Prerequisites

Complete the following prerequisites before installing HaloSHARE.

MPIP Protection

This section describes the prerequisites required to configure Microsoft Purview Information Protection.

Register an Application in Microsoft Entra ID

This section describes how to register an application in Microsoft Entra ID, obtain the Application (client) ID and Directory (tenant) ID, assign the required API permissions, and upload the certificate required for MPIP authentication.

Prerequisite: You must have sufficient administrative privileges to register an application in your Microsoft Entra ID tenant.

Create an Application

Follow these steps to register an application:

1. Log in to the Microsoft Entra admin center using an account that has administrator privileges.

2. If you have access to multiple tenants, click the Settings icon in the top menu. From Directories + subscriptions, select the tenant in which you want to register the application.

3. The application homepage opens.

   

   Selecting Microsoft Entra ID

4. In the left navigation pane, select Entra ID > App registrations.

5. On the App registrations page, click New registration or Register an Application. The Register an Application button appears only if no applications have already been created.

   

   New application registration

6. On the Register an application page, configure the following:

   

   Application details

   1. Name: Enter an appropriate name for the application.

   2. Supported account types: Select Single tenant only from the list. HaloSHARE GenNXT currently supports only single-tenant applications.

   3. Redirect URI: Select Web and enter a valid redirect URI. For example, https://localhost.

7. Click Register.

8. The Overview page of the newly registered application opens.

   

   Application ID and Tenant ID

9. Once registration is complete, the portal displays the following values. To copy and save the ID value in a text editor, hover your cursor over it and click the Copy to clipboard icon.

   1. Application ID – also known as Client ID.

   2. Directory ID – also known as Tenant ID.

Add Required Permissions 

To protect content with MIP SDK, you must provide the necessary API permissions to the application created in the previous section.

1. In the left navigation pane of the application, select API permissions.

2. Click Add a permission. The Request API permissions page appears.

3. Under the Select an API setting, select APIs my organization uses. A list appears containing the applications in your directory that expose APIs.

4. In the search box, type in the name of the permission indicated in the "Required Permissions" table below. Alternatively, you could scroll to find the API.

5. For example, type Microsoft Information Protection Sync Service into the search box. The following figure shows how the API is listed:

   

   API selection

6. Now, click on the displayed API. You can see two permission types on the page: Delegated permissions and Application permissions.

7. Click Application permissions and then, under the Permission section, select the checkbox near Read all unified policies of the tenant.

   

   Adding permission

8. Click Add permissions.

9. Repeat the steps above to add the other required permissions listed in the “Required permissions” table below.

10. The API permissions page opens, and the added permissions appear in the table with the status Not granted.

    

    Required API Permissions

11. Click Grant admin consent for your company. When prompted to confirm the consent request, click Yes.

12. After the admin consent is accepted, the status changes to Granted.

    

    API Permissions with admin consent

13. The following table lists the required permissions.

Required permissions #1

Additional Permission (Only for Relabeling)

The above permissions are sufficient to apply the MPIP label to a file. In addition, HaloSHARE requires the following superuser privilege to relabel a file if the service is not the owner of the file.

Required permissions #2

Upload the Certificate 

HaloSHARE uses certificate-based authentication, so you must enter your certificate information in the registered application.

Prerequisites: 

1. Certificate: 

   1. Ensure that you have a valid certificate containing the following key properties: -KeyExportPolicy Exportable and -KeySpec Signature.

   2. The certificate can also be self-signed. As a best practice, use a self-signed certificate only in a test environment.

2. Install the certificate:

   1. Ensure that this certificate is installed on the Windows Server machine where HaloSHARE is installed.

   2. The Certificate Store can be either Current User or Local Computer. 

   3. If it is a self-signed certificate, it should also be installed in the Trusted Root Certification Authorities store. 

   4. If the certificate is signed, the root CA and any intermediate CA (if applicable) should also be installed in the appropriate trusted store.

To upload the public key of the certificate, follow the steps below: 

1. In the sidebar of the new application page, select Certificate & secrets. 

2. Under the Certificate section, click Upload certificate. The Upload certificate dialog appears as shown in the figure below:

   

   Upload certificate #1

3. Click the folder icon to select the certificate, then click Open. For illustration purposes, the file DESKTOP001.cer is used.

4. Click Add. The certificate is uploaded, and its thumbprint appears on the page, as shown in the following figure:

   

   Upload certificate #2

5. You are now ready to install HaloSHARE.

Create and Configure the Sensitivity Labels

As an administrator, create, configure, and publish sensitivity labels based on your organization's classification taxonomy. Use label names that are familiar to your users. If your organization does not already have a classification taxonomy, consider using labels such as Public, General, Confidential, and Highly Confidential. For more information, refer to the Microsoft documentation on configuring sensitivity labels.

Enable TLS 1.2 for Microsoft Entra ID Authentication

To improve tenant security and comply with industry standards, Microsoft Entra ID stopped supporting the following Transport Layer Security (TLS) protocols and ciphers:

1. TLS 1.1

2. TLS 1.0

3. 3DES cipher suite (TLS_RSA_WITH_3DES_EDE_CBC_SHA)

To authenticate with Microsoft Entra ID, TLS 1.2 must be enabled on the client workstation. For instructions, refer to the Microsoft documentation on enabling TLS 1.2 in the following link: Microsoft article to enable TLS 1.2.

