diff --git a/docs/dataclassification/5.7/introduction/upgrade.md b/docs/dataclassification/5.7/introduction/upgrade.md index 5353538806..3fb5b4f284 100644 --- a/docs/dataclassification/5.7/introduction/upgrade.md +++ b/docs/dataclassification/5.7/introduction/upgrade.md @@ -31,39 +31,39 @@ Classification resides. If not, download it from Microsoft website: - Locate the folder containing index files (the default location is _C:\Program Files\Netwrix\Data Classification\Index_) and back it up. -**Step 4 -** Stop all NDC services. If upgrading a DQS Environment, make sure all services on all instances are stopped before upgrading any instance. If the services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for assistance with remediation. +**Step 4 -** Stop all NDC services. If upgrading a Distributed Query Server (DQS) environment, stop all services on all instances before upgrading any instance. If the services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for help. :::note -For versions of 5.7 before 5.7.10, all NDC services and the NDC IIS Application Pool had to run as the same service account. For 5.7.10 onwards this is no longer necessary, but if upgrading from an earlier version of 5.7, complete the upgrade to 5.7.10 _before_ changing the service account to prevent any possible issues with the upgrade process. +For versions of 5.7 before 5.7.10, all NDC services and the NDC IIS Application Pool had to run as the same service account. For 5.7.10 onwards this is no longer necessary, but if upgrading from an earlier version of 5.7, complete the upgrade to 5.7.10 _before_ changing the service account to avoid upgrade issues. ::: ## Upgrade Process You can upgrade directly to Netwrix Data Classification 5.7 only from versions 5.5 and newer. -To upgrade your deployment, after taking the preceding preparatory steps, run the product -setup and follow the wizard steps. When finished, all solution components will be running. +After taking the preceding preparatory steps, run the product setup and follow the wizard +steps. When the upgrade finishes, all solution components are running. -If you need to upgrade from an earlier version, you will need to perform a staged upgrade: first upgrade -to version 5.5, then perform a second upgrade to version 5.7. +To upgrade from an earlier version, perform a staged upgrade: first upgrade to version 5.5, then +upgrade to version 5.7. ## Upgrading a DQS Environment When upgrading an NDC environment which uses the **Distributed Query Server** (DQS) functionality to 5.7.10 or later, -the primary server must be upgraded before upgrading the secondary instances. Secondary instances will -attempt to resynchronize with the primary instance during the upgrade process, which will fail if the primary -instance has not been upgraded. +upgrade the primary server before the secondary instances. Secondary instances +attempt to resynchronize with the primary instance during the upgrade process, which fails if you haven't +upgraded the primary instance. When upgrading to 5.7.10 or later from an earlier version of 5.7, you should run the installer as the NDC service account if possible so that the installer can synchronize the DQS instances automatically. -If this isn't done, you will need to perform a DQS resynchronization when upgrading each secondary DQS instance. For further details on this process, +If you don't, you must resynchronize DQS when upgrading each secondary DQS instance. For further details on this process, see the [Configuring NDC Servers Cluster and Load Balancing with DQS Mode](/docs/dataclassification/5.7/introduction/deployment/ndcserverandclient/dqsmode.md) page. ## After the Upgrade During the upgrade from previous versions, Netwrix Data Classification preserves its configuration, so you can classify your data right after finishing the upgrade. However, -there are several steps you may need to take after upgrading. +you may need to take several steps after upgrading. To update taxonomies manually: From 8e0553948161c317b6738cde1ad3d36626618050 Mon Sep 17 00:00:00 2001 From: Ben Hayman Date: Wed, 9 Sep 2026 13:43:29 +0100 Subject: [PATCH 04/15] Suggested docs improvements --- .../addsource/exchangemailboxews.md | 6 +++--- .../addsource/exchangemailboxgraph.md | 6 +++--- .../introduction/addsource/exchangeserverews.md | 17 ++++++++--------- .../addsource/exchangeservergraph.md | 11 +++++------ .../introduction/addsource/sharepointonline.md | 3 ++- .../5.7/introduction/upgrade.md | 10 +++++++++- 6 files changed, 30 insertions(+), 23 deletions(-) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md index 43d830a113..1cdbcef5de 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md @@ -4,7 +4,7 @@ description: "Exchange Mailbox (EWS)" sidebar_position: 30 --- -# Exchange Mailbox +# Exchange Mailbox (EWS) Use the **Exchange Mailbox (EWS)** source to crawl and classify content stored in a single Exchange mailbox on the on-premises Exchange server or Exchange Online using the Exchange Web services (EWS). @@ -49,8 +49,8 @@ By default, only basic settings appear. To view advanced options, click the "wre | Mailbox | The mailbox to crawl. | When using impersonation, the settings can be like the following example:
  • Email Address
  • administrative account granted Impersonation right, e.g. _administrator@cs.com_
  • Mailbox
  • target mailbox, e.g. _test@cs.com_.
| | Crawl Range | Define the time period to crawl:
  • Select **Date Range** to crawl a static set of data within the specified interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date onwards, taking into account the last crawl date for each object.
| | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | Applies to Exchange Online. | -| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | -| Source Group | Select the source group to add this source to (if any exist). If no source groups exist, Netwrix Data Classification automatically creates one | | +| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • document images will not be processed
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images do not contain text. | +| Source Group | Select the source group to add this source to. If no source groups exist, the product creates one automatically, named after the source. | | | Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | | **Advanced settings** | | | | Build Search Index | Select to create a search index. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md index 486acb7f5e..0e855c6cd1 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -1,13 +1,13 @@ --- title: "Exchange Mailbox (Graph)" description: "Exchange Mailbox (Graph)" -sidebar_position: 30 +sidebar_position: 35 --- # Exchange Mailbox (Graph) Use the **Exchange Mailbox (Graph)** source to crawl and classify content stored in a -single Exchange mailbox on Exchange Online. +single Exchange mailbox on Exchange Online. Use this source type for Exchange Online mailboxes. For on-premises Exchange mailboxes, use Exchange Mailbox (EWS). **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. @@ -37,7 +37,7 @@ By default, only basic settings appear. To view advanced options, click the "wre | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Basic settings** | | | | Cloud Environment | Select the Azure instance hosting the Exchange Online server. | | -| Mailbox | The mailbox to crawl. | When using impersonation, the settings can be like the following example:
  • Email Address
  • administrative account granted Impersonation right, e.g. _administrator@cs.com_
  • Mailbox
  • target mailbox, e.g. _test@cs.com_.
| +| Mailbox | The mailbox to crawl. | E.g. _test@cs.com_. | | Crawl Range | Define which portions of data to retrieve from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each object.
| | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | | | OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the source setting (if configuring a path) or the global setting (if configured on a source)
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md index 5813230434..0f0330982b 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md @@ -4,30 +4,29 @@ description: "Exchange Server (EWS)" sidebar_position: 40 --- -# Exchange Server +# Exchange Server (EWS) Use the Exchange Server (EWS) source configuration screen to crawl and classify -multiple Exchange mailboxes from the same Exchange server using the Exchange Web services (EWS). +multiple Exchange mailboxes from the same Exchange server using the Exchange Web Services (EWS). :::warning Automatic detection, crawling, and classification of multiple Exchange mailboxes from -the same Exchange server (and, respectively, the _Exchange Server_ content source configuration) works +the same Exchange server (and, respectively, the _Exchange Server (EWS)_ content source configuration) works only with Exchange Server 2013 or later, due to limitations in the Microsoft APIs. For earlier -versions, consider using the _Exchange Mailbox_ content source. +versions, consider using the _Exchange Mailbox (EWS)_ content source. ::: You can use Match Rules to include or exclude specific mailboxes. -To configure an Exchange Server (EWS) source: +To configure an Exchange Server (EWS) source, follow these steps. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. -**Step 2 –** Select **Exchange (EWS)** source type and in the properties window specify the necessary +**Step 2 –** Select the **Exchange Server (EWS)** source type and in the properties window specify the necessary settings. -**Step 3 –** Remember to click the "wrench" icon next to **Settings** in the bottom-left corner to -display all settings. +**Step 3 –** To display all settings, click the 'wrench' icon next to Settings in the bottom-left corner. ## Authentication type: Modern authentication @@ -41,7 +40,7 @@ If you plan to use this authentication type, specify the following: | Option | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Authentication type | Select **Modern (Exchange Online)** | +| Authentication type | Select **Modern (O365)** | | Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md index 9ed740f36b..a3d50d8c78 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md @@ -1,17 +1,17 @@ --- title: "Exchange Server (Graph)" description: "Exchange Server (Graph)" -sidebar_position: 40 +sidebar_position: 45 --- # Exchange Server (Graph) Use the Exchange Server (Graph) source configuration screen to crawl and classify -multiple Exchange mailboxes from the same Exchange server. +multiple Exchange mailboxes from the same Exchange server. The Graph source type applies to Exchange Online only. To crawl mailboxes on an on-premises Exchange server, use Exchange Server (EWS). You can use Match Rules to include or exclude specific mailboxes. -To configure an Exchange Server (Graph) source: +To configure an Exchange Server (Graph) source, follow these steps. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. @@ -19,10 +19,9 @@ To configure an Exchange Server (Graph) source: **Step 2 –** Select **Exchange (Graph)** source type and in the properties window specify the necessary settings. -**Step 3 –** Remember to click the "wrench" icon next to **Settings** in the bottom-left corner to -display all settings. +**Step 3 –** To display all settings, click the 'wrench' icon next to Settings in the bottom-left corner. -## Authentication +## Authentication You must specify the following: diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md index 77229d10c3..a659bca030 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md @@ -27,7 +27,8 @@ Complete the following fields: | Option | Description | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Cloud Environment | Select the Azure instance hosting the Exchange Online server. | +| SharePoint URL | The root of the site collections to be added, by clicking the “(Multiple Urls)” link you can add multiple SharePoint Online Site Collections to be crawled against the same credentials. | +| Cloud Environment | Select the Azure instance hosting the SharePoint Online server. | | Username | Enter username in the following formats: DOMAIN\USERNAME and USERNAME@DOMAIN. | | Password | Enter your password for SharePoint Online. | | Match Rules | Enter the site collections' path for crawling the documents. You must include at least one match rule. Match rules are regular expressions, for example, https:\/\/example.sharepoint.com\/sites\/. | diff --git a/docs/dataclassification/5.7/introduction/upgrade.md b/docs/dataclassification/5.7/introduction/upgrade.md index 3fb5b4f284..d77105f3f0 100644 --- a/docs/dataclassification/5.7/introduction/upgrade.md +++ b/docs/dataclassification/5.7/introduction/upgrade.md @@ -24,10 +24,18 @@ Classification resides. If not, download it from Microsoft website: - In the Object Explorer, right-click the database and select **Tasks** > **Back Up**. - Wait for the process to complete. -**Step 3 –** Back up the Index files. Netwrix recommends the following: +**Step 3 –** Stop all NDC services. Netwrix recommends the following: - On the computer where Netwrix Data Classification is installed, start the Netwrix Data Classification Service Viewer tool. Select **Stop** next to each service. +- If upgrading a Distributed Query Server (DQS) environment, make sure all services on all instances are stopped before upgrading any instance. + +:::warning +If any services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for assistance with remediation. +::: + +**Step 4 –** Back up the Index files. Netwrix recommends the following: + - Locate the folder containing index files (the default location is _C:\Program Files\Netwrix\Data Classification\Index_) and back it up. From 899bd3f5db32821e6f8f30bbfcb34dde69ccae27 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 12:49:45 +0000 Subject: [PATCH 05/15] fix(vale): auto-fix style issues (Vale + Dale) --- .../introduction/addsource/exchangemailboxews.md | 4 ++-- .../introduction/addsource/exchangemailboxgraph.md | 2 +- .../introduction/addsource/sharepointonline.md | 4 ++-- docs/dataclassification/5.7/introduction/upgrade.md | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md index 1cdbcef5de..f3ce02ba06 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md @@ -46,10 +46,10 @@ By default, only basic settings appear. To view advanced options, click the "wre | Option | Description | Comments | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Basic settings** | | | -| Mailbox | The mailbox to crawl. | When using impersonation, the settings can be like the following example:
  • Email Address
  • administrative account granted Impersonation right, e.g. _administrator@cs.com_
  • Mailbox
  • target mailbox, e.g. _test@cs.com_.
| +| Mailbox | The mailbox to crawl. | When you use impersonation, the settings can be like the following example:
  • Email Address
  • administrative account granted Impersonation right, e.g. _administrator@cs.com_
  • Mailbox
  • target mailbox, e.g. _test@cs.com_.
| | Crawl Range | Define the time period to crawl:
  • Select **Date Range** to crawl a static set of data within the specified interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date onwards, taking into account the last crawl date for each object.
| | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | Applies to Exchange Online. | -| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • document images will not be processed
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images do not contain text. | +| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | | Source Group | Select the source group to add this source to. If no source groups exist, the product creates one automatically, named after the source. | | | Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | | **Advanced settings** | | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md index 0e855c6cd1..633153c7c6 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -7,7 +7,7 @@ sidebar_position: 35 # Exchange Mailbox (Graph) Use the **Exchange Mailbox (Graph)** source to crawl and classify content stored in a -single Exchange mailbox on Exchange Online. Use this source type for Exchange Online mailboxes. For on-premises Exchange mailboxes, use Exchange Mailbox (EWS). +single Exchange mailbox on Exchange Online. For on-premises Exchange mailboxes, use Exchange Mailbox (EWS). **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md index a659bca030..32fd127cfa 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md @@ -27,12 +27,12 @@ Complete the following fields: | Option | Description | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| SharePoint URL | The root of the site collections to be added, by clicking the “(Multiple Urls)” link you can add multiple SharePoint Online Site Collections to be crawled against the same credentials. | +| SharePoint URL | The root of the site collections to add. Click the “(Multiple Urls)” link to add multiple SharePoint Online Site Collections that use the same credentials for crawling. | | Cloud Environment | Select the Azure instance hosting the SharePoint Online server. | | Username | Enter username in the following formats: DOMAIN\USERNAME and USERNAME@DOMAIN. | | Password | Enter your password for SharePoint Online. | | Match Rules | Enter the site collections' path for crawling the documents. You must include at least one match rule. Match rules are regular expressions, for example, https:\/\/example.sharepoint.com\/sites\/. | | Classification template | Specify the required Classification template for writing classifications. See the [Enable Write Classifications](/docs/dataclassification/5.7/contentconfigurationoverview/taxonomies/enablewriteclassifications.md) and [Working with SharePoint templates](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/introduction/workwithtemplates.md) topics for more information. | -| Detection Period | Specify how often you will detect new site collections. Default period is 1 day. | +| Detection Period | Specify how often to detect new site collections. Default period is 1 day. | After configuring the settings, click the **Save** button. diff --git a/docs/dataclassification/5.7/introduction/upgrade.md b/docs/dataclassification/5.7/introduction/upgrade.md index d77105f3f0..7667eee852 100644 --- a/docs/dataclassification/5.7/introduction/upgrade.md +++ b/docs/dataclassification/5.7/introduction/upgrade.md @@ -28,7 +28,7 @@ Classification resides. If not, download it from Microsoft website: - On the computer where Netwrix Data Classification is installed, start the Netwrix Data Classification Service Viewer tool. Select **Stop** next to each service. -- If upgrading a Distributed Query Server (DQS) environment, make sure all services on all instances are stopped before upgrading any instance. +- If upgrading a Distributed Query Server (DQS) environment, stop all services on all instances before upgrading any instance. :::warning If any services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for assistance with remediation. @@ -59,8 +59,8 @@ upgrade to version 5.7. When upgrading an NDC environment which uses the **Distributed Query Server** (DQS) functionality to 5.7.10 or later, upgrade the primary server before the secondary instances. Secondary instances -attempt to resynchronize with the primary instance during the upgrade process, which fails if you haven't -upgraded the primary instance. +attempt to resynchronize with the primary instance during the upgrade process, and this resynchronization +fails if you haven't upgraded the primary instance. When upgrading to 5.7.10 or later from an earlier version of 5.7, you should run the installer as the NDC service account if possible so that the installer can synchronize the DQS instances automatically. From 21fd8d124368b9c886eb5e2507d50a5749e54637 Mon Sep 17 00:00:00 2001 From: Ben Hayman Date: Fri, 11 Sep 2026 14:47:47 +0100 Subject: [PATCH 06/15] Recommended docs updates --- .../introduction/addsource/addsource.md | 6 ++-- .../addsource/exchangemailboxews.md | 4 ++- .../addsource/exchangemailboxgraph.md | 13 ++++----- .../addsource/exchangeserverews.md | 15 +++++----- .../addsource/exchangeservergraph.md | 14 ++++----- .../addsource/sharepointonline.md | 6 ++-- .../introduction/exchange/exchange.md | 29 ++++++++++--------- .../5.7/introduction/upgrade.md | 6 +--- 8 files changed, 48 insertions(+), 45 deletions(-) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md index 05a22e0b35..2c8a65a6c0 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md @@ -23,8 +23,10 @@ the sources: - [Add Single Database](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsingledatabase/addsingledatabase.md) (Microsoft SQL Server, MySQL, PostgreSQL, or Oracle database) - [Add SQL Server](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsqlserversource/addsqlserversource.md) (All Microsoft SQL Server, MySQL, PostgreSQL, or Oracle databases on a server) - [Dropbox](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/adddropbox.md) -- [Exchange Server](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserver.md) or - [Exchange Mailbox](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailbox.md) +- [Exchange Server (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md) or + [Exchange Mailbox (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md) +- [Exchange Server (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md) or + [Exchange Mailbox (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md) - [File System](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/overview.md) (includes Folder and File) - [Google Drive Source](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addgdsource.md) - [Outlook Mail Archive](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/outlookmailarchive.md) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md index f3ce02ba06..b406fed0a9 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md @@ -7,7 +7,9 @@ sidebar_position: 30 # Exchange Mailbox (EWS) Use the **Exchange Mailbox (EWS)** source to crawl and classify content stored in a -single Exchange mailbox on the on-premises Exchange server or Exchange Online using the Exchange Web services (EWS). +single Exchange mailbox on an on-premises Exchange server or in Exchange Online using the Exchange Web Services (EWS). +Due to the imminent deprecation of EWS for connecting to Exchange Online, Netwrix recommends using [Exchange Mailbox (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md) +for any new sources intended to crawl Exchange Online mailboxes. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md index 633153c7c6..eb242e8557 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -6,8 +6,7 @@ sidebar_position: 35 # Exchange Mailbox (Graph) -Use the **Exchange Mailbox (Graph)** source to crawl and classify content stored in a -single Exchange mailbox on Exchange Online. For on-premises Exchange mailboxes, use Exchange Mailbox (EWS). +Use the Exchange Mailbox (Graph) source to crawl and classify content stored in a single Exchange Online mailbox using the Microsoft Graph API. For on-premises Exchange mailboxes, [Exchange Mailbox (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md). **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. @@ -15,7 +14,7 @@ single Exchange mailbox on Exchange Online. For on-premises Exchange mailboxes, **Step 2 –** Select **Exchange Mailbox (Graph)** source type and in the properties window specify the necessary settings. -## Authentication +## Authentication You must specify the following: @@ -36,12 +35,12 @@ By default, only basic settings appear. To view advanced options, click the "wre | Option | Description | Comments | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Basic settings** | | | -| Cloud Environment | Select the Azure instance hosting the Exchange Online server. | | +| Cloud Environment | Select the Azure instance hosting the Exchange Online server. | | | Mailbox | The mailbox to crawl. | E.g. _test@cs.com_. | -| Crawl Range | Define which portions of data to retrieve from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each object.
| | +| Crawl Range | Define the time period to crawl:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each object.
| | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | | -| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the source setting (if configuring a path) or the global setting (if configured on a source)
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | -| Source Group | Select the source group (if any). | | +| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | +| Source Group | Select the source group to add this source to. If no source groups exist, the product creates one automatically, named after the source. | | | Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | | **Advanced settings** | | | | Build Search Index | Select to create a search index. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md index 0f0330982b..5ea08e4e63 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md @@ -7,9 +7,9 @@ sidebar_position: 40 # Exchange Server (EWS) Use the Exchange Server (EWS) source configuration screen to crawl and classify -multiple Exchange mailboxes from the same Exchange server using the Exchange Web Services (EWS). +multiple Exchange mailboxes from the same Exchange server, using the Exchange Web Services (EWS). -:::warning +:::note Automatic detection, crawling, and classification of multiple Exchange mailboxes from the same Exchange server (and, respectively, the _Exchange Server (EWS)_ content source configuration) works only with Exchange Server 2013 or later, due to limitations in the Microsoft APIs. For earlier @@ -26,14 +26,10 @@ To configure an Exchange Server (EWS) source, follow these steps. **Step 2 –** Select the **Exchange Server (EWS)** source type and in the properties window specify the necessary settings. -**Step 3 –** To display all settings, click the 'wrench' icon next to Settings in the bottom-left corner. +**Step 3 –** To display all settings, click the "wrench" icon next to Settings in the bottom-left corner. ## Authentication type: Modern authentication -:::note -For Email Address / Password, use an Administrator account that has the Discovery Management -role and the Mailbox Search and MailboxSearchApplication permissions. -::: If you plan to use this authentication type, specify the following: @@ -50,6 +46,11 @@ If you plan to use this authentication type, specify the following: ## Authentication type: Basic +:::note +For Email Address / Password, use an Administrator account that has the Discovery Management +role and the Mailbox Search and MailboxSearchApplication permissions. +::: + To use this authentication type, specify the following: | Option | Description | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md index a3d50d8c78..4bf1884e90 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md @@ -7,7 +7,7 @@ sidebar_position: 45 # Exchange Server (Graph) Use the Exchange Server (Graph) source configuration screen to crawl and classify -multiple Exchange mailboxes from the same Exchange server. The Graph source type applies to Exchange Online only. To crawl mailboxes on an on-premises Exchange server, use Exchange Server (EWS). +multiple Exchange mailboxes in the same tenant. The Graph source type can only be used to connect to Exchange Online. To crawl mailboxes on an on-premises Exchange server, use Exchange Server (EWS). You can use Match Rules to include or exclude specific mailboxes. @@ -16,10 +16,10 @@ To configure an Exchange Server (Graph) source, follow these steps. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. -**Step 2 –** Select **Exchange (Graph)** source type and in the properties window specify the necessary +**Step 2 –** Select **Exchange Server (Graph)** source type and in the properties window specify the necessary settings. -**Step 3 –** To display all settings, click the 'wrench' icon next to Settings in the bottom-left corner. +**Step 3 –** To display all settings, click the "wrench" icon next to Settings in the bottom-left corner. ## Authentication @@ -36,13 +36,13 @@ You must specify the following: ## Other configuration settings -The following settings are also required: +Specify the following settings: | Option | Description | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Cloud Environment | Select the Azure instance hosting the Exchange Online server. | -| Crawl Range | Define which portions of data to retrieve from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| -| Match Rules | Define which mailboxes to crawl as part of an Exchange Server source. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes | +| Cloud Environment | Select the Azure instance hosting the Exchange Online tenancy. | +| Crawl Range | Define which portions of data to retrieve from Exchange Online:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| +| Match Rules | Define rules with wildcards to limit which mailboxes are crawled. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes. You must define at least one match rule. | | Detection Period | Specify how often to check the source for changes. Default period is 1 day. | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md index 32fd127cfa..3748bef373 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md @@ -6,8 +6,8 @@ sidebar_position: 100 # SharePoint Online -Office 365 customers can configure the collector service to automatically detect and queue their -employees SharePoint Online sites hosted in Office 365. You must supply an account with Tenant +If you are an Office 365 customer, you can configure the collector service to automatically detect and queue your +employees' SharePoint Online sites hosted in Office 365. You must supply an account with Tenant administration rights and set how often the service detects new SharePoint Online sites. You can also provide a filter expression to include certain SharePoint Online paths and exclude others as required. @@ -28,7 +28,7 @@ Complete the following fields: | Option | Description | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SharePoint URL | The root of the site collections to add. Click the “(Multiple Urls)” link to add multiple SharePoint Online Site Collections that use the same credentials for crawling. | -| Cloud Environment | Select the Azure instance hosting the SharePoint Online server. | +| Cloud Environment | Select the Azure instance that hosts your SharePoint Online tenant. | | Username | Enter username in the following formats: DOMAIN\USERNAME and USERNAME@DOMAIN. | | Password | Enter your password for SharePoint Online. | | Match Rules | Enter the site collections' path for crawling the documents. You must include at least one match rule. Match rules are regular expressions, for example, https:\/\/example.sharepoint.com\/sites\/. | diff --git a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md index 879a987ab8..4f97f356c7 100644 --- a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md +++ b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md @@ -9,12 +9,12 @@ sidebar_position: 30 When preparing your Exchange Server for data classification: :::note -On-premise Exchange servers support Basic authentication for crawling accounts, while Exchange Online supports either Modern or Basic authentication. The following sections describe both scenarios. +On-premise Exchange servers support Basic authentication for crawling accounts, while Exchange Online requires Modern authentication. The following sections describe both scenarios. ::: ## Basic Authentication -This method is supported for Exchange Online and on-premise Exchange organizations. You should +This method is supported for on-premise Exchange servers. You should configure sufficient permissions that will allow the crawling account to impersonate the mailboxes that you want to crawl. This requires the setup of two permissions: @@ -23,10 +23,6 @@ that you want to crawl. This requires the setup of two permissions: - Mailbox Search—Allows the crawling account to enumerate mailboxes (automatic discovery of mailboxes) -Review the related procedure that corresponds to your Exchange deployment: - -- Exchange Online -- Exchange Server (On-Premise) ### Exchange Online @@ -40,7 +36,7 @@ Review the related procedure that corresponds to your Exchange deployment: **Step 4 –** In the Set up basics step, enter the Name and Description '_NetwrixCrawlerImpersonation_'. Click **Next**. -**Step 5 –** On the **Add Permission** step, select ApplicationImpersonation and Mailbox Search +**Step 5 –** On the **Add Permission** step, select the Microsoft.Graph Mail.Read, Mail.ReadWrite, and User.Read.All permissions. Click **Next**. **Step 6 –** Select the users to assign to this role group. They will have permissions to manage the @@ -78,21 +74,28 @@ Online organization mailboxes using Modern authentication. For that, it uses an which can use Microsoft API to connect to Exchange Online organization. :::note -To access via Modern Authentication, you need to use an admin username. +To access Exchange using Modern Authentication, you need to use an admin username. ::: +You should configure sufficient permissions that will allow the crawling account to access and read the +mailboxes that you want to crawl. The permissions required differ between the EWS and Graph implementations. + +To utilise the Graph implementation, you must grant the following permissions: + +- Mail.Read-Allows the application to read the full contents of all mailboxes +- Mail.ReadWrite—Allows the application to move and delete mail in all mailboxes - necessary for the Exchange workflow actions +- User.Read.All—Allows the application to discover all users associated with an Exchange Online server -You should configure sufficient permissions that will allow the crawling account to impersonate the -mailboxes that you want to crawl. This requires the setup of two permissions: +To utilise the EWS implementation, you must grant the following permissions: - ApplicationImpersonation—Allows the crawling account to impersonate each of the mailboxes / users configured for collection - Mailbox Search—Allows the crawling account to enumerate mailboxes (automatic discovery of mailboxes) -If you plan to implement the scenario that involves modern authentication, you should do the +If you plan to make us of modern authentication, you should do the following: 1. [Create Azure AD app for Modern Authentication](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md) -2. Configure [Exchange Server](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserver.md) source - settings. +2. Configure [Exchange Server (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md) + or [Exchange Server (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md) source settings. diff --git a/docs/dataclassification/5.7/introduction/upgrade.md b/docs/dataclassification/5.7/introduction/upgrade.md index 7667eee852..4eaa233a72 100644 --- a/docs/dataclassification/5.7/introduction/upgrade.md +++ b/docs/dataclassification/5.7/introduction/upgrade.md @@ -34,13 +34,9 @@ Classification resides. If not, download it from Microsoft website: If any services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for assistance with remediation. ::: -**Step 4 –** Back up the Index files. Netwrix recommends the following: - -- Locate the folder containing index files (the default location is _C:\Program +**Step 4 –** Back up the Index files. Locate the folder containing the index files (the default location is _C:\Program Files\Netwrix\Data Classification\Index_) and back it up. -**Step 4 -** Stop all NDC services. If upgrading a Distributed Query Server (DQS) environment, stop all services on all instances before upgrading any instance. If the services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for help. - :::note For versions of 5.7 before 5.7.10, all NDC services and the NDC IIS Application Pool had to run as the same service account. For 5.7.10 onwards this is no longer necessary, but if upgrading from an earlier version of 5.7, complete the upgrade to 5.7.10 _before_ changing the service account to avoid upgrade issues. ::: From 66c36e3e74b3d8e49f5757310ccc839ad0b4218c Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 14:12:11 +0000 Subject: [PATCH 07/15] fix(vale): auto-fix style issues (Vale + Dale) --- .../introduction/addsource/addsource.md | 6 +++--- .../addsource/exchangeserverews.md | 2 +- .../addsource/exchangeservergraph.md | 4 ++-- .../introduction/exchange/exchange.md | 21 +++++++++---------- .../5.7/introduction/upgrade.md | 6 +++--- 5 files changed, 19 insertions(+), 20 deletions(-) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md index 2c8a65a6c0..9bed3bf8d1 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md @@ -35,8 +35,8 @@ the sources: The **Sources** section lists all your content sources. :::note -When adding a source or managing source configuration, the most commonly used source -settings are displayed by default. However, some source types have additional configuration options -that can be displayed by clicking the Advanced Settings ("wrench" icon). You can +When adding a source or managing source configuration, the console displays the most commonly used +source settings by default. However, some source types have additional configuration options +that appear when you click the Advanced Settings ("wrench" icon). You can set the Advanced Settings to display by default in User Preferences, accessible by clicking on the username. ::: diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md index 5ea08e4e63..7b76a148d7 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md @@ -11,7 +11,7 @@ multiple Exchange mailboxes from the same Exchange server, using the Exchange We :::note Automatic detection, crawling, and classification of multiple Exchange mailboxes from -the same Exchange server (and, respectively, the _Exchange Server (EWS)_ content source configuration) works +the same Exchange server—and therefore the _Exchange Server (EWS)_ content source—works only with Exchange Server 2013 or later, due to limitations in the Microsoft APIs. For earlier versions, consider using the _Exchange Mailbox (EWS)_ content source. ::: diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md index 4bf1884e90..4531e2c1a7 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md @@ -7,7 +7,7 @@ sidebar_position: 45 # Exchange Server (Graph) Use the Exchange Server (Graph) source configuration screen to crawl and classify -multiple Exchange mailboxes in the same tenant. The Graph source type can only be used to connect to Exchange Online. To crawl mailboxes on an on-premises Exchange server, use Exchange Server (EWS). +multiple Exchange mailboxes in the same tenant. The Graph source type connects only to Exchange Online. To crawl mailboxes on an on-premises Exchange server, use Exchange Server (EWS). You can use Match Rules to include or exclude specific mailboxes. @@ -42,7 +42,7 @@ Specify the following settings: | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cloud Environment | Select the Azure instance hosting the Exchange Online tenancy. | | Crawl Range | Define which portions of data to retrieve from Exchange Online:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| -| Match Rules | Define rules with wildcards to limit which mailboxes are crawled. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes. You must define at least one match rule. | +| Match Rules | Define rules with wildcards to limit which mailboxes the product crawls. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes. You must define at least one match rule. | | Detection Period | Specify how often to check the source for changes. Default period is 1 day. | diff --git a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md index 4f97f356c7..2573ab1127 100644 --- a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md +++ b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md @@ -14,9 +14,9 @@ On-premise Exchange servers support Basic authentication for crawling accounts, ## Basic Authentication -This method is supported for on-premise Exchange servers. You should -configure sufficient permissions that will allow the crawling account to impersonate the mailboxes -that you want to crawl. This requires the setup of two permissions: +On-premise Exchange servers support this method. Configure sufficient permissions that allow the +crawling account to impersonate the mailboxes that you want to crawl. This requires two +permissions: - ApplicationImpersonation—Allows the crawling account to impersonate each of the mailboxes / users configured for collection @@ -62,8 +62,8 @@ this Role as well. ADMINUSERNAME :::note -If crawling Microsoft Office 365 for Small Business or many hosted Exchange systems, then -it isn't possible to set up Application Impersonation. +If you crawl Microsoft Office 365 for Small Business or many hosted Exchange systems, you can't +set up Application Impersonation. ::: @@ -71,30 +71,29 @@ it isn't possible to set up Application Impersonation. Starting with version 5.5.3, Netwrix Data Classification allows for crawling Microsoft Exchange Online organization mailboxes using Modern authentication. For that, it uses an Azure AD application -which can use Microsoft API to connect to Exchange Online organization. +that connects to the Exchange Online organization through the Microsoft API. :::note To access Exchange using Modern Authentication, you need to use an admin username. ::: -You should configure sufficient permissions that will allow the crawling account to access and read the +Configure sufficient permissions that allow the crawling account to access and read the mailboxes that you want to crawl. The permissions required differ between the EWS and Graph implementations. -To utilise the Graph implementation, you must grant the following permissions: +To use the Graph implementation, you must grant the following permissions: - Mail.Read-Allows the application to read the full contents of all mailboxes - Mail.ReadWrite—Allows the application to move and delete mail in all mailboxes - necessary for the Exchange workflow actions - User.Read.All—Allows the application to discover all users associated with an Exchange Online server -To utilise the EWS implementation, you must grant the following permissions: +To use the EWS implementation, you must grant the following permissions: - ApplicationImpersonation—Allows the crawling account to impersonate each of the mailboxes / users configured for collection - Mailbox Search—Allows the crawling account to enumerate mailboxes (automatic discovery of mailboxes) -If you plan to make us of modern authentication, you should do the -following: +If you plan to use modern authentication, do the following: 1. [Create Azure AD app for Modern Authentication](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md) 2. Configure [Exchange Server (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md) diff --git a/docs/dataclassification/5.7/introduction/upgrade.md b/docs/dataclassification/5.7/introduction/upgrade.md index 4eaa233a72..c848e8a7e1 100644 --- a/docs/dataclassification/5.7/introduction/upgrade.md +++ b/docs/dataclassification/5.7/introduction/upgrade.md @@ -28,7 +28,7 @@ Classification resides. If not, download it from Microsoft website: - On the computer where Netwrix Data Classification is installed, start the Netwrix Data Classification Service Viewer tool. Select **Stop** next to each service. -- If upgrading a Distributed Query Server (DQS) environment, stop all services on all instances before upgrading any instance. +- If you upgrade a Distributed Query Server (DQS) environment, stop all services on all instances before upgrading any instance. :::warning If any services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for assistance with remediation. @@ -38,7 +38,7 @@ If any services are running while the upgrade occurs, database schema updates ma Files\Netwrix\Data Classification\Index_) and back it up. :::note -For versions of 5.7 before 5.7.10, all NDC services and the NDC IIS Application Pool had to run as the same service account. For 5.7.10 onwards this is no longer necessary, but if upgrading from an earlier version of 5.7, complete the upgrade to 5.7.10 _before_ changing the service account to avoid upgrade issues. +For versions of 5.7 before 5.7.10, all NDC services and the NDC IIS Application Pool had to run as the same service account. For 5.7.10 onwards this is no longer necessary, but if you upgrade from an earlier version of 5.7, complete the upgrade to 5.7.10 _before_ changing the service account to avoid upgrade issues. ::: ## Upgrade Process @@ -53,7 +53,7 @@ upgrade to version 5.7. ## Upgrading a DQS Environment -When upgrading an NDC environment which uses the **Distributed Query Server** (DQS) functionality to 5.7.10 or later, +When upgrading to 5.7.10 or later in an NDC environment that uses the **Distributed Query Server** (DQS) functionality, upgrade the primary server before the secondary instances. Secondary instances attempt to resynchronize with the primary instance during the upgrade process, and this resynchronization fails if you haven't upgraded the primary instance. From 83f4a66c7effcb0d68823fa95cf405bdc9f7b20a Mon Sep 17 00:00:00 2001 From: Ben Hayman Date: Wed, 16 Sep 2026 17:21:49 +0100 Subject: [PATCH 08/15] Removed screenshots, added dynamic source pages for EWS and Graph --- .../introduction/addsource/addsource.md | 2 -- .../addsource/exchangemailboxews.md | 2 -- .../addsource/exchangemailboxgraph.md | 1 - .../addsource/exchangeserverews.md | 4 +--- .../introduction/manage/exchangemailbox.md | 16 +++++++------- .../{exchange.md => exchangeews.md} | 13 ++++++----- .../sourcegroups/exchangegraph.md | 22 +++++++++++++++++++ .../introduction/sourcegroups/overview.md | 3 ++- 8 files changed, 41 insertions(+), 22 deletions(-) rename docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/{exchange.md => exchangeews.md} (85%) create mode 100644 docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md index 9bed3bf8d1..2956db5415 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md @@ -14,8 +14,6 @@ To add a content source: **Step 1 –** In administrative web console, navigate to **Content** →Sources → General and click **Add** to launch the Add source wizard. -![add_source_wizard_thumb_0_0](/images/dataclassification/5.7/admin/sources/add_source_wizard_thumb_0_0.webp) - **Step 2 –** Select the source you need and configure its settings. See detailed instructions for the sources: diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md index b406fed0a9..7a7d26d09d 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md @@ -30,8 +30,6 @@ specify the following: | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | | Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | -![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) - ## Authentication type: Basic To use this authentication type, specify the following: diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md index eb242e8557..fefed276e5 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -25,7 +25,6 @@ You must specify the following: | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | | Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | -![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) ## Other configuration settings diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md index 7b76a148d7..af1bf0afd6 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md @@ -7,7 +7,7 @@ sidebar_position: 40 # Exchange Server (EWS) Use the Exchange Server (EWS) source configuration screen to crawl and classify -multiple Exchange mailboxes from the same Exchange server, using the Exchange Web Services (EWS). +multiple Exchange mailboxes from the same Exchange server, using the Exchange Web Services (EWS). Due to the imminent deprecation of EWS for connecting to Exchange Online, Netwrix recommends using Exchange Server (Graph) for any new sources intended to crawl Exchange Online. :::note Automatic detection, crawling, and classification of multiple Exchange mailboxes from @@ -42,8 +42,6 @@ If you plan to use this authentication type, specify the following: | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | | Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | -![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) - ## Authentication type: Basic :::note diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md index 866ff6b9ad..564f4f54f5 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md @@ -1,33 +1,33 @@ --- -title: "Exchange Mailbox" -description: "Exchange Mailbox" +title: "Exchange" +description: "Exchange" sidebar_position: 40 --- -# Exchange Mailbox +# Exchange -For the Exchange Mailbox source, you can configure the list of folders/emails to exclude from +For the various Exchange sources, you can configure the list of folders/emails to exclude from processing. Do the following: -1. In the management console, click **Sources** →**Exchange Mailbox**, then Collection Exclusion +1. In the management console, click **Sources** →**Exchange Mailbox (EWS)** or **Exchange Mailbox (Graph)**, then the Collection Exclusion page will be displayed. 2. To create an exclusion, click **Add**. 3. ![boxexclusions](/images/dataclassification/5.7/admin/sources/database/boxexclusions.webp) 4. In the **Details** window, on the **Filter** tab enter the name of the entity to exclude. Consider the following: - - If you specify a folder name (e.g. “Drafts”) with no special characters, then any folders with + - If you specify a folder name (e.g. “Drafts”) with no wildcards, then any folders with that specific name will be excluded. :::note - Adding an exclusion of this type will match any folders with the name provided, wherever they are within the mailbox. + Adding an exclusion of this type will match any folders with the name provided, wherever they are within any mailbox. ::: - When you wrap the exclusion in wildcard indicators (e.g. “\*Deleted\*”), the system will match any folder/email with “Deleted” somewhere in the title. :::note - You can optionally enter exclusion location in the **Test Path** field to verify the + You can optionally enter an example exclusion location or path in the **Test Path** field to verify the new filter, and click **Test**. ::: diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchange.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md similarity index 85% rename from docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchange.md rename to docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md index 4a88313921..3e0d179295 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchange.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md @@ -1,18 +1,21 @@ --- -title: "Dynamic Source Groups — Exchange" -description: "Dynamic Source Groups — Exchange" +title: "Dynamic Source Groups — Exchange (EWS)" +description: "Dynamic Source Groups — Exchange (EWS)" sidebar_position: 10 --- -# Dynamic Source Groups — Exchange +# Dynamic Source Groups — Exchange (EWS) This section contains information on how to configure Exchange and Exchange Online dynamic source groups. Toggle between Basic and Advanced configuration settings by clicking the icons in the Settings button in the bottom left corner of the page. -![dynamicsourcegroupex](/images/dataclassification/5.7/admin/sources/sourcegroups/dynamicsourcegroups/dynamicsourcegroupex.webp) +:::warning +The Exchange Web Services (EWS) are in the process of being deprecated and will be fully disabled in April 2027. +For all new Exchange Online dynamic source groups, you should use the Exchange (Graph) dynamic source group. +::: -The following options can be configured for Exchange Dynamic Source Groups: +The following options can be configured for Exchange (EWS) Dynamic Source Groups: | Option | Description | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md new file mode 100644 index 0000000000..958979b52b --- /dev/null +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md @@ -0,0 +1,22 @@ +--- +title: "Dynamic Source Groups — Exchange (Graph)" +description: "Dynamic Source Groups — Exchange (Graph)" +sidebar_position: 15 +--- + +# Dynamic Source Groups — Exchange (Graph) + +This section contains information on how to configure Exchange Online dynamic source +groups. Toggle between Basic and Advanced configuration settings by clicking the icons in the +Settings button in the bottom left corner of the page. + +The following options can be configured for Exchange (Graph) Dynamic Source Groups: + +| Option | Description | +| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Cloud Environment | Select the Azure Cloud Environment hosting the Exchange tenancy to be crawled. | +| Crawl Range | Configure whether to crawl data over a date range or from a specific date onwards. | +| Match Rules | At least one match rule must be included, match rules are Regular expressions, such as:
  • `.*@mydomain.com`
  • `.*@mydomain.co.uk`
