Advanced Settings - Microsoft 365 Adapter
The following settings can be used to further customize the behavior of eperi sEcure Platform in the Admin Console. For general instructions and adapter-independent settings, see Advanced Settings.
| Setting | Explanation | Possible values | Default value |
|---|---|---|---|
| Add custom query parameters to the Collabora URL for additional configuration | With this setting you can force a specific language and pass additional configuration parameters to Collabora. | A string of one or more URI query components (syntax: parameterName=value) with an ampersand (&) appended to each query component | lang=LANG& (where LANG is a placeholder for browser locale, e.g., de-DE, en-GB, etc.) |
| Add Symbol to Encrypted Files | With this setting you may enable or disable the indicator for the protected files in SharePoint and OneDrive when using the web version. | Switch on = Indicator is enabled. Switch off = Indicator is disabled. |
Switch off |
| Allow technical user as editor if no access token available in Teams | If a token for the logged-in user is available, it will be used. Otherwise, when set to true, a token issued to the technical user is used to edit documents. If set to false, it is only used for viewing documents. | Switch on = Documents can be edited using the technical user's token.
Switch off = Documents can only be viewed. |
Switch on |
| Anonymous user is allowed to modify shared file | If set to true, anonymous users will be able to modify shared files. | Switch on = Modifying files is allowed
for anonymous users. Switch off = Modifying files is not allowed for anonymous users. |
Switch on |
| BGI Attachment Size Limit (KB) | Configure the maximum attachment size for Background Indexing (BGI). Attachments larger than the configured value will not be indexed. | Size of attachment in kilobytes (KB) | 25000 |
| BGI Attribute for filtering entity Ids | Configure an AAD attribute (property) which will be used for matching against a possible Entity ID value as BGI filter, if it is neither a UPN or a User Object ID. If one of the attributes mail, userPrincipalName or onPremisesUserPrincipalName is configured here, only the domain part will be matched to the configured Entity ID value. | Property name of an AAD User Object as returned by the Graph API. For a list of available properties, please refer to user resource type - Properties. | onPremisesDomainName |
| BGI filter entity Ids, if attribute is null | Configure whether a user's data should be indexed when BGI is filtering based on an AAD attribute and the value for the configured attribute is null for the user. | Switch on = If the attribute's value is null, the user's data will not be indexed.
Switch off = The user's data will be indexed even if the attribute's value is null. |
Switch on |
| BGI finished jobs are removed from database after configured # of hours | Configure the amount of time in hours after which the finished BGI Tasks are removed automatically from database, either during GW start or if a new BGI Job is started. | Time in hours. | 72 |
| BGI Graph API page size | Set the page size for the BGI Graph API. | Unsigned integer | 999 |
| BGI job state query interval (in seconds) | Set the query interval in seconds for getting the BGI job state. | Unsigned integer | 20 |
| BGI Object Chunk Size | Configure how many objects (emails, events) should be requested in one request to the Graph API. | Unsigned integer | 100 |
| BGI Retry Limit | Configure how many times a BGI task should be tried if it fails due to a Graph API error as for example a timeout. Graph API errors have a status code >= 500. | Unsigned integer | 5 |
| Cache path entries for ODSP resource Ids (in seconds) | Specify how long (in seconds) ODSP resource Ids should be cached. | Unsigned integer | 300 |
| Configured file types are not encrypted | Configure whether file types defined via the File types, which are (not) processed by encryption (comma-separated, e.g., one,onetoc2) setting should be exluded from or in scope of encryption. | Switch on = File types defined via
the File types, which are (not) processed by encryption (comma-separated, e.g., one,onetoc2) setting are excluded from encryption.
Switch off = File types defined via the File types, which are (not) processed by encryption (comma-separated, e.g., one,onetoc2) setting are in scope of encryption. |
Switch on |
| Create BGI tasks only for licensed users | Switch on: BGI tasks are created for licensed users and for users that can be selected using a configurable JSON path.
