Connect Azure Blob Storage to DSPM

Overview

Netskope DSPM enables you to scan unstructured data within Azure Blob Storage data stores, supporting Discovery, Classification, and Automation to assess security risks associated with your unstructured data accurately. Follow the instructions below to configure and connect your Azure Blob Storage data store. 

Configure Azure Permissions

The following permissions are required within your custom Azure IAM role to enable scanning of Azure Blob Storage data stores.

"Microsoft.Storage/storageAccounts/blobServices/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Storage/storageAccounts/listkeys/action"
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"

Read more about enabling these permissions in Onboarding Azure Subscriptions and Tenants Manually.

Retrieve Connection Information

Netskope DSPM will require additional information to communicate with your Azure Blob Storage data store. Please follow the steps below to identify the connection values for later use within Netskope DSPM.

1. Log into Azure console.
2. From the left side navigation, click Storage accounts 
3. Click on the relevant Storge account name
4. Click Containers > Container name > Properties to obtain the URL highlighted in yellow below  
5. From the Storage account name on the left, click Access keys to obtain the Key value highlighted in blue below
6. Note the below values in each section

Highlight Color	Corresponding Netskope DSPM Value	Example
Yellow	Data Store Endpoint
Blue	Access Key

Connect Your Data Store

Step 1: Provide Credentials

Follow these steps to configure the connection:

1. Go to Data Stores > Data Store Inventory.

2. Click CONNECT A DATA STORE in the upper right.

   Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.

   

3. In the Connect a Data Store window, click the data store icon you wish to connect.

4. In the Provide Credentials section, complete the following fields:

Step 2: Scanning Infrastructure

1. Click Next.
2. When the Select Capabilities tab appears, complete the following fields:
   • Assign a Data Owner (Optional): Select one or more users responsible for this data store.
   • Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
   • Features: Select the features you want to enable.

Enabling Classification triggers file scanning based on your defined sampling rate. The following classification limits apply when using Advanced Scan. When Smart Scan is selected, file selection is automated by the clustering algorithm and these manual limits do not apply. For more details, see Data Store Smart Scan.

• Scan Limits: DSPM processes a maximum of 100,000 files per scan, regardless of the sampling rate. If you choose 100%, the system scans files in batches of 100,000 across subsequent scans until all files are covered. A maximum of 1,000,000 files will be scanned per data store.
• File Size Exclusions: The scanner skips files larger than 128 MB.
• Incremental Scanning: To optimize performance, DSPM only rescans files that have been modified since the last scan.
• File Type Filtering: You can optionally use a regular expression to restrict sampling to specific file types.

Step 3: Review and Save

1. Click Save.
   • When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
2. Click Save to finalize the connection.

Supported File Types for Unstructured Data Store Scanning

DSPM now supports all file types supported by the DLP appliance: