Veritas Alta™ SaaS Protection Administrator's Guide
- Introduction to Veritas Alta™ SaaS Protection
- API permissions
- Administrator portal (Web UI)
- Manage users and roles
- What is a connector?
- What is a connector?
- Supported SaaS workloads and backup capabilities
- Workflow to protect data using Cohesity Alta SaaS Protection
- Know your subscription details
- About transient errors
- Overview of adding connectors
- Configure General settings
- Configure Capture scope
- Configure User filter
- Configure Group filter
- Configure Folder filter
- Configure credentials
- Configure Custom backup policy and guidelines
- Configure Delete policy for SharePoint Online and guidelines
- Configure Stubbing policy
- Guidelines to configure Stubbing policy for SharePoint Online
- Schedule a backup
- Configure email addresses to get notifications
- Review configuration and edit/save/initiate backup
- Connectors page
- Connector status
- Edit connector configuration
- Delete connectors
- Pre-requisites for Microsoft 365 connectors
- Protect Microsoft 365 Multi-Geo tenant
- Protect Exchange Online data
- Protect SharePoint sites and data
- Add SharePoint connectors
- Supported and unsupported SharePoint Settings and Types for backup and restore
- Supported Sites and List templates for backup and restore
- Supported SharePoint permission objects for backup and restore
- Configuring capture scope for SharePoint connectors
- End-user SharePoint data access in Cohesity Alta SaaS Protection
- Run Delete and Stubbing policies to the SharePoint Online environment
- Limitations of SharePoint connector
- Protect Teams sites
- Protect OneDrive data
- Protect Teams chats
- Protect GoogleDrive data
- Protect Gmail data
- Protect Audit logs
- Protect Salesforce data and metada
- Protect Entra ID objects
- Protect Box data
- Protect Slack data
- Protect Email/Message data
- Configure Retention policies
- Perform backups
- View and share backed-up data
- Analytics
- About analytics
- Gain insights into storage utilization
- Gain insights into storage utilization for Entra ID and Salesforce connectors
- Gain insights into blocked activities, most active users, and more
- Gain insights into data volume (size and item count) on legal hold
- Gain insights into data volume (size and item count) saved in different Enhanced cases
- Gain insights into data volume (size and count) under different policies
- Gain insights into data volume (size and item count) under different Tags
- Gain insights into data volume (size and item count) under different Tags behaviors
- Gain insights into storage savings after deduplication and compression
- Gain insights into data ingestion trends
- Perform restores using Administration portal
- About restore
- Prerequisites for restore
- Restore Exchange Online mailboxes
- Restore SharePoint/OneDrive/Teams Sites and data
- Restore Teams chat messages and Teams channel conversations
- Restore O365 audit logs
- Restore Box data
- Restore Google Drive data
- Restore Gmail data
- About Salesforce Data, Metadata, and CRM Content restore and Sandbox seeding
- Guidelines for Schema changes in Salesforce organization to prevent restore failures
- Restore Standard and Custom objects (Structured data restore)
- Custom Object restore - post processing steps
- Restore specific Records (Structured data) using Query filters
- Restore Salesforce CRM Content (Unstructured data restore)
- Restore Salesforce files/documents in Public/Shared libraries (Unstructured data restore)
- Limitations of Salesforce Data restore
- Salesforce Objects not supported for restore
- Key considerations for Salesforce Metadata restore
- Restore Salesforce Metadata
- Limitations of Salesforce Metadata backup and restore
- About Entra ID (Azure AD) objects and records restore
- Restore Slack data
- Restore data to File server
- Set default restore point
- Configure Restore all, Restore all versions, Point-in-time, and Specific range restore options
- Configure email addresses for notifications
- Downloading an item
- Restore dashboard
- Install services and utilities
- About services and utilities
- Pre-requisites to download and install services and utilities
- Downloading services and utilities
- Where to install the services and utilities
- Installing or upgrading services and utilities
- Configuring service accounts for services and utilities
- About the Apps Consent Grant Utility
- Discovery
- Configure Tagging polices
- Configure Tiering policy
- Auditing
- Manage Stors (Storages)
Architecture of Cohesity Alta SaaS Protection
The components in the Cohesity Alta SaaS Protection architecture are:
An Azure account established for Cohesity Alta SaaS Protection provides a dedicated single-tenant instance. This setup ensures the segregation of data and supports secure multi-region data storage while adhering to data residency requirements.
Each tenant incorporates a single Hub database that contains global configuration details.
Depending on requirements, a Hub may have one or multiple StorSites. While most tenants have a single StorSite, organizations with multiple office locations in different countries may have multiple StorSites aligned with Microsoft Azure regions to enhance scalability. Each StorSite includes at least one app service.
A target storage repository located within a StorSite. A StorSite may encompass one or multiple Stors, each featuring two dedicated Blob storages with tiering. The workloads of each tenant are allocated to one or more Stors as necessary. Blob storage supports data deduplication and encryption at rest, with the option for data redundancy through storage replication as preferred by customers.
Each tenant connects to a dedicated SQL database, complete with distinct settings for policies, storage redundancy, storage tier, encryption, and metadata.
Each Stor includes at least one App service, facilitating user access to the web UI. Cohesity Alta SaaS Protection offers two web UI alternatives: The Administration portal and the End-User portal.
The App service component manages access to a Cohesity Alta SaaS Protection tenant and runs various Web jobs to update statistics, track activity, and execute policies. Although the App service does not store data and does not require backup or replication, it is essential for user access and data operations.
Multiple App service instances can be deployed within a Cohesity Alta SaaS Protection tenant for scalability and high availability. In a geo-redundant configuration with a short recovery time objective (RTO), an App service can be provisioned in secondary regions to serve as a warm standby, supporting active storage accounts in that region.
Cohesity Alta SaaS Protection is integrated with Microsoft Entra ID. Cohesity Alta SaaS Protection supports multifactor authentication, Enterprise Single Sign-On (SSO), Access Control Lists, and granular role-based access control (RBAC).
Workflow for data back up and restore in Cohesity Alta SaaS Protection:
Backup data flow:
The required data is fetched by the Connector service installed on the Windows server from SaaS applications.
The Connector service establishes communication with the App service to acquire a token, enabling the App service to store data in the Blob Storage. Initially, data is written to the staging area, also referred to as 'Blob storage,' where the App service performs an integrity check before transferring it to the actual Stor.
The data is written to the Blob storage, and the App service performs deduplication before writing the data to the Blob storage.
The App service updates the database with essential metadata information.
The App service signals the preparation of indexes of the backed-up items within the Search Cluster.
Restore data flow:
The App service and the database connect to initiate a request for the necessary data.
The App service retrieves data from the Blob storage.
The data is transferred by the Export service to the target workload.
The Export service prepares a job and transfers the data into the SaaS applications according to the specified restore locations.
For additional information on managing Stors,
Cohesity Alta SaaS Protection is bundled with services and utilities as part of the solution. You can download these utilities and services from the Administration portal and configure on the Windows VM (on-premises or in the cloud).
The following services and utilities are available:
Connector service
Export service
Export utilities
Retrieval service
Slack administration utility
Apps consent grant utility