Switch off: BGI tasks are created for all users. |
Switch on | |
| Custom JsonPath to select BGI users from Graph API | Set a custom JsonPath for BGI users. | A valid JsonPath | None |
| Deactivate encryption for OneDrive only (cluster-wide) | If enabled, eperi sEcure Platform processing for OneDrive is deactivated cluster-wide, which means requests and responses are only forwarded (unless otherwise specified in connector properties). | Switch on = eperi sEcure Platform encryption for OneDrive is disabled.
Switch off = eperi sEcure Platform encryption for OneDrive is enabled. |
Switch off |
| Deactivate eperi sEcure Platform Encryption cluster-wide | If enabled, encryption for M365 is deactivated cluster-wide. This means requests and responses are only forwarded. If disabled, encryption for M365 remains active cluster-wide (unless otherwise specified in connector properties). | Switch on = eperi sEcure Platform encryption is disabled.
Switch off = eperi sEcure Platform encryption is enabled. |
Switch off |
| Deactivate O365 Disclaimer Page |
The disclaimer page for Office 365 is activated by default. You may deactivate it here. |
Switch on = Disclaimer page is deactivated.
Switch off = Disclaimer page is activated. |
Switch off |
| Disable EWS handlers | Disable one or more EWS request handlers by specifying their names as comma separated values. The name of the handler is equal to the Java class name and has to be requested from the vendor. | Comma separated values of EWS request handlers to be disabled, e.g.,
XchExportItemsResponseHandler |
<none> |
| Enable collaboration for unprotected Office documents in site subfolder | When this setting is activated, files located in the site subfolder for unprotected documents are available for collaboration. | Switch on = Collaboration subfolder for unprotected documents is enabled.
Switch off = Collaboration subfolder for unprotected documents is disabled. |
Switch on |
| Enable user context for accessing office documents via Office Online Server | Configure whether User Context should be used for OOS Document Editing. | Switch on = User context will be used.
Switch off = User context will not be used. |
Switch on |
| EWS export items encrypt | Change the behavior for EWS export requests. The default is to decrypt items on export. | Switch on = Items are encrypted on export.
Switch off = Items are decrypted on export. |
Switch off |
| EWS upload items encrypt | Change the behavior for EWS upload requests. The default is to encrypt items on upload. | Switch on = Items are encrypted on upload.
Switch off = Items are decrypted on upload. |
Switch on |
| Exchange Web Service connection pool size (default 27) | Sets the Exchange Web Service initial connection pool size. | Unsigned integer | 27 |
| Exchange Web Service timeout (in milliseconds) | Unsigned integer | 100000 | |
| Exchange Web Service timeout for checking out a connection from pool (in milliseconds) | Currently unused and slated for removal. | Unsigned integer | 5000 |
| Execute delta BGI after renaming files or uploading files from OneDrive client | Configure whether an automatic delta BGI should be executed after files have been uploaded or renamed using the OneDrive client. | Switch on = A delta BGI will be executed automatically.
Switch off = A delta BGI will not be executed automatically. |
Switch on |
| File types, which are (not) processed by encryption (comma-separated, e.g. one,onetoc2) | Configure file types based on their file extension to be excluded from or in scope of encryption. The behaviour depends on the Configured file types are not encrypted setting. | Comma separated list of file extensions without the leading dot, e.g., txt,jpg | Not configured |
| Force WebDAV compatibility mode for OneDrive client | This forces Office desktop apps to use the WebDAV protocol when accessing protected files that are synchronized via the OneDrive client. | Switch on = WebDAV compatibility is enabled
Switch off = WebDAV compatibility is not enabled |
Switch on |
| Forward requests, if not in internal domain | Emails sent via M365 accounts which reside in a tenant that is not protected by eperi sEcure Platform from a device with a global forward proxy set up can now be excluded from encryption. |
Switch On = Only emails from accounts that are part of the tenants specified as "Internal Domains" in the O365 Settings will be encrypted Switch Off = Also emails from accounts that are not part of the tenants specified as "Internal Domains" in the O365 Settings will be encrypted |
Switch on |
