search cancel

Understanding the O365 Scan Details

book

Article ID: 225054

calendar_today

Updated On:

Products

CASB Security Advanced

Issue/Introduction

Why do I have failed files in the scan details of the o365 Securlet?

Environment

o365 Securlet

Resolution

The failed column represents:

  • Documents that were deleted or locked whe the scan took place.  (We will retry failed files).
  • Files that are > than 30 MB are not sent to DLP.
  • Files marked to be retried because of throttling,429 error.

The failed files column will fluctuate with a sudden increase of new files to be scanned or as files are deleted or modified.

Failed files are retried daily for 30 days. Files greater than 30 days will not be re-scanned.  If you find a large number of failed files reported that have not cleared up over time, create a support ticket asking for detail regarding these files such as the number of non-recoverable files or asking for a re-scan of failed files >30 days.

A re-scan may not touch these files as only exposed files will be re-scanned and only for 30 days for email.

 

 

 

Additional Information

A feature has been requested to break down failed files in greater detail.

Attachments