Forcepoint ONE SSE Deployment Guide Document Subtitle

Home
Configure applications
Forcepoint ONE SSE supports various cloud applications so that Admins can monitor data which is in transit, in motion and at rest.
Microsoft
Forcepoint ONE SSE supports the ability to control access to Microsoft 365 via SSO and API. Forcepoint ONE SSE also supports CSPM audit scanning for Azure.

Verify access and perform initial configuration
Describes about initial account configurations, such as creating and assigning administrator accounts and roles, and configuring portal access and timeout policies in Forcepoint ONE Security Service Edge.
Integrate identity
You can configure user identity settings and synchronize user information from your directory in order to assign policies to users or groups.
Configure common components
Describes how to configure common components such as login policies, various notifications, custom notification files and so on.
Setup traffic steering
Forcepoint ONE SSE supports SmartEdge Agent and Cloud SWG traffic steering methods. This chapter describes steps to deploy each of those so that traffic can be forwarded to Forcepoint ONE SSE.
Configure DLP
DLP is a data loss prevention capability that allows for pattern matching (via regular expressions and keywords) against data as it is either being downloaded, uploaded, or scanned via API at rest.
Configure Zero Trust Network Access
Forcepoint ONE SSE's Agentless and Agent-based Zero Trust Network Access (ZTNA) provides an alternative to VPNs allowing admins to provide inline protection to internal apps without the need for VPN service to be running on the user's local machine.
Protect cloud applications
This chapter describes how to setup various cloud applications in Forcepoint ONE SSE so that Admins can monitor the data at rest and data in motion.
Configure policies
Describes how to configure policies for your application in Forcepoint ONE SSE portal so that you can monitor the data at rest and data in motion.
Monitor and analyze traffic
You can perform steps to monitor and analyze the traffic. Forcepoint ONE SSE Log Export REST API allows customers to query and pull cloud and access Logs. Alternatively, customers with Splunk or QRadar can instead utilize the Forcepoint ONE SSE Splunk app or the Forcepoint ONE SSE QRadar App for easy integration with the Forcepoint ONE SSE REST API to extract Forcepoint ONE SSE logs.
Configure applications
Forcepoint ONE SSE supports various cloud applications so that Admins can monitor data which is in transit, in motion and at rest.
- Microsoft
  Forcepoint ONE SSE supports the ability to control access to Microsoft 365 via SSO and API. Forcepoint ONE SSE also supports CSPM audit scanning for Azure.
  - Microsoft 365: Deploying Forcepoint ONE SSE as a SAML IdP
    This section will guide you through configuring Forcepoint ONE SSE as a SAML Identity provider for Microsoft 365 single sign-on (SSO) authentication. This will ensure visibility and access control of Microsoft 365 via Forcepoint ONE SSE CASB.
  - Microsoft Entra IdP: Configuring Reverse Proxy for Microsoft 365
    Provides the setup instructions for configuring Microsoft 365 for use with Forcepoint ONE SSE when Microsoft 365 uses Microsoft Entra ID as the identity provider.
  - Creating Immutable ID for cloud only users
    For customers with users deployed on Microsoft 365 as cloud only, users (without any Active Directory instances installed) will need to manually create the Immutable ID for the users which is used as the Source Anchor that Microsoft uses to authenticate the user.
  - Microsoft 365: Configuring API scan
    This section will walk you through how to setup API access for Forcepoint ONE SSE to your OneDrive and Sharepoint environments. All the files at rest will then be analyzed against DLP Patterns and a report will be generated to identify any DLP violations in your corporate account.
  - Microsoft 365: Creating a device access rule
    These instructions will enable you to set a device access rule in Microsoft 365 that prohibits devices from connecting unless they are going through Forcepoint ONE SSE. This ensures complete compliance for users across all devices.
  - Microsoft 365: Configuring custom URLs
    Customers with dedicated instances of Microsoft 365 that use vanity URLs will need to map their custom URLs to the web app inside of Forcepoint ONE SSE to allow us to properly understand and proxy the URLs. This is accomplished on the Microsoft 365 application page.
  - Microsoft Entra ID: How to Provision Users
    New users cannot be created in a domain that has already been federated in Microsoft Entra ID. Instead new users must be created in a non-federated domain and then migrated over.
  - Azure: Configuring CSPM audit
    Forcepoint ONE SSE can scan Azure for configuration management to ensure your security settings and configurations are in compliance with frameworks such as CIS Benchmark.
  - Viewing unknown landing page
    In deployments that have policies configured with users connecting through the secure proxy on web browsers but connecting through direct app access for client apps, users will encounter a landing page when trying to open an unproxied link from inside of the client app (Outlook, IM, bookmark, etc).
  - Exchange: Creating a device access rule
    These instructions will enable you to set a device access rule in Exchange that prohibits devices from accessing the Exchange Server unless they are going through Forcepoint ONE SSE. This ensures complete compliance for users across all devices.
  - Sharepoint: Deploying Forcepoint ONE SSE as a SAML IdP
    These instructions will show how to setup Forcepoint ONE SSE for single sign-on (SSO) authentication with Sharepoint. This will guarantee that the use of Sharepoint passes through Forcepoint ONE SSE for visibility and access control.
  - ActiveSync: Migrating existing users to modern Auth
    Microsoft is deprecating basic Auth for ActiveSync and as such customers that have currently deployed Forcepoint ONE SSE mobile protection offering for Microsoft 365 will need to migrate their users over to modern Auth.
- Google Workspace
  Forcepoint ONE SSE supports the ability to control access to Google Workspace and Google Cloud Platform (GCP) via SSO and API. Forcepoint ONE SSE also supports CSPM audit scanning for GCP.
- Dropbox
  Forcepoint ONE SSE supports the ability to control access to Dropbox via SSO and API.
- Box
  Forcepoint ONE SSE supports the ability to control access to Box via SSO and API.
- AWS
  Forcepoint ONE SSE supports the ability to control access to AWS via SSO and API. Forcepoint ONE SSE also supports CSPM audit scanning.
- Slack
  Forcepoint ONE SSE supports the ability to control access to Slack via SSO and API.
- Salesforce
  Forcepoint ONE SSE supports the ability to control access to Salesforce via SSO and API.
- ServiceNow
  Forcepoint ONE SSE supports the ability to control access to ServiceNow via SSO and API. Also, Forcepoint ONE SSE supports SSPM scanning feature.
- Atlassian (Confluence and JIRA)
  Forcepoint ONE SSE supports the ability to control access to Atlassian via SSO and API.
- GitHub
  Forcepoint ONE SSE provides SSO and API integrations with GitHub in order to scan and surface sensitive data at rest.
- Egnyte: Configuring API access
  This guide page will walk you through how to setup Egnyte for API scanning with Forcepoint ONE SSE. It is important to note that Egnyte enforces API rate limits on all tenants which will not be suitable enough for Forcepoint ONE SSE API scanning.
- Configure Forcepoint Security Manager
  Forcepoint Security Manager (FSM) is an Any HTTP/S ZTNA App/Service application which can be used for adding multiple FSM ZTNA internal applications while onboarding a large customer.
- Cisco WebEx Teams (Formerly Spark): Configuring API access
  Forcepoint ONE SSE can provide visibility into data at rest inside of Cisco WebEx Teams (Spark) and quarantine sensitive files.
- Mobile Mail Cutoff (M365, Google, Exchange)
  Mobile Mail cutoff features enable you to enforce that all ActiveSync traffic goes through Forcepoint ONE SSE.