Complete the following steps:

1. Update the Windows Operating System

2. Update .NET Framework

3. Set the following registry settings:

Registry entries

Register an application in Autodesk Platform Services

This section describes how to register an application in Autodesk Platform Services (APS), obtain the Client ID and Client Secret, and configure the required API access.

Prerequisites:

Before you begin, ensure that the following requirements are met:

• Allow the required Autodesk subscription licensing URLs and protocols through the firewall or proxy server.

• If the computer connects to the internet via a firewall or proxy server, configure the proxy to allow unrestricted and anonymous access to the required domains.

• Allow access to the URL developer.api.autodesk.com over port 443 (HTTPS).
  The default ports used are 80 (HTTP) and 443 (HTTPS).

• Allow access to the required Certificate Authority (CA) endpoints (for example, http://digicert.com ) over port 80 for Certificate Revocation List (CRL) validation.

To complete the configuration, you need:

• An Autodesk Platform Services (APS) account.

• An APS Developer Hub.

If you do not have an APS account, complete Create an APS account. If you already have an account, continue with Set up a developer hub.

Create an APS Account

If you do not have an Autodesk account, create one as follows:

1. Go to the Autodesk Platform Services website.

2. Click Sign in in the upper-right corner.

3. Click Create account.

4. Follow the on-screen instructions to complete account setup.

Set up a Developer Hub

A developer hub is used to create and manage APS applications.

• If you are part of a team, your team might already have a developer hub. Ask your team administrator to add you, and then continue with Create an application.

• If your team has an Autodesk Platform Services plan but has not created a developer hub, see Create a developer hub.

Create a Developer Hub

Prerequisites

• An Autodesk account (created in the previous step)

• An Autodesk team with an APS subscription (Free tier or Paid)

Procedure

1. Log in to https://manage.autodesk.com using your Autodesk Account.

2. Click Products and Services, and then select the Hubs tab.

   

   Products and Services

3. Choose the Team where the APS offering is assigned.

4. From the Create hub list, select APS Developer Hub as the product.

5. Enter a hub name and, optionally, provide a description. (for example, RND Hub)

6. Click Create & Activate.

7. Refresh the page, and then click the hub name to open the developer portal.

   

   New hub

Create Application Credentials

To authenticate with APS APIs, you must create an application to obtain the client ID and client secret.

1. Click the APS Developer Hub created in the previous section.

2. On the Applications page, click Create application in the top right corner.

3. The Create Applications window opens.

4. Enter a name for the application (for example, HaloSHARE_App).

   

   Application name

5. The following application types are available. For HaloSHARE, select Server-to-Server App.

   • Traditional Web App – For applications that run on a server (for example, a web app with a backend server).

   • Desktop, Mobile, Single-Page App – For applications that run on a user’s device (for example, mobile apps, desktop apps, or browser-based apps).

   • Server-to-Server App – For server-side applications that do not require user authentication (for example, background services or daemons).

6. Click Create.

7. A confirmation message appears after the settings are successfully saved.

8. Copy the Client ID and Client Secret from the App Settings and use them when configuring HaloSHARE.

9. Under General Settings, enter the redirect URI in the JWKS URI. For local development, you can use https://localhost:8080

10. Under API Access, select the Data Management API from the list.

11. Click Save changes.

Provide access to Autodesk Forma

Some Autodesk products require you to provision access for your application using its Client ID before integration.

Prerequisite: Ensure that you have administrator access to a Forma hub.

1. Log in to your Autodesk Forma hub.

2. Navigate to Hub Admin.

3. Select the required project.

4. On the Hub Admin page, go to Custom Integrations.

5. Click Add Custom Integration.

6. In the Add custom integration dialog box, enter the following details:

   • Client ID

   • Custom integration name

   • Description

7. Click Next and complete the process.

Watermarking CAD files

Before configuring watermarking, ensure that the following prerequisites are met:

• Install a supported CAD application, such as Autodesk Revit or AutoCAD, on the server where HaloSHARE is installed. HaloSHARE installs the required watermarking components only when it detects a supported CAD application during installation.

• Ensure that the SharePoint folder is synchronized with the mapped local drive. Files configured as Always keep on this device (indicated by a green circle with a white check mark) are downloaded automatically and remain available locally.

• Ensure that the user who is running the service, or the specific group the user belongs to, is not assigned to the Deny log on as a service policy (Local Security Policy > Security Settings > Local Policies > User Rights Assignment). If the user exists, the error message “Error 1069: The service did not start due to a logon failure” appears while running HaloSHARE.

• Revit only: Install the RevitLookup tool to view custom properties (metadata) in Revit. After watermarking is applied, navigate to:

  RevitLookup > Dashboard > Schemas > HaloMetadataInfo > GetElements > GetEntity (Schema) > Get().

File Signing Task

When configuring a file signing task, you can select either the Local Computer or Current User certificate store. Each option has the following requirements:

• If you select Local Computer, the service running user must have access to the Local Computer certificates or to the specific certificate in the Local Computer store. If the service-running user is a local non-admin user, promote the service-running user to a local admin user or grant the service-running user access to the private key.

•  If you select Current User, the selected certificate must be installed in the certificate store of the service running user.

General

Before installing and running HaloSHARE, ensure that the following requirements are met:

• To install the service, you must have local administrator privileges.

• To run the service, you can use a user account with administrative privilege or non-administrative privilege.

• The user who initializes the service should have appropriate permissions on the source and destination folders. In addition, the user running the service should have access to that network location as an IP address. For example, \\10.0.0.138\foldername

Last updated: October 26, 2026