| +| Crawl In-Place Archive | Check the box to enable crawling the Exchange In-Place Archive for data. Uncheck the box to disable this option. | +| Detection Period | The Detection Period set here will apply to all Exchange and Exchange Online source groups configured under the URL set in the URL text field. Use the slider to change the Detection Period. To disable detection, set the period to **0** days and **0** hours. | +| Re-Index Period | The Re-Index Period set here will apply to all Exchange and Exchange Online source groups configured under the URL set in the URL text field. Use the slider to change the Re-Index Period. To disable re-indexing, set the period to **0**. | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md index 8bddad9853..172fd2125f 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md @@ -67,7 +67,8 @@ accessed through the Add page in the Auto-Detect a Set of Sources section. Each will have different options depending on which one is being configured. The Dynamic Source Groups are: -- [Dynamic Source Groups — Exchange](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchange.md) +- [Dynamic Source Groups — Exchange (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md) +- [Dynamic Source Groups — Exchange (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md) - [Dynamic Source Groups — File Servers](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/file.md) - [Dynamic Source Groups — Google Drive Organization](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/googledrive.md) - [Dynamic Source Groups — SharePoint Online](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/sharepoint.md) From 527f58695c107ba1c1fca786ea5e3b2e2981ed85 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 16:31:14 +0000 Subject: [PATCH 09/15] fix(vale): auto-fix style issues (Vale + Dale) --- .../introduction/addsource/addsource.md | 2 +- .../addsource/exchangemailboxgraph.md | 2 +- .../addsource/exchangeserverews.md | 2 +- .../introduction/manage/exchangemailbox.md | 20 +++++----- .../introduction/sourcegroups/exchangeews.md | 10 ++--- .../sourcegroups/exchangegraph.md | 10 ++--- .../introduction/sourcegroups/overview.md | 37 +++++++++---------- .../introduction/exchange/exchange.md | 2 +- .../5.7/introduction/upgrade.md | 2 +- 9 files changed, 43 insertions(+), 44 deletions(-) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md index 2956db5415..43e14cbfe1 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md @@ -36,5 +36,5 @@ The **Sources** section lists all your content sources. When adding a source or managing source configuration, the console displays the most commonly used source settings by default. However, some source types have additional configuration options that appear when you click the Advanced Settings ("wrench" icon). You can -set the Advanced Settings to display by default in User Preferences, accessible by clicking on the username. +set the Advanced Settings to display by default in User Preferences, which you open by clicking the username. ::: diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md index fefed276e5..184d5c0d59 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -6,7 +6,7 @@ sidebar_position: 35 # Exchange Mailbox (Graph) -Use the Exchange Mailbox (Graph) source to crawl and classify content stored in a single Exchange Online mailbox using the Microsoft Graph API. For on-premises Exchange mailboxes, [Exchange Mailbox (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md). +Use the Exchange Mailbox (Graph) source to crawl and classify content stored in a single Exchange Online mailbox using the Microsoft Graph API. For on-premises Exchange mailboxes, use [Exchange Mailbox (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md) instead. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md index af1bf0afd6..98bf06c52a 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md @@ -57,7 +57,7 @@ To use this authentication type, specify the following: ## Other configuration settings -The following settings are also required in both cases: +Both authentication types also require the following settings: | Option | Description | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md index 564f4f54f5..963dd720a0 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md @@ -9,18 +9,18 @@ sidebar_position: 40 For the various Exchange sources, you can configure the list of folders/emails to exclude from processing. Do the following: -1. In the management console, click **Sources** →**Exchange Mailbox (EWS)** or **Exchange Mailbox (Graph)**, then the Collection Exclusion page - will be displayed. +1. In the management console, click **Sources** →**Exchange Mailbox (EWS)** or **Exchange Mailbox (Graph)**. The Collection Exclusion page + appears. 2. To create an exclusion, click **Add**. 3. ![boxexclusions](/images/dataclassification/5.7/admin/sources/database/boxexclusions.webp) 4. In the **Details** window, on the **Filter** tab enter the name of the entity to exclude. Consider the following: - - If you specify a folder name (e.g. “Drafts”) with no wildcards, then any folders with - that specific name will be excluded. + - If you specify a folder name (e.g. “Drafts”) with no wildcards, then the product excludes + any folders with that specific name. :::note - Adding an exclusion of this type will match any folders with the name provided, wherever they are within any mailbox. + Adding an exclusion of this type will match any folders with the name you provide, wherever they are within any mailbox. ::: - When you wrap the exclusion in wildcard indicators (e.g. “\*Deleted\*”), the system will match any folder/email @@ -32,16 +32,16 @@ processing. Do the following: ::: -5. If needed, you can use metadata conditions to restrict when an exclusion filter should be - applied. For that, click **Condition** tab and click **Add**. Then select how the exclusion +5. If needed, you can use metadata conditions to restrict when the product applies an exclusion + filter. For that, click **Condition** tab and click **Add**. Then select how the exclusion conditions will work: it can check if metadata field of the document has any value, isn't specified, or matches a specific metadata value. | Criteria | Condition | | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | Comparison | Compare a value in the document metadata field with the value set by condition. With this criteria selected, you will then need to specify: - **Field name** — document metadata field to check - **Comparison** — operator to use (for example, "doesn't contain") - **Value** — value to compare against For example, to exclude documents tagged with year 2018, set the condition as follows: - **Field Name** — _DocYear_ - **Comparison** — _equals_ - **Value** — _2018_ | - | Has any value | Exclude the document if its metadata field has any value. With this criteria selected, specify **Field Name**. | - | Has no values | Exclude the document if metadata field value isn't specified. With this criteria selected, specify **Field Name**. | + | Comparison | Compare a value in the document metadata field with the value the condition sets. When you select this criteria, specify: - **Field name** — document metadata field to check - **Comparison** — operator to use (for example, "doesn't contain") - **Value** — value to compare against For example, to exclude documents tagged with year 2018, set the condition as follows: - **Field Name** — _DocYear_ - **Comparison** — _equals_ - **Value** — _2018_ | + | Has any value | Exclude the document if its metadata field has any value. When you select this criteria, specify **Field Name**. | + | Has no values | Exclude the document if metadata field value isn't specified. When you select this criteria, specify **Field Name**. | When finished, click **Add**. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md index 3e0d179295..86c028fc8e 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md @@ -11,18 +11,18 @@ groups. Toggle between Basic and Advanced configuration settings by clicking the Settings button in the bottom left corner of the page. :::warning -The Exchange Web Services (EWS) are in the process of being deprecated and will be fully disabled in April 2027. +Microsoft is deprecating Exchange Web Services (EWS) and will fully disable it in April 2027. For all new Exchange Online dynamic source groups, you should use the Exchange (Graph) dynamic source group. ::: -The following options can be configured for Exchange (EWS) Dynamic Source Groups: +You can configure the following options for Exchange (EWS) Dynamic Source Groups: | Option | Description | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Authentication Type | Basic — With **Credentials**, users authenticate using email address and password credentials Modern (O365) — With **Modern (O365)**, users authenticate using Tenant ID | | Exchange API Url | Enter a URL for an Exchange API for data collection. Leave this field blank to autodetect Exchange APIs. | | Crawl Range | Configure whether to crawl data over a date range or from a specific date onwards. | -| Match Rules | At least one match rule must be included, match rules are Regular expressions, such as:
  • `.*@mydomain.com`
  • `.*@mydomain.co.uk`
| +| Match Rules | You must include at least one match rule. Match rules are regular expressions, such as:
  • `.*@mydomain.com`
  • `.*@mydomain.co.uk`
| | Crawl In-Place Archive | Check the box to enable crawling the Exchange In-Place Archive for data. Uncheck the box to disable this option. | -| Detection Period | The Detection Period set here will apply to all Exchange and Exchange Online source groups configured under the URL set in the URL text field. Use the slider to change the Detection Period. To disable detection, set the period to **0** days and **0** hours. | -| Re-Index Period | The Re-Index Period set here will apply to all Exchange and Exchange Online source groups configured under the URL set in the URL text field. Use the slider to change the Re-Index Period. To disable re-indexing, set the period to **0**. | +| Detection Period | The Detection Period you set here applies to all Exchange and Exchange Online source groups configured under the URL you enter in the URL text field. Use the slider to change the Detection Period. To disable detection, set the period to **0** days and **0** hours. | +| Re-Index Period | The Re-Index Period you set here applies to all Exchange and Exchange Online source groups configured under the URL you enter in the URL text field. Use the slider to change the Re-Index Period. To disable re-indexing, set the period to **0**. | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md index 958979b52b..9acf21a9f0 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md @@ -10,13 +10,13 @@ This section contains information on how to configure Exchange Online dynamic so groups. Toggle between Basic and Advanced configuration settings by clicking the icons in the Settings button in the bottom left corner of the page. -The following options can be configured for Exchange (Graph) Dynamic Source Groups: +You can configure the following options for Exchange (Graph) Dynamic Source Groups: | Option | Description | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Cloud Environment | Select the Azure Cloud Environment hosting the Exchange tenancy to be crawled. | +| Cloud Environment | Select the Azure Cloud Environment hosting the Exchange tenancy you want to crawl. | | Crawl Range | Configure whether to crawl data over a date range or from a specific date onwards. | -| Match Rules | At least one match rule must be included, match rules are Regular expressions, such as:
  • `.*@mydomain.com`
  • `.*@mydomain.co.uk`
| +| Match Rules | You must include at least one match rule. Match rules are regular expressions, such as:
  • `.*@mydomain.com`
  • `.*@mydomain.co.uk`
| | Crawl In-Place Archive | Check the box to enable crawling the Exchange In-Place Archive for data. Uncheck the box to disable this option. | -| Detection Period | The Detection Period set here will apply to all Exchange and Exchange Online source groups configured under the URL set in the URL text field. Use the slider to change the Detection Period. To disable detection, set the period to **0** days and **0** hours. | -| Re-Index Period | The Re-Index Period set here will apply to all Exchange and Exchange Online source groups configured under the URL set in the URL text field. Use the slider to change the Re-Index Period. To disable re-indexing, set the period to **0**. | +| Detection Period | The Detection Period you set here applies to all Exchange and Exchange Online source groups configured under the URL you enter in the URL text field. Use the slider to change the Detection Period. To disable detection, set the period to **0** days and **0** hours. | +| Re-Index Period | The Re-Index Period you set here applies to all Exchange and Exchange Online source groups configured under the URL you enter in the URL text field. Use the slider to change the Re-Index Period. To disable re-indexing, set the period to **0**. | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md index 172fd2125f..e01ad1ca24 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md @@ -6,14 +6,14 @@ sidebar_position: 60 # Source Groups -Source groups provide a way of logically grouping specific sources, perhaps by type, or perhaps by -an internal business specification. +Source groups logically group specific sources, perhaps by type or by an internal business +specification. A group can either be "mixed", which allows it to contain all source types, or source-specific. For example, you could create a source group named "Demo Content", which only supports the addition of SharePoint sources. When you create a source, any existing source groups that support that source type appear in a dropdown in the source configuration screen. -Certain source types are treated as source groups. See [Dynamic Source Groups](#dynamic-source-groups) for the available +Netwrix Data Classification treats certain source types as source groups. See [Dynamic Source Groups](#dynamic-source-groups) for the available group types and configuration options. Select the cog icon on the main sources grid screen for a source group to amend the @@ -25,26 +25,26 @@ Here you can: - Amend the group name - Delete the group -- Disable Search Index — When disabled, content will not be processed into the core search index - (classification will occur as normal, although content will be excluded from Browse / Search / - Suggestions). -- Discovery mode — This allows a source to be fully enumerated before any files are processed. +- Disable Search Index — When you disable this option, the product doesn't process content into the + core search index (classification occurs as normal, although Browse, Search, and Suggestions + exclude the content). +- Discovery mode — The product fully enumerates a source before processing any files. - _(SharePoint only)_ Supply regular expression rules to support automatically assigning sources to a specific group -- Enable Text Extraction - Allows reading the documents and run classification rules against their - content. By unticking the checkbox, the system can fetch only the metadata without crawling the - entire document. After this you can run a workflow to remove the old data, using **Document Age** - option. Unlike Discovery Mode, you can still run workflows if the workflow is triggered solely by - metadata. See [Step 3. Specify Conditions for Processing](/docs/dataclassification/5.7/contentconfigurationoverview/workflows/manage/addworkflowwizard/step3specifyconditions.md) for instructions on configuring metadata-only workflows. +- Enable Text Extraction - Allows reading the documents and running classification rules against + their content. If you untick the checkbox, the system fetches only the metadata without crawling + the entire document. After this you can run a workflow to remove the old data, using the + **Document Age** option. Unlike in Discovery Mode, you can still run workflows if metadata alone + triggers the workflow. See [Step 3. Specify Conditions for Processing](/docs/dataclassification/5.7/contentconfigurationoverview/workflows/manage/addworkflowwizard/step3specifyconditions.md) for instructions on configuring metadata-only workflows. :::note -Credentials will only be supported if the source group is type-specific. +The product supports credentials only if the source group is type-specific. ::: Deleting a group will remove all existing items from the group leaving them unassigned. You can also remove specific sources from a group by selecting the source group in the grid and then -selecting Remove from Group for the required sources. Source groups can also be created and -assigned as part of the source creation process. +selecting Remove from Group for the required sources. You can create and assign source groups +as part of the source creation process. By going to the Settings of the Source Group, you can: @@ -62,10 +62,9 @@ By going to the Settings of the Source Group, you can: ## Dynamic Source Groups -Dynamic Source Groups are used to add a collection of sources at once. These source groups are -accessed through the Add page in the Auto-Detect a Set of Sources section. Each Dynamic Source Group -will have different options depending on which one is being configured. The Dynamic Source Groups -are: +Use Dynamic Source Groups to add a collection of sources at once. You access these source groups +through the Add page in the Auto-Detect a Set of Sources section. Each Dynamic Source Group has +different options depending on which one you configure. The Dynamic Source Groups are: - [Dynamic Source Groups — Exchange (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md) - [Dynamic Source Groups — Exchange (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md) diff --git a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md index 2573ab1127..93bd84b4cd 100644 --- a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md +++ b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md @@ -69,7 +69,7 @@ set up Application Impersonation. ## Modern Authentication -Starting with version 5.5.3, Netwrix Data Classification allows for crawling Microsoft Exchange +Starting with version 5.5.3, Netwrix Data Classification can crawl Microsoft Exchange Online organization mailboxes using Modern authentication. For that, it uses an Azure AD application that connects to the Exchange Online organization through the Microsoft API. diff --git a/docs/dataclassification/5.7/introduction/upgrade.md b/docs/dataclassification/5.7/introduction/upgrade.md index c848e8a7e1..b4fe4fc720 100644 --- a/docs/dataclassification/5.7/introduction/upgrade.md +++ b/docs/dataclassification/5.7/introduction/upgrade.md @@ -31,7 +31,7 @@ Classification resides. If not, download it from Microsoft website: - If you upgrade a Distributed Query Server (DQS) environment, stop all services on all instances before upgrading any instance. :::warning -If any services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for assistance with remediation. +If any services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for help. ::: **Step 4 –** Back up the Index files. Locate the folder containing the index files (the default location is _C:\Program From c026ebe04528a4b5d1d143a7ccc6279750c1e0e3 Mon Sep 17 00:00:00 2001 From: Ben Hayman Date: Wed, 16 Sep 2026 19:02:50 +0100 Subject: [PATCH 10/15] removed last screenshot --- .../introduction/addsource/exchangeservergraph.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md index 4531e2c1a7..972120479a 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md @@ -32,8 +32,6 @@ You must specify the following: | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | | Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | -![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) - ## Other configuration settings Specify the following settings: From 9a9205d6912025f650ac4130abad24ec0a2c649c Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 18:09:39 +0000 Subject: [PATCH 11/15] fix(vale): auto-fix style issues (Vale + Dale) --- .../introduction/addsource/exchangemailboxews.md | 2 +- .../introduction/addsource/exchangemailboxgraph.md | 2 +- .../introduction/manage/exchangemailbox.md | 6 +++--- .../5.7/introduction/introduction/exchange/exchange.md | 2 +- docs/dataclassification/5.7/introduction/upgrade.md | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md index 7a7d26d09d..471fe9b369 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md @@ -50,7 +50,7 @@ By default, only basic settings appear. To view advanced options, click the "wre | Crawl Range | Define the time period to crawl:
  • Select **Date Range** to crawl a static set of data within the specified interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date onwards, taking into account the last crawl date for each object.
| | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | Applies to Exchange Online. | | OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | -| Source Group | Select the source group to add this source to. If no source groups exist, the product creates one automatically, named after the source. | | +| Source Group | Select the source group to add this source to. If no source groups exist, the product automatically creates one named after the source. | | | Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | | **Advanced settings** | | | | Build Search Index | Select to create a search index. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md index 184d5c0d59..aa49130146 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -39,7 +39,7 @@ By default, only basic settings appear. To view advanced options, click the "wre | Crawl Range | Define the time period to crawl:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each object.
| | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | | | OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | -| Source Group | Select the source group to add this source to. If no source groups exist, the product creates one automatically, named after the source. | | +| Source Group | Select the source group to add this source to. If no source groups exist, the product automatically creates one named after the source. | | | Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | | **Advanced settings** | | | | Build Search Index | Select to create a search index. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md index 963dd720a0..31f3bd2cce 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md @@ -34,14 +34,14 @@ processing. Do the following: 5. If needed, you can use metadata conditions to restrict when the product applies an exclusion filter. For that, click **Condition** tab and click **Add**. Then select how the exclusion - conditions will work: it can check if metadata field of the document has any value, isn't - specified, or matches a specific metadata value. + conditions will work: it can check whether the document's metadata field has any value, has no + value, or matches a specific metadata value. | Criteria | Condition | | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Comparison | Compare a value in the document metadata field with the value the condition sets. When you select this criteria, specify: - **Field name** — document metadata field to check - **Comparison** — operator to use (for example, "doesn't contain") - **Value** — value to compare against For example, to exclude documents tagged with year 2018, set the condition as follows: - **Field Name** — _DocYear_ - **Comparison** — _equals_ - **Value** — _2018_ | | Has any value | Exclude the document if its metadata field has any value. When you select this criteria, specify **Field Name**. | - | Has no values | Exclude the document if metadata field value isn't specified. When you select this criteria, specify **Field Name**. | + | Has no values | Exclude the document if the metadata field has no value. When you select this criteria, specify **Field Name**. | When finished, click **Add**. diff --git a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md index 93bd84b4cd..be07e5b03a 100644 --- a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md +++ b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md @@ -78,7 +78,7 @@ To access Exchange using Modern Authentication, you need to use an admin usernam ::: Configure sufficient permissions that allow the crawling account to access and read the -mailboxes that you want to crawl. The permissions required differ between the EWS and Graph implementations. +mailboxes that you want to crawl. The permissions required differ between the Exchange Web Services (EWS) and Graph implementations. To use the Graph implementation, you must grant the following permissions: diff --git a/docs/dataclassification/5.7/introduction/upgrade.md b/docs/dataclassification/5.7/introduction/upgrade.md index b4fe4fc720..979f1790b3 100644 --- a/docs/dataclassification/5.7/introduction/upgrade.md +++ b/docs/dataclassification/5.7/introduction/upgrade.md @@ -26,7 +26,7 @@ Classification resides. If not, download it from Microsoft website: **Step 3 –** Stop all NDC services. Netwrix recommends the following: -- On the computer where Netwrix Data Classification is installed, start the Netwrix Data +- On the computer where Netwrix Data Classification resides, start the Netwrix Data Classification Service Viewer tool. Select **Stop** next to each service. - If you upgrade a Distributed Query Server (DQS) environment, stop all services on all instances before upgrading any instance. From c63eb6639f70b0addce2de1d642e90ab260005ee Mon Sep 17 00:00:00 2001 From: thobed <10742470+thobed@users.noreply.github.com> Date: Wed, 16 Sep 2026 19:22:44 -0400 Subject: [PATCH 12/15] Document automatic TLS certificate issuance for Access Analyzer 26.1 Adds ACME and AD CS certificate-manager modes, the self-signed bootstrap cert flags, and the standalone --preflight mode to the installer docs. --- .../26.1/install/adcs-tls-certificates.md | 86 ++++++++++++ .../install/automatic-tls-certificates.md | 124 ++++++++++++++++++ .../26.1/install/installer-reference.md | 47 ++++++- .../26.1/install/run-the-installer.md | 4 + 4 files changed, 260 insertions(+), 1 deletion(-) create mode 100644 docs/accessanalyzer/26.1/install/adcs-tls-certificates.md create mode 100644 docs/accessanalyzer/26.1/install/automatic-tls-certificates.md diff --git a/docs/accessanalyzer/26.1/install/adcs-tls-certificates.md b/docs/accessanalyzer/26.1/install/adcs-tls-certificates.md new file mode 100644 index 0000000000..e01dbc0840 --- /dev/null +++ b/docs/accessanalyzer/26.1/install/adcs-tls-certificates.md @@ -0,0 +1,86 @@ +--- +title: AD CS TLS Certificates +description: Let Access Analyzer obtain and renew its TLS certificate automatically from your on-premises Active Directory Certificate Services (AD CS) enterprise certificate authority. +sidebar_position: 4.6 +--- + +The `adcs` mode hands certificate issuance and renewal to your own Active Directory Certificate Services (AD CS) enterprise certificate authority (CA), instead of a manual certificate you rotate by hand or a public CA like Let's Encrypt. See [Automatic TLS Certificates](automatic-tls-certificates.md) for the full list of automatic modes and how they compare. + +cert-manager submits enrollment requests to your AD CS server's `/certsrv` web enrollment endpoint using NT LAN Manager (NTLM) authentication. The certificate AD CS issues lands at the same location Access Analyzer already reads its TLS certificate from, and cert-manager renews it before it expires — no maintenance window, no `update-cert` runs. + +This mode fits enterprises that already run a Microsoft public key infrastructure (PKI) and want Access Analyzer's certificate to come from it rather than from a public CA. + +## Before you start + +The `adcs` mode requires: + +1. **The AD CS enrollment details.** + + | Flag | Requirement | + |---|---| + | `--adcs-url` | The AD CS server's `/certsrv` web enrollment endpoint URL. Required. | + | `--adcs-username` | An NTLM enrollment account. Required. | + | `--adcs-password` | The account's password. Required. Pass it through the `DSPM_ADCS_PASSWORD` environment variable rather than the flag when scripting — see [Install with AD CS certificates](#install-with-ad-cs-certificates). | + | `--adcs-template` | The certificate template to request. Defaults to `WebServer`. | + | `--adcs-ca-bundle` | A PEM bundle for TLS to the AD CS server itself, separate from `--ca-bundle`. | + + See [Certificate Manager Flags](installer-reference.md#certificate-manager-flags) for full details on each flag. + +2. **A bootstrap certificate.** As with the `acme` mode, the web server needs something to serve before the first AD CS certificate arrives. Pass `--generate-self-signed-cert` to create a temporary self-signed pair, or supply `--tls-cert`/`--tls-key` with existing files instead. See [Before you start](automatic-tls-certificates.md#before-you-start) for the same requirement in the `acme` mode. + +:::warning +Set Extended Protection for Authentication (EPA) on the AD CS server's `/certsrv` endpoint to **Off** or **Allow**, not **Required**. The `adcs` issuer authenticates over NTLM without channel-binding tokens, so a `/certsrv` endpoint that requires EPA rejects every enrollment attempt with HTTP 401. +::: + +:::note +cert-manager's certificate signing request carries only Common Name and Organization in the subject. If the certificate template you name with `--adcs-template` requires Organizational Unit, Country, State, or Locality, AD CS rejects the enrollment. +::: + +## Install with AD CS certificates + +Follow [Install Access Analyzer](run-the-installer.md) as usual, adding the AD CS flags. You can skip the "Copy the TLS Certificate to the Server" step — `--generate-self-signed-cert` replaces it. + +```bash +export DSPM_ADCS_PASSWORD='' + +sudo -E dspm-installer \ + --hostname dspm.corp.example.com \ + --first-admin-email admin@corp.example.com \ + --cert-manager-issuer-mode adcs \ + --adcs-url https://ca.corp.example.com/certsrv \ + --adcs-username svc-adcs-enroll \ + --adcs-template WebServer \ + --generate-self-signed-cert +``` + +- `--cert-manager-issuer-mode adcs` turns on AD CS issuance. +- `--adcs-url`, `--adcs-username`, and `--adcs-password` (here set through `DSPM_ADCS_PASSWORD`) are required. +- Setting the password through the environment variable instead of `--adcs-password` keeps it out of shell history and process listings. +- `--generate-self-signed-cert` provides the bootstrap certificate. + +The install proceeds exactly as described in [Install Access Analyzer](run-the-installer.md). When the services are up, the cluster requests the certificate from your AD CS server; issuance typically completes within a minute or two. Browsers connecting during that window see the self-signed bootstrap certificate and show a trust warning — the warning stops when the AD CS certificate is in place. + +:::note +The installer doesn't save the issuance mode to `/etc/dspm/installer.yaml`. Every installer run uses exactly the `--cert-manager-issuer-mode` you pass it; omitting the flag means manual certificates. Upgrading never changes the mode. +::: + +## Confirm the certificate + +From any machine with a browser, open `https://` — there should be no certificate warning. To check from a shell: + +```bash +openssl s_client -connect :443 -servername /dev/null \ + | openssl x509 -noout -subject -issuer -dates +``` + +The issuer should name your AD CS CA. If the issuer is still your own hostname, the bootstrap certificate is still serving. Check the certificate and challenge status on the server: + +```bash +sudo kubectl describe certificate dspm-tls -n access-analyzer +``` + +The certificate's events show what AD CS returned, including an HTTP 401 from an EPA-hardened endpoint or a rejected enrollment from a template requiring unsupported subject fields. + +## Switch an existing installation + +Switching to, from, or between automatic modes works the same way for `adcs` as it does for the other modes. See [Switch an existing installation](automatic-tls-certificates.md#switch-an-existing-installation) for the full procedure. diff --git a/docs/accessanalyzer/26.1/install/automatic-tls-certificates.md b/docs/accessanalyzer/26.1/install/automatic-tls-certificates.md new file mode 100644 index 0000000000..89614805ea --- /dev/null +++ b/docs/accessanalyzer/26.1/install/automatic-tls-certificates.md @@ -0,0 +1,124 @@ +--- +title: Automatic TLS Certificates +description: Let Access Analyzer obtain and renew its TLS certificate automatically from Let's Encrypt or another ACME certificate authority, or from an internal chain it manages itself. +sidebar_position: 4.5 +--- + +Instead of supplying a certificate file and rotating it by hand, you can hand certificate issuance and renewal to the cluster itself. Pass `--cert-manager-issuer-mode` to the installer and Access Analyzer obtains its own certificate, renews it before it expires, and reloads it without a restart — no maintenance window, no `update-cert` runs. + +Three automatic modes are available: + +| Mode | Certificate comes from | Best for | +|---|---|---| +| `acme` | Let's Encrypt (default) or any ACME-compatible certificate authority | Servers reachable from the internet, or organizations running a private ACME CA | +| `adcs` | Your Active Directory Certificate Services CA | Enterprises with an existing Microsoft public key infrastructure (PKI) | +| `selfsigned` | An internal CA the cluster creates and manages itself | Demos, labs, and isolated environments | + +If you don't pass the flag, nothing changes: the installer uses the certificate files you supply, and you rotate them yourself with [`update-cert`](rotate-the-tls-certificate.md). + +This page covers the `acme` mode. For `adcs`, see [AD CS TLS Certificates](adcs-tls-certificates.md). For `selfsigned`, see the [Installer reference](installer-reference.md). + +## About Let's Encrypt and ACME + +The nonprofit Internet Security Research Group operates [Let's Encrypt](https://letsencrypt.org), a free, publicly trusted certificate authority (CA). There are no fees and no account to create ahead of time — you only provide an email address for expiry and incident notices. All mainstream browsers and operating systems trust its certificates, so users see no certificate warnings. + +Let's Encrypt issues certificates over ACME (Automatic Certificate Management Environment), an open protocol in which the certificate authority verifies that you control the domain before issuing. Access Analyzer uses the HTTP-01 challenge: the certificate authority connects to `http:///.well-known/acme-challenge/` on port 80 and checks for a response only your server could produce. The cluster answers this challenge automatically — you never handle the token. + +Certificates are valid for 90 days and Access Analyzer renews them automatically 30 days before expiry, using the same challenge. As long as your DNS record and firewall rules stay in place, no one has to update the certificate again. + +The `acme` mode works with any ACME-compatible certificate authority, not only Let's Encrypt — see [Use a private ACME certificate authority](#use-a-private-acme-certificate-authority). + +## Before you start + +The `acme` mode with Let's Encrypt has requirements the manual certificate path doesn't: + +1. **Public DNS.** The hostname you install with must resolve on public DNS to this server. Let's Encrypt looks the name up itself and connects to whatever address it finds — an entry in `/etc/hosts` or on your internal DNS isn't enough. + +2. **Inbound ports 80 and 443 open from the internet.** The HTTP-01 challenge arrives on port 80; Access Analyzer serves the application itself on port 443. If a firewall or NAT blocks either, issuance never completes. + +3. **An email address** for the ACME account. Let's Encrypt sends certificate expiry warnings and incident notices there. + +4. **A bootstrap certificate.** The web server needs something to serve during the minute or two before the first Let's Encrypt certificate arrives. The simplest choice is `--generate-self-signed-cert`, which creates a temporary self-signed pair; you can pass `--tls-cert`/`--tls-key` with existing files instead. Use `--tls-cert-validity-days` (alias `--cert-days`) to set the bootstrap certificate's validity period — the default is 365 days, and the maximum is 36500. See the [Installer reference](installer-reference.md) for both flags. + +:::warning +The installer checks that the ACME flags are present, but it can't check that Let's Encrypt can actually reach your server. If DNS or the firewall is wrong, the install completes but the certificate stays pending and the site keeps serving the bootstrap certificate. See [If the certificate stays pending](#if-the-certificate-stays-pending). +::: + +## Install with automatic certificates + +Follow [Install Access Analyzer](run-the-installer.md) as usual, adding the ACME flags. You can skip the "Copy the TLS Certificate to the Server" step — `--generate-self-signed-cert` replaces it. + +```bash +sudo -E dspm-installer \ + --hostname dspm.example.com \ + --first-admin-email admin@example.com \ + --cert-manager-issuer-mode acme \ + --acme-email ops@example.com \ + --generate-self-signed-cert +``` + +- `--cert-manager-issuer-mode acme` turns on automatic issuance. +- This mode requires `--acme-email`. +- `--generate-self-signed-cert` provides the bootstrap certificate. + +Each flag also has an environment variable (`CERT_MANAGER_ISSUER_MODE`, `ACME_EMAIL`, `ACME_SERVER`), listed in the [Installer reference](installer-reference.md). + +The install proceeds exactly as described in [Install Access Analyzer](run-the-installer.md). When the services are up, the cluster requests the certificate from Let's Encrypt; issuance typically completes within a minute or two. Browsers connecting during that window see the self-signed bootstrap certificate and show a trust warning — the warning stops when the Let's Encrypt certificate is in place. + +:::note +The installer doesn't save the issuance mode to `/etc/dspm/installer.yaml`. Every installer run uses exactly the `--cert-manager-issuer-mode` you pass it; omitting the flag means manual certificates. Upgrading never changes the mode. +::: + +## Confirm the certificate + +From any machine with a browser, open `https://` — there should be no certificate warning. To check from a shell: + +```bash +openssl s_client -connect :443 -servername /dev/null \ + | openssl x509 -noout -subject -issuer -dates +``` + +The issuer should name Let's Encrypt (for example `issuer=C=US, O=Let's Encrypt, CN=...`), and the dates should show a 90-day window. If the issuer is still your own hostname, the bootstrap certificate is still serving — see the next section. + +## If the certificate stays pending + +If the site keeps serving the bootstrap certificate more than a few minutes after install, the challenge is failing. On the server: + +```bash +sudo kubectl describe certificate dspm-tls -n access-analyzer +sudo kubectl get challenges -A +``` + +The certificate's events and the challenge's status show what Let's Encrypt saw. The common causes: + +- **The hostname doesn't resolve publicly**, or resolves to a different address. Check with a resolver outside your network: `dig +short @1.1.1.1`. +- **Port 80 is blocked.** The challenge always arrives on port 80, even though the application serves on 443. Test from outside your network: `curl -I http:///.well-known/acme-challenge/test` should return an HTTP response (a 404 is fine — a timeout is the problem). +- **Rate limits.** Let's Encrypt limits how many certificates it issues per domain per week. Repeated reinstalls against the same hostname can hit them; the challenge status names the limit explicitly. Wait, or test against the [staging environment](#use-a-private-acme-certificate-authority) instead. + +Fix the cause and the cluster retries automatically — no reinstall needed. + +## Use a private ACME certificate authority + +If your organization runs its own ACME-compatible certificate authority (for example smallstep `step-ca`), point `--acme-server` at its directory URL and supply that CA's root chain with `--ca-bundle` so Access Analyzer's own services trust the certificates it issues: + +```bash +sudo -E dspm-installer \ + --hostname dspm.corp.example.com \ + --cert-manager-issuer-mode acme \ + --acme-server https://ca.corp.example.com/acme/acme/directory \ + --acme-email pki-admins@corp.example.com \ + --ca-bundle /etc/dspm/corp-root-ca.pem \ + --generate-self-signed-cert +``` + +With a private CA the public-DNS requirement relaxes to: the hostname must resolve, and ports 80 and 443 must be reachable, **from the CA's network** rather than from the internet. + +:::note +Let's Encrypt's **staging** environment (`https://acme-staging-v02.api.letsencrypt.org/directory`) counts as a private CA here: its certificates chain to deliberately untrusted test roots. Use it to test the flow without consuming production rate limits, and pass its roots as the `--ca-bundle`. +::: + +## Switch an existing installation + +**From manual certificates to ACME** — re-run the installer with the `acme` flags. The new certificate replaces the existing one automatically at first issuance; you don't need any manual cleanup, and the web server loads it without a restart. If the previous setup used `--ca-bundle` and you're moving to public Let's Encrypt, also delete the `ca-bundle` line from `/etc/dspm/installer.yaml` so the installer doesn't reapply the old trust anchor. + +**From ACME back to manual certificates** — re-run the installer without `--cert-manager-issuer-mode` (or with `none`), supplying `--tls-cert`/`--tls-key` as usual, plus `--ca-bundle` if a private CA issued the certificate. From then on you rotate it yourself with [`update-cert`](rotate-the-tls-certificate.md). diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index 4e2573fece..d428659f95 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -30,6 +30,9 @@ Two environment variable names need care: `--hostname` reads `DSPM_HOSTNAME`, no | `--tls-cert` | `TLS_CERT_FILE` | `/etc/dspm/tls.crt` | PEM TLS certificate file, full chain with the leaf certificate first. Requires `--tls-key`. | | `--tls-key` | `TLS_KEY_FILE` | `/etc/dspm/tls.key` | PEM TLS private key file. Requires `--tls-cert`. | | `--ca-bundle` | `TLS_CA_BUNDLE_FILE` | none | PEM certificate authority (CA) bundle. Needed when a private CA issued the certificate. | +| `--generate-self-signed-cert` (alias `--self-signed`) | `DSPM_GENERATE_SELF_SIGNED_CERT` | `false` | Generate a one-time self-signed certificate and key pair at the resolved TLS paths instead of requiring one on disk. Requires `--hostname`. The installer only generates a certificate when none already exists at those paths — it never overwrites an existing one — and skips this under `--dry-run`. | +| `--tls-cert-validity-days` (alias `--cert-days`) | `DSPM_TLS_CERT_VALIDITY_DAYS` | `365` | Validity period, in days, for a certificate `--generate-self-signed-cert` generates. Maximum `36500`. | +| `--cert-manager-issuer-mode` (alias `--issuer-mode`) | `CERT_MANAGER_ISSUER_MODE` | `none` | Hand issuance and renewal of the `dspm-tls` certificate to cert-manager instead of managing it yourself: `none`, `selfsigned`, `adcs`, or `acme`. See [Automatic TLS Certificates](automatic-tls-certificates.md) for the `acme` mode. The installer doesn't save this to `/etc/dspm/installer.yaml` — see [Configuration File](#configuration-file). | | `--size` | `SIZE` | `medium` | Deployment size: `small`, `medium`, `large`, or `enterprise`. Case-insensitive. See [Size](requirements.md#size) for the CPU, RAM, and disk each size requires. | | `--target-revision` | `TARGET_REVISION` | `1.*` | Release version to install, such as `1.5.0`. The default installs the latest 1.x release. Also appears as **Target Revision** under **Show advanced settings?**. | | `--accept-warnings` | `ACCEPT_WARNINGS` | `false` | Continue past preflight warnings without asking. | @@ -41,6 +44,7 @@ Two environment variable names need care: `--hostname` reads `DSPM_HOSTNAME`, no | `--clickhouse-data-dir` | `CLICKHOUSE_DATA_DIR` | none | Custom directory for the analytics store's data. | | `--log-exports-storage` | `LOG_EXPORTS_STORAGE` | none | Persistent volume claim (PVC) size for log exports, such as `10Gi`. | | `--skip-preflight` | `SKIP_PREFLIGHT` | `false` | Skip the preflight checks. For testing only. | +| `--preflight` | `DSPM_PREFLIGHT` | `false` | Run the preflight checks only, then exit without installing. See [Preflight-only mode](#preflight-only-mode). | | `--version` | — | — | Print the installer version and exit. | | `--help` | — | — | Print flag help and exit. | @@ -73,6 +77,33 @@ These flags control the underlying Kubernetes platform, ArgoCD, and Helm chart t A custom data directory must be an absolute path to an existing, writable directory. It can't be `/`, can't sit under `/bin`, `/sbin`, `/boot`, `/dev`, `/etc`, `/lib`, `/lib64`, `/proc`, `/root`, `/run`, `/sys`, `/usr`, or `/var/log`, and can't contain quotes, backslashes, dollar signs, or backticks. +### Certificate Manager Flags + +The installer only reads the following flags when `--cert-manager-issuer-mode` selects the matching mode: the Automatic Certificate Management Environment (ACME) flags apply to `acme`, and the Active Directory Certificate Services (AD CS) flags apply to `adcs`. See [Automatic TLS Certificates](automatic-tls-certificates.md) for `acme` and `selfsigned`, and [AD CS TLS Certificates](adcs-tls-certificates.md) for `adcs`. + +| Flag | Environment variable | Default | Description | +|---|---|---|---| +| `--acme-email` | `ACME_EMAIL` | none | Email address for the ACME account. Required in `acme` mode. | +| `--acme-server` | `ACME_SERVER` | Let's Encrypt production | ACME directory URL. Point this at a private ACME certificate authority (CA) for internal issuance. | + +| Flag | Environment variable | Default | Description | +|---|---|---|---| +| `--adcs-url` | `ADCS_URL` | none | The Active Directory Certificate Services (AD CS) server's `/certsrv` web enrollment endpoint URL. Required in `adcs` mode. | +| `--adcs-username` | `ADCS_USERNAME` | none | NT LAN Manager (NTLM) enrollment account for the AD CS server. Required in `adcs` mode. | +| `--adcs-password` | `DSPM_ADCS_PASSWORD` | none | Password for `--adcs-username`. Required in `adcs` mode. The installer never persists it to the configuration file or logs it. | +| `--adcs-template` | `ADCS_TEMPLATE` | `WebServer` | Certificate template to request from the AD CS server. | +| `--adcs-ca-bundle` | `ADCS_CA_BUNDLE` | none | PEM bundle for TLS to the AD CS server itself. This is separate from `--ca-bundle`, which covers Access Analyzer's own certificate chain. | + +:::warning +Set Extended Protection for Authentication (EPA) on the AD CS server's `/certsrv` endpoint to **Off** or **Allow**, not **Required**. The `adcs` issuer authenticates over NTLM without channel-binding tokens, so a `/certsrv` endpoint that requires EPA rejects every enrollment attempt with HTTP 401. +::: + +:::note +cert-manager's certificate signing request carries only Common Name and Organization in the subject. If the AD CS certificate template you name with `--adcs-template` requires Organizational Unit, Country, State, or Locality, AD CS rejects the enrollment. +::: + +There's no interactive wizard step for `adcs` mode — configure it with flags only. + ### Value Checks The installer rejects bad values before it changes anything on the server. @@ -89,7 +120,7 @@ The installer rejects bad values before it changes anything on the server. The installer keeps its answers in `/etc/dspm/installer.yaml`. It writes the file itself: after every confirmed prompt in an interactive run, or once after license validation in a flag-driven run. On the first save it prints `Progress saved to /etc/dspm/installer.yaml — future runs will pre-fill these values.` A later run reads the file and asks only for what's still missing, so a canceled install resumes where it stopped. -Keys are the flag names. The installer writes `license-key`, `hostname`, `first-admin-email`, `first-admin-name`, `tls-cert`, `tls-key`, and `ca-bundle`, plus `target-revision` when you pin a version other than `1.