Microsoft

Forcepoint ONE SSE supports the ability to control access to Microsoft 365 via SSO and API. Forcepoint ONE SSE also supports CSPM audit scanning for Azure.

Microsoft 365: Deploying Forcepoint ONE SSE as a SAML IdP
This section will guide you through configuring Forcepoint ONE SSE as a SAML Identity provider for Microsoft 365 single sign-on (SSO) authentication. This will ensure visibility and access control of Microsoft 365 via Forcepoint ONE SSE CASB.
Microsoft Entra IdP: Configuring Reverse Proxy for Microsoft 365
Provides the setup instructions for configuring Microsoft 365 for use with Forcepoint ONE SSE when Microsoft 365 uses Microsoft Entra ID as the identity provider.
Creating Immutable ID for cloud only users
For customers with users deployed on Microsoft 365 as cloud only, users (without any Active Directory instances installed) will need to manually create the Immutable ID for the users which is used as the Source Anchor that Microsoft uses to authenticate the user.
Microsoft 365: Configuring API scan
This section will walk you through how to setup API access for Forcepoint ONE SSE to your OneDrive and Sharepoint environments. All the files at rest will then be analyzed against DLP Patterns and a report will be generated to identify any DLP violations in your corporate account.
Microsoft 365: Creating a device access rule
These instructions will enable you to set a device access rule in Microsoft 365 that prohibits devices from connecting unless they are going through Forcepoint ONE SSE. This ensures complete compliance for users across all devices.
Microsoft 365: Configuring custom URLs
Customers with dedicated instances of Microsoft 365 that use vanity URLs will need to map their custom URLs to the web app inside of Forcepoint ONE SSE to allow us to properly understand and proxy the URLs. This is accomplished on the Microsoft 365 application page.
Microsoft Entra ID: How to Provision Users
New users cannot be created in a domain that has already been federated in Microsoft Entra ID. Instead new users must be created in a non-federated domain and then migrated over.
Azure: Configuring CSPM audit
Forcepoint ONE SSE can scan Azure for configuration management to ensure your security settings and configurations are in compliance with frameworks such as CIS Benchmark.
Viewing unknown landing page
In deployments that have policies configured with users connecting through the secure proxy on web browsers but connecting through direct app access for client apps, users will encounter a landing page when trying to open an unproxied link from inside of the client app (Outlook, IM, bookmark, etc).
Exchange: Creating a device access rule
These instructions will enable you to set a device access rule in Exchange that prohibits devices from accessing the Exchange Server unless they are going through Forcepoint ONE SSE. This ensures complete compliance for users across all devices.
Sharepoint: Deploying Forcepoint ONE SSE as a SAML IdP
These instructions will show how to setup Forcepoint ONE SSE for single sign-on (SSO) authentication with Sharepoint. This will guarantee that the use of Sharepoint passes through Forcepoint ONE SSE for visibility and access control.
ActiveSync: Migrating existing users to modern Auth
Microsoft is deprecating basic Auth for ActiveSync and as such customers that have currently deployed Forcepoint ONE SSE mobile protection offering for Microsoft 365 will need to migrate their users over to modern Auth.

Copyright © 2024 Forcepoint LLC