Deauthorize and resume monitoring a cloud or email service
Who is this article for?
Incydr, yes.
CrashPlan for Enterprise, yes.
Code42 for Enterprise, yes.
CrashPlan for Small Business, no.
This article applies to Code42 cloud environments.
Overview
To help protect you from data loss, you can use Code42 to monitor files moving to and from users' cloud services, such as Google Drive or Microsoft OneDrive, or emailed as attachments through Gmail or Office 365.
This article explains how to deauthorize those data connections so that Code42 no longer has access to user data in those cloud or email services. You can also resume monitoring those data connections to resolve errors, reconfigure cloud service scoping, or restart the collection of file activity from data connections after a pause.
For information about disconnecting an automated integration, see Configure automated integrations.
Considerations
- You cannot deauthorize a cloud service (Google Drive, OneDrive, or Box, for example) or email service (such as Gmail or Office 365) while the status is Initializing. Wait for the service to indicate that it has a status of Monitoring or Error before attempting to deauthorize.
- If needed, you can use this process to reconfigure scoping for monitoring a cloud service's user or groups.
- Google Workspace administrators must have the Super Admin role in order to share file activity data with Code42 without errors. See Resolve "Data source is not sending security data" errors for more information.
- Cloud and email service connections are not available in the Code42 federal environment.
Deauthorize a cloud or email service
Deauthorize a service to stop monitoring for new event activity. Once deauthorized, you have 90 days to resume monitoring that service. After 90 days, Code42 removes the cloud or email service's configuration and authorization information (the events you have collected remain searchable in Forensic Search).
- Sign in to the Code42 console.
- Select Administration > Integrations > Data Connections.
- Locate the service to deauthorize in the table, then click View details
. - Click Deauthorize.
- When prompted, enter DEAUTHORIZE.
- Click Deauthorize.
At this point, Code42 stops collecting new file activity from the data connection. - If you do not plan to resume monitoring the service, remove Code42's access in the external console as well.
Remove Code42's access in Box
- Log in to your Box Admin Console using your Box Admin email and password.
- Select Apps from the Admin Console menu.
- Click the to the Custom Apps tab.
- Click the options button
to the right of the Code42 Cloud Services application and select the appropriate action from the menu.
- Select Disable app authorization to remove Code42's access to your Box service while retaining basic information about the connection.
Use this option when you want to temporarily stop Code42 from collecting file activity from Box but may want to resume monitoring in the future. When you want to resume monitoring, you can use the saved information to reconnect to Code42 without having to enter that setup information again. - Select Delete app authorization and users to completely remove the Code42 Cloud Services custom app from your Box environment. This selection may require assistance from Box.
This option deletes all information about the Code42 Cloud Service application. If you want to resume monitoring in the future, you'll need to recreate the app in Box and re-enter all of your setup information. See Allow Code42 access to Box for details.
- Select Disable app authorization to remove Code42's access to your Box service while retaining basic information about the connection.
Remove Code42's access in Google Drive or Gmail
Remove Code42's access in Microsoft OneDrive or Office 365 email
Resume monitoring a cloud or email service
You can resume monitoring a cloud or email service for up to 90 days after you deauthorized the initial connection. Code42 removes services that have been deactivated for over 90 days.
- Sign in to the Code42 console.
- Select Administration > Integrations > Data Connections.
- Locate the service to resume monitoring in the table, then click View details .
- Click Resume Monitoring.
You can resume monitoring only services with a status of Deauthorized. - Follow the prompts to authorize Code42 to monitor file events on that service.
Option to update administrator email address
If you are resuming monitoring of a Google Drive or Gmail environment, you can change the administrator's email address if needed. When doing so, you can change the username in the email address, but the domain used (such as "@example.com") must remain the same. This new email address must be associated with a Google Workspace administrator that has the Super Admin role.
Use cases
You can deauthorize and then resume monitoring a cloud service to update the scoping used or resolve errors. In most cases, errors caused by permissions or licensing issues within the cloud service can be resolved by deauthorizing the connection and then immediately resuming its monitoring.
Some use cases for using the deauthorization and resume monitoring processes for a cloud service are detailed below.
Reconfigure cloud service scoping for user or group monitoring
Resolve "Data source is not sending security data" errors
In certain situations, Code42 may be unable to access your Google Drive environment to monitor its file activity. When Code42 is unable to gather data from your Google Drive environment, the following message appears at the top of the Data Connections screen after the Google Drive connection is authorized: "Data connection <ConnectionName> is not sending security data."
To resolve this issue, try the following solutions in the order listed.
- Make sure that your Google Workspace administrator has the Super Admin role.
- If needed, update permissions in the Google Admin console to give your administrator the Super Admin role.
- After updating administrator permissions, deauthorize the Google Drive cloud service in the Code42 console.
- Resume monitoring the Google Drive cloud service again using the email address of the administrator with the Super Admin role.
The authorization process must be completed by someone who holds the Super Admin role in your Google Workspace. No other administrator levels are valid.
- Verify that the permissions (or scopes) required by the Code42 service account have been added to your Google Workspace correctly.
- Verify that Drive and Docs is turned on for everyone in your Google Workspace (or for everyone in the Google Workspace organizational unit that you want to monitor).
Code42 can only monitor file activity for the organizational units with Drive and Docs enabled. - Verify that third-party apps have access to Drive files. Code42 cannot monitor your Google Drive environment if this setting is disabled.
Resolve "Number of user drives exceeded" errors
Code42 can monitor a maximum number of drives in a cloud service, depending on vendor:
- Box: 500,000 drives
- Google Drive and OneDrive: 55,000 drives
If Code42 detects more than the maximum number of drives, the following error appears at the top of the Data Connections screen: "The number of supported user drives (<DriveMaximum>) for this connector has been exceeded. Deauthorize the connector and reauthorize with fewer than <DriveMaximum> drives."
If you receive this message:
- Deauthorize the cloud service connection.
- Resume monitoring the cloud service connection.
You are prompted to set up the cloud service connection again. - In the Add Users step of the reauthorization process, select the Specific Users or Specific Groups option and ensure that the total number of drives included is below the maximum limit.