*`. It keeps any keys you add, and never saves operational flags such as `--accept-warnings`, `--assume-yes`, `--dry-run`, and `--skip-preflight`. You can also write the file by hand before the first run. +Keys are the flag names. The installer writes `license-key`, `hostname`, `first-admin-email`, `first-admin-name`, `tls-cert`, `tls-key`, and `ca-bundle`, plus `target-revision` when you pin a version other than `1.*`. It keeps any keys you add, and never saves operational flags such as `--accept-warnings`, `--assume-yes`, `--dry-run`, `--skip-preflight`, `--preflight`, and `--cert-manager-issuer-mode`. You can also write the file by hand before the first run. ```yaml title="/etc/dspm/installer.yaml" license-key: XXXX-XXXX-XXXX-XXXX-XXXX-V3 @@ -146,6 +177,20 @@ When the `antivirus` check finds a product, add these paths to that product's ex The [Requirements](requirements.md) page lists the 18 hosts the `network` check connects to and the CPU, RAM, and disk figures for each size. +### Preflight-only mode + +Pass `--preflight` to run the preflight checks and exit, without installing k3s, creating the cluster, or writing a configuration file. Use it to validate a server before you commit to an install. + +`--preflight` runs the same checks listed in this section, plus a certificate check: the PEM certificate and key at the resolved TLS paths must exist, match, and not be expired. A certificate expiring within 30 days still passes, because a real install would also proceed on it. Pass `--hostname` to also verify the certificate's Subject Alternative Names cover it, and `--size` to check RAM, CPU, and disk against the size you intend to install. Under `--dry-run`, the installer skips the certificate check, matching a dry-run install. + +You can't combine `--preflight` with `--uninstall` or `--skip-preflight`. It writes the same `/var/log/dspm-installer.log` and `/var/log/dspm-preflight.json` files a regular install writes, except under `--dry-run`, where the installer doesn't write the JSON report. + +| Code | Meaning | +|---|---| +| 0 | Every check passed, or the installer raised only warnings and you passed `--accept-warnings`. | +| 80 | A check failed, or the installer raised warnings and you didn't pass `--accept-warnings`. | +| 1 | You combined `--preflight` with `--uninstall` or `--skip-preflight`, or the checks themselves couldn't run. | + ## RHEL and CentOS Preparation Complete these steps on a Red Hat Enterprise Linux (RHEL) or CentOS server before you run the installer. diff --git a/docs/accessanalyzer/26.1/install/run-the-installer.md b/docs/accessanalyzer/26.1/install/run-the-installer.md index 5c9b9bcccf..78251f22fe 100644 --- a/docs/accessanalyzer/26.1/install/run-the-installer.md +++ b/docs/accessanalyzer/26.1/install/run-the-installer.md @@ -48,6 +48,10 @@ Keep the `channel=stable` parameter. Without it, the registry returns the newest The installer expects the certificate at `/etc/dspm/tls.crt` and the private key at `/etc/dspm/tls.key`. If you keep them somewhere else, enter the paths when the installer prompts for them, or pass them with `--tls-cert` and `--tls-key`. +:::tip +Supplying your own certificate isn't the only option. `--generate-self-signed-cert` has the installer generate one for you, so you can skip this section. Or hand issuance and renewal to a certificate authority instead: see [Automatic TLS Certificates](automatic-tls-certificates.md) for Let's Encrypt or another Automatic Certificate Management Environment (ACME) certificate authority, and [AD CS TLS Certificates](adcs-tls-certificates.md) for an on-premises Active Directory Certificate Services (AD CS) CA. +::: + 1. Create the directory. ```bash From 7e2f0ed8a8b7e01f1e2ee1d62fa87bebe13dc0fd Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 23:27:59 +0000 Subject: [PATCH 13/15] fix(vale): auto-fix style issues (Vale + Dale) --- docs/accessanalyzer/26.1/install/adcs-tls-certificates.md | 4 ++-- .../26.1/install/automatic-tls-certificates.md | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/accessanalyzer/26.1/install/adcs-tls-certificates.md b/docs/accessanalyzer/26.1/install/adcs-tls-certificates.md index e01dbc0840..2ae22aa569 100644 --- a/docs/accessanalyzer/26.1/install/adcs-tls-certificates.md +++ b/docs/accessanalyzer/26.1/install/adcs-tls-certificates.md @@ -4,7 +4,7 @@ description: Let Access Analyzer obtain and renew its TLS certificate automatica sidebar_position: 4.6 --- -The `adcs` mode hands certificate issuance and renewal to your own Active Directory Certificate Services (AD CS) enterprise certificate authority (CA), instead of a manual certificate you rotate by hand or a public CA like Let's Encrypt. See [Automatic TLS Certificates](automatic-tls-certificates.md) for the full list of automatic modes and how they compare. +The `adcs` mode hands certificate issuance and renewal to your own Active Directory Certificate Services (AD CS) enterprise certificate authority (CA), instead of a certificate you rotate by hand or one from a public CA like Let's Encrypt. See [Automatic TLS Certificates](automatic-tls-certificates.md) for the full list of automatic modes and how they compare. cert-manager submits enrollment requests to your AD CS server's `/certsrv` web enrollment endpoint using NT LAN Manager (NTLM) authentication. The certificate AD CS issues lands at the same location Access Analyzer already reads its TLS certificate from, and cert-manager renews it before it expires — no maintenance window, no `update-cert` runs. @@ -58,7 +58,7 @@ sudo -E dspm-installer \ - Setting the password through the environment variable instead of `--adcs-password` keeps it out of shell history and process listings. - `--generate-self-signed-cert` provides the bootstrap certificate. -The install proceeds exactly as described in [Install Access Analyzer](run-the-installer.md). When the services are up, the cluster requests the certificate from your AD CS server; issuance typically completes within a minute or two. Browsers connecting during that window see the self-signed bootstrap certificate and show a trust warning — the warning stops when the AD CS certificate is in place. +The install proceeds exactly as [Install Access Analyzer](run-the-installer.md) describes. When the services are up, the cluster requests the certificate from your AD CS server; issuance typically completes within a minute or two. Browsers connecting during that window see the self-signed bootstrap certificate and show a trust warning — the warning stops when the AD CS certificate is in place. :::note The installer doesn't save the issuance mode to `/etc/dspm/installer.yaml`. Every installer run uses exactly the `--cert-manager-issuer-mode` you pass it; omitting the flag means manual certificates. Upgrading never changes the mode. diff --git a/docs/accessanalyzer/26.1/install/automatic-tls-certificates.md b/docs/accessanalyzer/26.1/install/automatic-tls-certificates.md index 89614805ea..c736479fbe 100644 --- a/docs/accessanalyzer/26.1/install/automatic-tls-certificates.md +++ b/docs/accessanalyzer/26.1/install/automatic-tls-certificates.md @@ -22,7 +22,7 @@ This page covers the `acme` mode. For `adcs`, see [AD CS TLS Certificates](adcs- The nonprofit Internet Security Research Group operates [Let's Encrypt](https://letsencrypt.org), a free, publicly trusted certificate authority (CA). There are no fees and no account to create ahead of time — you only provide an email address for expiry and incident notices. All mainstream browsers and operating systems trust its certificates, so users see no certificate warnings. -Let's Encrypt issues certificates over ACME (Automatic Certificate Management Environment), an open protocol in which the certificate authority verifies that you control the domain before issuing. Access Analyzer uses the HTTP-01 challenge: the certificate authority connects to `http:///.well-known/acme-challenge/` on port 80 and checks for a response only your server could produce. The cluster answers this challenge automatically — you never handle the token. +Let's Encrypt issues certificates over Automatic Certificate Management Environment (ACME), an open protocol in which the certificate authority verifies that you control the domain before issuing. Access Analyzer uses the HTTP-01 challenge: the certificate authority connects to `http:///.well-known/acme-challenge/` on port 80 and checks for a response only your server could produce. The cluster answers this challenge automatically — you never handle the token. Certificates are valid for 90 days and Access Analyzer renews them automatically 30 days before expiry, using the same challenge. As long as your DNS record and firewall rules stay in place, no one has to update the certificate again. @@ -63,7 +63,7 @@ sudo -E dspm-installer \ Each flag also has an environment variable (`CERT_MANAGER_ISSUER_MODE`, `ACME_EMAIL`, `ACME_SERVER`), listed in the [Installer reference](installer-reference.md). -The install proceeds exactly as described in [Install Access Analyzer](run-the-installer.md). When the services are up, the cluster requests the certificate from Let's Encrypt; issuance typically completes within a minute or two. Browsers connecting during that window see the self-signed bootstrap certificate and show a trust warning — the warning stops when the Let's Encrypt certificate is in place. +The install proceeds exactly as [Install Access Analyzer](run-the-installer.md) describes. When the services are up, the cluster requests the certificate from Let's Encrypt; issuance typically completes within a minute or two. Browsers connecting during that window see the self-signed bootstrap certificate and show a trust warning — the warning stops when the Let's Encrypt certificate is in place. :::note The installer doesn't save the issuance mode to `/etc/dspm/installer.yaml`. Every installer run uses exactly the `--cert-manager-issuer-mode` you pass it; omitting the flag means manual certificates. Upgrading never changes the mode. @@ -78,7 +78,7 @@ openssl s_client -connect :443 -servername /de | openssl x509 -noout -subject -issuer -dates ``` -The issuer should name Let's Encrypt (for example `issuer=C=US, O=Let's Encrypt, CN=...`), and the dates should show a 90-day window. If the issuer is still your own hostname, the bootstrap certificate is still serving — see the next section. +The issuer should name Let's Encrypt (for example `issuer=C=US, O=Let's Encrypt, CN=...`), and the dates should show a 90-day window. If the issuer is still your own hostname, the bootstrap certificate is still serving — see [If the certificate stays pending](#if-the-certificate-stays-pending). ## If the certificate stays pending From aa94de39349361ee6098c5452002838c7b3a072b Mon Sep 17 00:00:00 2001 From: Ben Hayman Date: Thu, 17 Sep 2026 13:13:55 +0100 Subject: [PATCH 14/15] Recommended documentation changes --- .../addsource/exchangemailboxews.md | 4 +- .../addsource/exchangemailboxgraph.md | 6 +-- .../addsource/exchangeserverews.md | 8 ++- .../addsource/exchangeservergraph.md | 10 ++-- .../addsource/sharepointonline.md | 2 +- .../introduction/manage/exchangemailbox.md | 4 +- .../introduction/sourcegroups/exchangeews.md | 10 ++-- .../sourcegroups/exchangegraph.md | 8 +-- .../introduction/exchange/exchange.md | 49 ++++--------------- .../5.7/introduction/upgrade.md | 2 +- 10 files changed, 37 insertions(+), 66 deletions(-) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md index 471fe9b369..942383ef15 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md @@ -7,8 +7,8 @@ sidebar_position: 30 # Exchange Mailbox (EWS) Use the **Exchange Mailbox (EWS)** source to crawl and classify content stored in a -single Exchange mailbox on an on-premises Exchange server or in Exchange Online using the Exchange Web Services (EWS). -Due to the imminent deprecation of EWS for connecting to Exchange Online, Netwrix recommends using [Exchange Mailbox (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md) +single Exchange mailbox on an on-premises Exchange server or in Exchange Online, using Exchange Web Services (EWS). +Microsoft is deprecating EWS for Exchange Online and will fully disable it in April 2027. Netwrix recommends using [Exchange Mailbox (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md) for any new sources intended to crawl Exchange Online mailboxes. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md index aa49130146..48ff781056 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -6,7 +6,7 @@ sidebar_position: 35 # Exchange Mailbox (Graph) -Use the Exchange Mailbox (Graph) source to crawl and classify content stored in a single Exchange Online mailbox using the Microsoft Graph API. For on-premises Exchange mailboxes, use [Exchange Mailbox (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md) instead. +Use the **Exchange Mailbox (Graph)** source to crawl and classify content stored in a single Exchange Online mailbox using the Microsoft Graph API. For on-premises Exchange mailboxes, use [Exchange Mailbox (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md) instead. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. @@ -23,7 +23,7 @@ You must specify the following: | Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | -| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details of the permissions that need to be granted to the application. | ## Other configuration settings @@ -34,7 +34,7 @@ By default, only basic settings appear. To view advanced options, click the "wre | Option | Description | Comments | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Basic settings** | | | -| Cloud Environment | Select the Azure instance hosting the Exchange Online server. | | +| Cloud Environment | Select the Azure environment that hosts your Exchange Online tenant. | | | Mailbox | The mailbox to crawl. | E.g. _test@cs.com_. | | Crawl Range | Define the time period to crawl:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each object.
| | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md index 98bf06c52a..9dc7133467 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md @@ -7,7 +7,7 @@ sidebar_position: 40 # Exchange Server (EWS) Use the Exchange Server (EWS) source configuration screen to crawl and classify -multiple Exchange mailboxes from the same Exchange server, using the Exchange Web Services (EWS). Due to the imminent deprecation of EWS for connecting to Exchange Online, Netwrix recommends using Exchange Server (Graph) for any new sources intended to crawl Exchange Online. +multiple Exchange mailboxes from the same Exchange server, using the Exchange Web Services (EWS). "Microsoft is deprecating EWS for Exchange Online and will fully disable it in April 2027. Netwrix recommends using [Exchange Server (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md) for any new sources intended to crawl Exchange Online. :::note Automatic detection, crawling, and classification of multiple Exchange mailboxes from @@ -26,12 +26,10 @@ To configure an Exchange Server (EWS) source, follow these steps. **Step 2 –** Select the **Exchange Server (EWS)** source type and in the properties window specify the necessary settings. -**Step 3 –** To display all settings, click the "wrench" icon next to Settings in the bottom-left corner. +**Step 3 –** To display all settings, click the "wrench" icon next to **Settings** in the bottom-left corner. ## Authentication type: Modern authentication - - If you plan to use this authentication type, specify the following: | Option | Description | @@ -63,7 +61,7 @@ Both authentication types also require the following settings: | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Exchange API URL | By default, the crawling engine uses the _Exchange AutoDiscover_ functionality to locate the Exchange Web Services API URL, so you can typically leave this field blank. If _Exchange AutoDiscover_ isn't available, specify the Exchange API URL explicitly: `https:///EWS/Exchange.asmx`. | | Crawl Range | Define which portions of data to retrieve from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| -| Match Rules | Define which mailboxes to crawl as part of an Exchange Server source. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes | +| Match Rules | Define rules with regular expressions to limit which mailboxes the product crawls. You must define at least one match rule. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes | | Detection Period | Specify how often to check the source for changes. Default period is 1 day. | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md index 972120479a..d87fc3de1b 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md @@ -7,7 +7,7 @@ sidebar_position: 45 # Exchange Server (Graph) Use the Exchange Server (Graph) source configuration screen to crawl and classify -multiple Exchange mailboxes in the same tenant. The Graph source type connects only to Exchange Online. To crawl mailboxes on an on-premises Exchange server, use Exchange Server (EWS). +multiple Exchange mailboxes in the same tenant. The Graph source type connects only to Exchange Online. To crawl mailboxes on an on-premises Exchange server, use [Exchange Server (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md). You can use Match Rules to include or exclude specific mailboxes. @@ -19,7 +19,7 @@ To configure an Exchange Server (Graph) source, follow these steps. **Step 2 –** Select **Exchange Server (Graph)** source type and in the properties window specify the necessary settings. -**Step 3 –** To display all settings, click the "wrench" icon next to Settings in the bottom-left corner. +**Step 3 –** To display all settings, click the "wrench" icon next to **Settings** in the bottom-left corner. ## Authentication @@ -30,7 +30,7 @@ You must specify the following: | Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | -| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details of the permissions that need to be granted to the application. | ## Other configuration settings @@ -38,9 +38,9 @@ Specify the following settings: | Option | Description | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Cloud Environment | Select the Azure instance hosting the Exchange Online tenancy. | +| Cloud Environment | Select the Azure environment that hosts your Exchange Online tenant. | | Crawl Range | Define which portions of data to retrieve from Exchange Online:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| -| Match Rules | Define rules with wildcards to limit which mailboxes the product crawls. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes. You must define at least one match rule. | +| Match Rules | Define rules with regular expressions to limit which mailboxes the product crawls. You must define at least one match rule. Examples: 1. `.*@netwrix.com`— enter the wildcard (.*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes. | | Detection Period | Specify how often to check the source for changes. Default period is 1 day. | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md index 3748bef373..ad88fcc4c3 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md @@ -6,7 +6,7 @@ sidebar_position: 100 # SharePoint Online -If you are an Office 365 customer, you can configure the collector service to automatically detect and queue your +If you're an Office 365 customer, you can configure the collector service to automatically detect and queue your employees' SharePoint Online sites hosted in Office 365. You must supply an account with Tenant administration rights and set how often the service detects new SharePoint Online sites. You can also provide a filter expression to include certain SharePoint Online paths and exclude others as diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md index 31f3bd2cce..d6d8e8f323 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md @@ -6,7 +6,7 @@ sidebar_position: 40 # Exchange -For the various Exchange sources, you can configure the list of folders/emails to exclude from +For the Exchange sources, you can configure the list of folders/emails to exclude from processing. Do the following: 1. In the management console, click **Sources** →**Exchange Mailbox (EWS)** or **Exchange Mailbox (Graph)**. The Collection Exclusion page @@ -20,7 +20,7 @@ processing. Do the following: any folders with that specific name. :::note - Adding an exclusion of this type will match any folders with the name you provide, wherever they are within any mailbox. + Adding an exclusion of this type will match any folders with the name you provide in all configured sources. ::: - When you wrap the exclusion in wildcard indicators (e.g. “\*Deleted\*”), the system will match any folder/email diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md index 86c028fc8e..44f1b57876 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md @@ -6,15 +6,15 @@ sidebar_position: 10 # Dynamic Source Groups — Exchange (EWS) -This section contains information on how to configure Exchange and Exchange Online dynamic source -groups. Toggle between Basic and Advanced configuration settings by clicking the icons in the -Settings button in the bottom left corner of the page. - :::warning Microsoft is deprecating Exchange Web Services (EWS) and will fully disable it in April 2027. -For all new Exchange Online dynamic source groups, you should use the Exchange (Graph) dynamic source group. +For all new Exchange Online dynamic source groups, Netwrix recommends using the [Exchange (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md) dynamic source group. ::: +This section contains information on how to configure Exchange and Exchange Online dynamic source +groups. Toggle between Basic and Advanced configuration settings by clicking the icons in the +Settings button in the bottom left corner of the page. + You can configure the following options for Exchange (EWS) Dynamic Source Groups: | Option | Description | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md index 9acf21a9f0..6aa5d6a1e8 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md @@ -10,13 +10,15 @@ This section contains information on how to configure Exchange Online dynamic so groups. Toggle between Basic and Advanced configuration settings by clicking the icons in the Settings button in the bottom left corner of the page. +Use Exchange (Graph) dynamic source groups for all new Exchange Online source groups. To crawl on-premises Exchange servers, use Dynamic Source Groups — Exchange (EWS). + You can configure the following options for Exchange (Graph) Dynamic Source Groups: | Option | Description | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Cloud Environment | Select the Azure Cloud Environment hosting the Exchange tenancy you want to crawl. | +| Cloud Environment | Select the Azure environment that hosts your Exchange Online tenant. | | Crawl Range | Configure whether to crawl data over a date range or from a specific date onwards. | | Match Rules | You must include at least one match rule. Match rules are regular expressions, such as:
  • `.*@mydomain.com`
  • `.*@mydomain.co.uk`
| | Crawl In-Place Archive | Check the box to enable crawling the Exchange In-Place Archive for data. Uncheck the box to disable this option. | -| Detection Period | The Detection Period you set here applies to all Exchange and Exchange Online source groups configured under the URL you enter in the URL text field. Use the slider to change the Detection Period. To disable detection, set the period to **0** days and **0** hours. | -| Re-Index Period | The Re-Index Period you set here applies to all Exchange and Exchange Online source groups configured under the URL you enter in the URL text field. Use the slider to change the Re-Index Period. To disable re-indexing, set the period to **0**. | +| Detection Period | The Detection Period you set here applies to all Exchange Online Mailbox sources created by this dynamic source group. Use the slider to change the Detection Period. To disable detection, set the period to **0** days and **0** hours. | +| Re-Index Period | The Re-Index Period you set here applies to all Exchange Online Mailbox sources created by this dynamic source group. Use the slider to change the Re-Index Period. To disable re-indexing, set the period to **0**. | diff --git a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md index be07e5b03a..ffecad8b61 100644 --- a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md +++ b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md @@ -23,33 +23,7 @@ permissions: - Mailbox Search—Allows the crawling account to enumerate mailboxes (automatic discovery of mailboxes) - -### Exchange Online - -**Step 1 –** Log in to the -[Office 365 Exchange Admin Portal](https://admin.microsoft.com/Adminportal/Home?source=applauncher#office-365-exchange-admin-portal)[.](https://admin.microsoft.com/Adminportal/Home?source=applauncher#) - -**Step 2 –** Go to Roles > **Role Assignments** > **Exchange**. - -**Step 3 –** Select **Add new role**. - -**Step 4 –** In the Set up basics step, enter the Name and Description -'_NetwrixCrawlerImpersonation_'. Click **Next**. - -**Step 5 –** On the **Add Permission** step, select the Microsoft.Graph Mail.Read, Mail.ReadWrite, and User.Read.All -permissions. Click **Next**. - -**Step 6 –** Select the users to assign to this role group. They will have permissions to manage the -roles that you assigned in the previous step. - -**Step 7 –** Finish adding the permissions by selecting \_**\_Add role group\_\_**. - -**Step 8 –** Go to the **DiscoveryManagement** Role. - -**Step 9 –** Add your user as a member and/or assign your user for Modern Authentication set up to -this Role as well. - -## Exchange Server (On-Premise) +### Exchange Server (On-Premise) 1. Log in to one of the Exchange servers (RDP). 2. Open a Powershell window. @@ -61,12 +35,6 @@ this Role as well. New-ManagementRoleAssignment –Name "NetwrixCrawlerSearch" –Role "Mailbox Search" –User ADMINUSERNAME -:::note -If you crawl Microsoft Office 365 for Small Business or many hosted Exchange systems, you can't -set up Application Impersonation. -::: - - ## Modern Authentication Starting with version 5.5.3, Netwrix Data Classification can crawl Microsoft Exchange @@ -78,15 +46,15 @@ To access Exchange using Modern Authentication, you need to use an admin usernam ::: Configure sufficient permissions that allow the crawling account to access and read the -mailboxes that you want to crawl. The permissions required differ between the Exchange Web Services (EWS) and Graph implementations. +mailboxes that you want to crawl. The permissions required depend on whether you are using the Exchange Web Services (EWS) or Graph source types. -To use the Graph implementation, you must grant the following permissions: +To use the Graph source types, you must grant the following permissions: -- Mail.Read-Allows the application to read the full contents of all mailboxes +- Mail.Read—Allows the application to read the full contents of all mailboxes - Mail.ReadWrite—Allows the application to move and delete mail in all mailboxes - necessary for the Exchange workflow actions - User.Read.All—Allows the application to discover all users associated with an Exchange Online server -To use the EWS implementation, you must grant the following permissions: +To use the EWS source types, you must grant the following permissions: - ApplicationImpersonation—Allows the crawling account to impersonate each of the mailboxes / users configured for collection @@ -96,5 +64,8 @@ To use the EWS implementation, you must grant the following permissions: If you plan to use modern authentication, do the following: 1. [Create Azure AD app for Modern Authentication](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md) -2. Configure [Exchange Server (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md) - or [Exchange Server (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md) source settings. +2. Configure source settings for one or more of the following: + - [Exchange Server (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md) + - [Exchange Server (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md) + - [Exchange Mailbox (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md) + - [Exchange Mailbox (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md) diff --git a/docs/dataclassification/5.7/introduction/upgrade.md b/docs/dataclassification/5.7/introduction/upgrade.md index 979f1790b3..d204aea093 100644 --- a/docs/dataclassification/5.7/introduction/upgrade.md +++ b/docs/dataclassification/5.7/introduction/upgrade.md @@ -35,7 +35,7 @@ If any services are running while the upgrade occurs, database schema updates ma ::: **Step 4 –** Back up the Index files. Locate the folder containing the index files (the default location is _C:\Program - Files\Netwrix\Data Classification\Index_) and back it up. +Files\Netwrix\Data Classification\Index_) and back it up. :::note For versions of 5.7 before 5.7.10, all NDC services and the NDC IIS Application Pool had to run as the same service account. For 5.7.10 onwards this is no longer necessary, but if you upgrade from an earlier version of 5.7, complete the upgrade to 5.7.10 _before_ changing the service account to avoid upgrade issues. From f48acb49f31476f390a775af34abffd3da62a649 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Thu, 17 Sep 2026 12:36:51 +0000 Subject: [PATCH 15/15] fix(vale): auto-fix style issues (Vale + Dale) --- .../introduction/addsource/addsource.md | 2 +- .../introduction/addsource/exchangemailboxgraph.md | 2 +- .../introduction/addsource/exchangeservergraph.md | 2 +- .../introduction/sourcegroups/exchangeews.md | 2 +- .../introduction/sourcegroups/exchangegraph.md | 2 +- .../introduction/sourcegroups/overview.md | 6 +++--- .../5.7/introduction/introduction/exchange/exchange.md | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md index 43e14cbfe1..4e9362eeb2 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md @@ -33,7 +33,7 @@ the sources: The **Sources** section lists all your content sources. :::note -When adding a source or managing source configuration, the console displays the most commonly used +When you add a source or manage source configuration, the console displays the most commonly used source settings by default. However, some source types have additional configuration options that appear when you click the Advanced Settings ("wrench" icon). You can set the Advanced Settings to display by default in User Preferences, which you open by clicking the username. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md index 48ff781056..4c1682bc71 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -23,7 +23,7 @@ You must specify the following: | Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | -| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details of the permissions that need to be granted to the application. | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details of the permissions to grant to the application. | ## Other configuration settings diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md index d87fc3de1b..09c68c4203 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md @@ -30,7 +30,7 @@ You must specify the following: | Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | -| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details of the permissions that need to be granted to the application. | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details of the permissions to grant to the application. | ## Other configuration settings diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md index 44f1b57876..b2d2d0d312 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md @@ -11,7 +11,7 @@ Microsoft is deprecating Exchange Web Services (EWS) and will fully disable it i For all new Exchange Online dynamic source groups, Netwrix recommends using the [Exchange (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md) dynamic source group. ::: -This section contains information on how to configure Exchange and Exchange Online dynamic source +This section describes how to configure Exchange and Exchange Online dynamic source groups. Toggle between Basic and Advanced configuration settings by clicking the icons in the Settings button in the bottom left corner of the page. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md index 6aa5d6a1e8..ea65762505 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md @@ -6,7 +6,7 @@ sidebar_position: 15 # Dynamic Source Groups — Exchange (Graph) -This section contains information on how to configure Exchange Online dynamic source +This section describes how to configure Exchange Online dynamic source groups. Toggle between Basic and Advanced configuration settings by clicking the icons in the Settings button in the bottom left corner of the page. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md index e01ad1ca24..b2337e2ec9 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md @@ -16,8 +16,8 @@ groups that support that source type appear in a dropdown in the source configur Netwrix Data Classification treats certain source types as source groups. See [Dynamic Source Groups](#dynamic-source-groups) for the available group types and configuration options. -Select the cog icon on the main sources grid screen for a source group to amend the -group settings: +To amend the group settings, select the cog icon for that source group on the main sources grid +screen: ![editgroup](/images/dataclassification/5.7/admin/sources/sourcegroups/editgroup.webp) @@ -46,7 +46,7 @@ remove specific sources from a group by selecting the source group in the grid a selecting Remove from Group for the required sources. You can create and assign source groups as part of the source creation process. -By going to the Settings of the Source Group, you can: +In the Source Group settings, you can: - Set the Re-index period, priority, and credentials for a single source in the group or configure these options for all sources in this group using the "Apply changes to all sources in Source diff --git a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md index ffecad8b61..40a0fba79b 100644 --- a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md +++ b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md @@ -46,7 +46,7 @@ To access Exchange using Modern Authentication, you need to use an admin usernam ::: Configure sufficient permissions that allow the crawling account to access and read the -mailboxes that you want to crawl. The permissions required depend on whether you are using the Exchange Web Services (EWS) or Graph source types. +mailboxes that you want to crawl. The permissions required depend on whether you use the Exchange Web Services (EWS) or Graph source types. To use the Graph source types, you must grant the following permissions: