Discovery Scan inspects the content of all files in the tenant that are modified over the selected date range. As files in the selected tenant are scanned upon content change and context (sharing) change, Umbrella assesses the file. If Umbrella detects a violation, the offending file is listed in the Data Loss Prevention Report.
This topic walks you through how to initiate a scan and how to cancel an ongoing scan.

Note: A discovery scan must be triggered around 24 hours after tenant authorization as the system evaluates and enumerates the users in the organization. Any triggering beforehand might not include all users. The size limit for files to be scanned is 5MB.

Initiate a Discovery Scan

1. Navigate to Policies > Management > Data Loss Prevention Policy.
2. Click Discovery Scan.

2. Enter the Scan Details. Choose a platform and tenant of the platform from the drop-down lists.

3. Select the required Data Classification of your choice. You can select multiple tenants.

4. Enter the Date Range to define the scanning scope. Note that only files modified in the selected date range are scanned.

5. Click Scan to initiate.
6. Click Continue and Scan.

Note: Only one scan executes at a time. The scan might take a while. Once completed, you can initiate another scan.

7. Click Discovery Report to view the progress of the scan results.
   For more information on DLP reports, refer to DLP Report.

Cancel a Discovery Scan

1. Navigate to Reporting > Additional Reports > Data Loss Prevention.
2. Switch to the Discovery tab.

3. Click Cancel Scan. Results of the ongoing scan are displayed in the ribbon.
   Note that the cancelation of a scan might take a few minutes.

4. You can choose to either discard or keep the scan results and history. Click Cancel Scan.

Add a SaaS API Rule to the Data Loss Prevention Policy < Discovery Scan > Edit a Data Loss Prevention Rule