| Index Attachments For BGI | Configure whether BGI should try to index email or event attachments. By default, BGI does not index attachments. | Switch on = Try to index attachments
Switch off = Do not index attachments |
Switch off |
| Index File Content For BGI (relevant for OneDrive and SharePoint) | Configure whether BGI should index the content of files stored in OneDrive or SharePoint. By default, file content is indexed. | Switch on = Both content and metadata (such as file path) of files are indexed
Switch off = Only metadata of files is indexed |
Switch on |
| Index Folders For BGI (relevant for OneDrive and SharePoint) | Configure whether BGI should index folder names and paths. By default, folder names and paths are not indexed. | Switch on = Index folder names and paths
Switch off = Do not index folder names and paths |
Switch off |
| Language mappings | Transforms the language code set in the browser to one supported by Office Online Server (OOS). The setting can be configured to resolve issues with creating or editing Excel files when the browser language is not supported by OOS. | Comma-separated list of language mappings | nl=nl-NL |
| Maximum number of search results for Solr query | Configure how many search results should be retrieved with one Solr query. | Unsigned integer | 100 |
| Maximum number of threads used for generating thumbnails for large images | Specifies the upper limit for the number of threads that are available for generating thumbnails of large images. | Unsigned integer | 2 |
| Maximum number of threads used for generating thumbnails for medium sized images | Specifies the upper limit for the number of threads that are available for generating thumbnails of medium-size images. | Unsigned integer | 6 |
| OD/SP Web upload - cancel if file offset mismatch | When enabled, each part of a multi-part upload needed for large files will be verified. If any of the parts is not successfully uploaded, the multi-part upload is terminated. | Switch on = Web upload will be canceled in case of a file offset mismatch.
Switch off = Web upload won't be canceled in case of a file offset mismatch. |
Switch off |
| OD/SP Web upload chunk size threshold (in bytes) | Sets the upper limit for uploading whole files without splitting them into chunks when using OneDrive via a web browser, but not when using the OneDrive desktop client. This setting's default value is exactly 10 MB (expressed in bytes). | Unsigned integer | |
| OD/SP Web upload maximum size of chunk (in bytes) | Used for fine-tuning the maximum chunk size when uploading large files when using either web or desktop clients. SharePoint/OneDrive supports up to 250 MB per chunk. This setting's default value is exactly 249 MB (expressed in bytes). | Unsigned integer | 261095424 |
| OD/SP Web upload size of last chunk (in bytes) | This setting only pertains to files between 10 MB and 250 MB. Its default value is exactly 1 MB (expressed in bytes) and should only be changed in special situations. | Unsigned integer | 1048576 |
| OneDrive client - always consume InputStream | This setting is used for configuring OneDrive client policies. | Switch on = InputStream will be consumed
Switch off = InputStream won't be consumed |
Switch off |
| OneDrive client - duplicate detection window (seconds) | This setting is used for configuring OneDrive client policies. | Integer | 7200 |
| OneDrive client - max stream size in KB | OneDrive client sends huge file in multiple chunks to the server. You can configure the maximum chunk size that the OneDrive client will use (in KB). It is possible to tweak performance by configuring this value (in the range from 5120 KB to 102400 KB). This setting becomes effective when the OneDrive client requests a policy update, which can take some time. | Integer | 81920 |
| OneDrive client - metadata provider | This setting provides various options in case a file's metadata cannot be retrieved. |
1 = Forward, fallback to Graph API 2 = Forward (faster, but undocumented) 3 = Graph API 4 = Graph API, fallback to Forward |
1 |
| OneDrive client - policy BackoffOnErrorsIntervalSeconds end | This setting is used for configuring OneDrive client policies. | Integer | 0 |
| OneDrive client - policy BackoffOnErrorsIntervalSeconds start | This setting is used for configuring OneDrive client policies. | Integer | 0 |
| OneDrive client - policy ClientNotificationCoalesceSeconds | This setting is used for configuring OneDrive client policies. | Integer | 0 |
| OneDrive client - policy DeferredDownloadRetrySeconds | This setting is used for configuring OneDrive client policies. | Integer | 0 |
| OneDrive client - policy DownloadStreamingMaxStreamSizeKB | This setting is used for configuring OneDrive client policies. | Integer | 0 |
| OneDrive client - policy EnterpriseFeatureRetryIntervalSeconds end | This setting is used for configuring OneDrive client policies. | Integer | 0 |
| OneDrive client - policy EnterpriseFeatureRetryIntervalSeconds start | This setting is used for configuring OneDrive client policies. | Integer | 0 |
| OneDrive client - policy FullSyncMaxItemCount | This setting is used for configuring OneDrive client policies. | Integer | 0 |
| OneDrive client - remove intermediate hashes from upload session, if last part was uploaded | This setting is used for configuring OneDrive client policies. | Switch on = Intermediate hashes will be removed
Switch off = Intermediate hashes won't be removed |
Switch on |
| OneDrive client - throttle factor | This setting is used for configuring OneDrive client policies. | Integer | 3 |
| OneDrive client - if multiple parallel uploads in same BITS session (experimental) | This setting is used for configuring OneDrive client policies. | Integer | 0 |
| OWA user mapping mode | A mapping table inside eperi sEcure Platform was created to map an AnchorMailbox to its Email Address or alternatively its User Principal Name (UPN). Whether the email address or the UPN is to be used, can be configured using the below values, which is particularly important for email indexing. |
1 = Mapping of AnchorMailbox to User Principal Name (UPN) 2 = Mapping of AnchorMailbox to Email Address 3 = Mapping to logon email 4 = Mapping to logon email / find mailbox in path |
4 |
| Offer shared office document as download, if user id can not be determined | If enabled, force download is initiated if the user id is not known. | Switch on = Force download is initiated.
Switch off = Force download will not be initiated. |
Switch on |
| Open document as read-only in Office Online Server if checked out | If enabled, checked out documents are opened in viewer. | Switch on = Checked out documents are opened in viewer.
Switch off = Checked out documents are opened in editor. |
Switch on |
| Output quality for thumbnails (0.0-1.0) | This decimal value determines the quality of thumbnails with 0.0 being the lowest quality and 1.0 the highest quality. | Any unsigned value ranging from 0.0 to 1.0 | |
| Query metadata for files < 64K | When enabled, the metadata of files smaller than 64 KB is queried to determine their actual file size. Otherwise, it is assumed that these files are not encrypted and their file size is taken from the OneDrive/SharePoint server. | Switch on = Files smaller than 64 KB will be queried for their metadata.
Switch off = Metadata will not be queried for files smaller than 64 KB. |
Switch off |
| Replace thumbnails for corresponding SharePoint/OneDrive endpoint | When enabled, eperi sEcure Platform replaces thumbnails for SharePoint/OneDrive since images uploaded or dropped into Teams are stored im SharePoint or OneDrive. However, it cannot generate thumbnails for encrypted images. | Switch on = SharePoint/OneDrive thumbnails will be replaced.
Switch off = SharePoint/OneDrive thumbnails won't be replaced. |
Switch on |
| Rewrite file links | Configure whether links should point to the Reverse Proxy URL when sharing documents from SharePoint or OneDrive.
When this setting points to the Reverse Proxy URL, it is also applied for re-writing Share links in emails sent to external recipients via Postfix.
Note: In SharePoint, on a site with anonymous access allowed, a document can only be edited as an anonymous user, because there is no user ID in the FedAuth Cookie.
If non-anonymouos access is selected and no user ID can be found in the FedAuth cookie, the document is offered as download instead.When anonymous access is not allowed for a SharePoint Site, it may be necessary to enter login credentials twice.
|
0 = No rewriting takes place 2 = Links point to the Forward Proxy URL 3 = Links point to the Reverse Proxy URL 6 = Links point to the Forward Proxy URL - Office Documents are offered as downloads (instead of opening them in Office Online Server) 7 = Links point to the Reverse Proxy URL - Office Documents are offered as downloads (instead of opening them in Office Online Server) |
3 |
| Selection Encryption - care for URL encoded paths | To determine whether a path is protected, the URL-decoded forms of the paths are also used. For example, a folder named Shared%20Documents is also recognized as unprotected if its URL-decoded form (Shared Documents) is configured as an unprotected path. | Switch on = Try to fix any issues with URL-encoded paths for files to be encrypted.
Switch off = URL-encoded paths for files to be encrypted will not be checked for validity. |
Switch on |
| Selection Encryption paths are case-sensitive | Detecting an unprotected path is case-insensitive if this option is enabled. | Switch on = Paths of files to be encrypted are case-sensitive.
Switch off = Paths of files to be encrypted are not case-sensitive |
Switch off |
| Selection Encryption List entries are exclusive (true) or inclusive (false) | If a file path corresponds to one of the expressions configured under Selective Encryption, then the file is either not encrypted if the option is activated or encrypted if the option is not activated. | Switch on = List items will not be encrypted.
Switch off = List items will be encrypted. |
Switch on |
| SPOD: max-age for thumbnails | Maximum caching duration in seconds for thumbnails in Sharepoint or OneDrive that eperi sEcure Platform has generated via the endpoint. The default value is the equivalent of 7 days. | Unsigned integer | 604800 |
| SPOD - max cache size for metadata | This setting limits the number of entries to be cached. Used together with the SPOD - metadata cache retention time setting, metadata cache reliability can be improved to achieve better stability of OneDrive and SharePoint sychronization in large environments. | Unsigned integer | 500000 |
| SPOD - metadata cache retention time | This setting determines how long (in seconds) metadata will be cached. Used together with the SPOD - max cache size for metadata setting, metadata cache reliability can be improved to achieve better stability of OneDrive and SharePoint sychronization in large environments. | Unsigned integer | 3600 |
| SPOD: threshold for generating image thumbnails | For images uploaded/dropped into Teams that are larger than this threshold (in bytes), thumbnails will be generated. Otherwise, images will be sent to the Teams client in their unaltered, decrypted form. | Unsigned integer | 50000 |
| SPOD: threshold for replacing server generated thumbnails | For images uploaded/dropped into Teams that are larger than this threshold (in bytes), a placeholder image (No Preview available) will be shown. | Unsigned integer | 10598400 |
| Teams - Encrypt clips (requires ffmpeg to be installed) | Enable clip encryption by setting this value. FFmpeg installation is required for generating content that can be directly viewed in Teams. The generated content will be encrypted and stored on a configurable SharePoint site. FFmpeg must be installed on the same system(s) where eperi sEcure Platform is deployed. | Switch on = Encrypt video clips.
Switch off = Video clips will not be encrypted. |
Switch off |
| Teams - open unprotected documents in cloud apps | With this setting enabled, internal users are able to open unencrypted Office files that external users have uploaded. | Switch on = Internal users can open unencrypted Office files from external users.
Switch off = Internal users cannot open unencrypted Office files from external users. |
Switch on |
| Teams - Storage path for clips | SharePoint folder name for encrypted clips.
Note: After initial configuration, the folder name cannot be changed. |
Any valid SharePoint folder name | EPERI Microsoft Teams Video Clips |
| Teams - Storage site path for clips | The SharePoint site where video clips are stored.
The SharePoint site path should identify only the site itself (e.g., /sites/Marketing or /sites/Engineering) without any subfolders or document libraries.
This enables the API to directly access the associated SharePoint drive.
Only the primary drive of a SharePoint site is supported.
OneDrive sites are not currently supported.
Note: After initial configuration, the SharePoint site path cannot be changed.
|
Absolute path to the SharePoint site, not its URL | / (root site) |
| Teams - Path to the ffmpeg executable (default: /usr/bin/ffmpeg) | Location of the ffmpeg executable, which is usually /usr/bin/ffmpeg on Linux | Absolute path to the executable | /usr/bin/ffmpeg |
| Teams - Path to the ffprobe executable | Location of the ffprobe executable, which is usually /usr/bin/ffprobe in Linux. ffprobe is part of the FFmpeg installation. | Absolute path to the executable | /usr/bin/ffprobe |
| Teams - Local path for caching intermediate files (default: temp folder) | FFmpeg/ffprobe input/output folder | A valid path | Apache Tomcat's temp folder |
| Teams - Low bandwidth variant for mobile or limited network connections (in kbit/s) | FFmpeg will generate two MP4 videos, one of which having a lower bitrate. This setting is used to configure its bitrate. Low Bandwith video can be disabled by specifying a value <= 0 for this setting. The lower bandwidth videos have a height of around 480 pixels. | Unsigned integer | 600 |
| Teams - High bandwidth variant for standard playback (in kbit/s) | FFmpeg will generate two MP4 videos, one of which having a higher bitrate. This setting is used to configure its bitrate. | Unsigned integer | 1800 |
| Teams: buffer size which is used to detect image metadata | Unsigned integer | 262144 | |
| Teams: change filename extension to jpg (pasted images) | Images pasted into Teams have an internal filename and are typically of type .png. With this option, images will have their filename extension changed to .jpg. | Switch on = Filename extension will be changed to .jpg.
Switch off = Filename extension remains unchanged. |
Switch off |
| Teams: encrypt absence notification | If enabled, Teams "Out of office" messages will be encrypted. | Switch on = Encrypts absence notifications.
Switch off = Absence notifications are unencrypted. |
Switch off |
| Teams: intercept flightproxy host (reverse proxy) | Switch on = Flightproxy host is intercepted.
Switch off = Flightproxy host is not intercepted. |
Switch on | |
| Teams: threshold for downloading full size images internally | Images pasted into Teams are completely downloaded internally and either used for gateway-internal thumbnail generation or sent directly to the client if the total image size (in bytes) is below this threshold. | Unsigned integer | 10598400 |
| Teams: threshold for generating image thumbnails | Images smaller than this threshold (in bytes) are sent unaltered to the Teams client. For images size larger than this threshold, thumbnails are generated in eperi sEcure Platform and sent to the Teams client. | Unsigned integer | 50000 |
| Teams: use multi-level subdomains (reverse proxy) | Switch on = Will use multi-level subdomains.
Switch off = Won't use multi-level subdomains. |
Switch off | |
| Teams: use multi-level subdomains for phone calls (reverse proxy) | Switch on = Will use multi-level subdomains for phone calls.
Switch off = Won't use multi-level subdomains for phone calls. |
Switch on | |
| Threshold to identify images as large images | Threshold value (in bytes) above which eperi sEcure Platform will classify an image as a "large image". By default, fewer threads are used simultaneously to generate thumbnails for large images in order to save memory. To generate thumbnails, it is necessary for the original images to be completely loaded into memory. | Unsigned integer | 3145728 |
| Timeout for acquiring a free slot to generate a thumbnail in seconds | Only a limited number of thumbnails can be generated concurrently. Each batch of thumbnails is processed by a single thread. This setting determines how long (in seconds) the next thread will wait for an available slot to process the next batch. If a new slot cannot be allocated, an error message is sent to the client. | Unsigned integer | 8 |
| Tokenize file names | Configure whether file names should be tokenized. By default, file names are in clear text. | Switch on = File names are tokenized
Switch off = Do not tokenize file names |
Switch off |
| Tokenize name of plans in Planner | If enabled, a plan name will be tokenized, otherwise the plan name will remain unchanged. Plan names can be part of URLs, which would require the tokenized value in order to access such URLs. Therefore, this option is not activated by default. | Switch on = Plan names will be tokenized.
Switch off = Plan names won't be tokenized. |
Switch off |
| Use file metadata database table | If enabled, file metadata is written to the database.
When a file uploaded via the OneDrive client has no metadata appended to it, the metadata is queried from the database.
This should not be changed for legacy installations that may still depend on file metadata in the database.
Newer eperi sEcure Platform versions always append file metadata to an encrypted file in SharePoint/OneDrive.
Since querying the database can affect the performance of eperi sEcure Platform if the database connection is very slow, the setting can safely be turned off for newer eperi sEcure Platform versions (23.x or later).
Note:
For existing installations and upgrades to the current release, it is possible that the default setting for this switch might still be "on".
|
Switch on = File metadata is stored in the database.
If metadata is not appended to the file, it is queried from the database.
Switch off = The database is not used to store file metadata and is not queried if metadata is not appended to the file. |
Switch off |
| Use Graph API to query metadata from OneDrive desktop clients | If enabled, the Graph API is used to query metadata for files. Otherwise, the download.aspx Active Server Page is queried. | Switch on = Graph API will query metadata.
Switch off = Graph API will not be used to query metadata. |
Switch off |