- Coming up, I will show you the controls in Microsoft 365
to help drive security
and compliance as your users work in Microsoft Teams.
As Nydia covered in our last Essential's episode,
there are of course specific security
and compliance-related controls to configure
the core experiences within Teams,
including meeting policies
and org-wide settings, such as guest access and more.
You can implement these in the Microsoft Teams admin center.
You can catch that episode at aka.ms/microsoftteamsforit.
Because Teams is part of Microsoft 365,
the best approach is to consider Microsoft Teams as another
endpoint in your security and compliance strategy.
This is because, as we've explained previously,
Microsoft Teams benefits from the security
and compliance foundation of SharePoint, OneDrive,
and Exchange, so if you're used to the controls
for these workloads, for the most part,
you just need to extend these to your Teams environment.
A good place to start is Secure Score,
found in the Microsoft 365 security center.
Under Improvement actions, you will find
a list of recommendations in order of importance
to improve the security of your environment.
Let me point out a few that are relevant to Teams.
First, we know that enabling multi-factor authentication
can reduce the risk of phishing attacks,
including impersonation, by around 99.9%.
With MFA, you can require a second form of authentication,
such as a phone call or a text message from your users,
before they get access to Teams.
Enabling multi-factor authentication
is done in Azure Active Directory.
You can create a custom policy
or use a baseline policy to do everything in one step.
When you enable this policy, all users will be required
to register for Azure Multi-Factor Authentication
within 14 days.
Once registered, users will be prompted
for MFA only during risky sign-in attempts.
This is an effective, but significant change for your users,
so make sure to communicate these before enabling it.
You can learn more about MFA at aka.ms/mfa.
Back in Secure Score,
another great recommendation is configuring Safe Links.
This can help you protect your users from impersonation
and phishing attacks from weaponized links.
This can be configured across Office 365 experiences
in the Office 365 Security & Compliance center,
under Threat Management policy.
Additionally, we have a capability called Safe attachments
which, like Safe Links, is part
of Office 365 Advanced Threat Protection.
You will need to proactively enable this for Teams.
Then, beyond threat protection, another capability
that you will see recommended by Secure Score
is data loss prevention or DLP.
This is central to how we approach information protection
across Microsoft 365 including
the classification of your data for compliance.
In the case of Teams, with DLP, you can scan chat messages
and channel conversations to block the sharing
of sensitive data, whereas files in Teams
are covered by DLP policies applied to SharePoint.
From Secure Score, again,
I get a direct link to enable DLP policies for Teams.
When creating a new policy, you can see that Microsoft 365
includes definitions for many common
sensitive information types across many different regions
that are ready for you to use, including financial,
medical and health, and privacy data.
You also have the ability to create a custom policy.
Let's create a policy for financial data
using the pre-built template for PCI data security standard,
which covers credit card numbers.
I will need a default name.
Here, you can choose all workloads or pick specific ones.
I will leave everything selected, including Teams.
You can also choose to include
or exclude certain user accounts or groups.
Under Policy Settings you can, for example,
allow the sharing of information within your organization,
but block attempts to share it externally
or block internally any sharing of sensitive information.
Next, you can configure DLP for instances when
a large volume of sensitive information is shared once.
For example, if someone shares
at least 10 credit card numbers in the same chat,
an incident report can be sent.
You can choose what to include in the report
and who should receive it.
Then, I can turn on DLP right away or test it first.
I will click Next, review my policy,
hit Create, and I'm done.
You can learn more about DLP at aka.ms/dlp.
So now, let's take a look
at the top compliance configurations.
The first step is to understand
the type of information that is in your environment.
The new data Classification tab
in the Microsoft 365 Compliance Center,
which will be available soon, takes you to an overview page
that shows you the volume of sensitive data
across your digital estate in Microsoft 365.
This can help you streamline the process of figuring out
the types of information protection rules
you need to apply with DLP.
Additionally, Microsoft Teams also honors sensitivity labels
created for Office files, OneDrive, and SharePoint.
To learn more about information classification
for these workloads visit aka.ms/infoclassification.
However, beyond proactively using DLP
and information classification to protect your data
and stay compliant, we also give you the ability
to reactively search for specific content
and understand when it was last accessed
and by whom, for regulatory and legal reasons.
Content search in the Microsoft 365 compliance center
helps you search for Microsoft Teams data.
Start by creating a new search.
I already created one.
As you can see here, you can scope the search based
on keywords and conditions, such as sender, date, and more.
Once you click Save & Run,
it will take a moment to return the results.
I already have done this in advance.
The search will find all content that meets the criteria.
If you need to, you can use additional capabilities,
like in-place hold, to prevent the tampering
of content important to a legal investigation.
From the Microsoft 365 compliance center,
you can set up eDiscovery capabilities.
You can do this in Core eDiscovery,
but I will show it in Advanced eDiscovery.
The first thing you will need to do is creating a case.
I already have one here.
You can apply eDiscovery to files, meetings, calls
and messages, including Skype for Business
interim chats, by searching.
You create your search criteria
in the same way that I showed you before.
I have my search already defined
for a confidential project, X1050,
and you can see here it has discovered all related content.
And I can place these on legal hold by walking through
the same steps for content search
that we discussed a moment ago, including selecting
specific locations, such as mailboxes and sites.
In private channels, messages are stored differently.
Records for messages sent in a private channel are delivered
to the mailbox of all private channel members
instead to a group mailbox.
And because each private channel
has its own SharePoint site collection
that's separate from the parent team site,
files in a private channel are managed independently
of the parent team in its separate site collection.
For eDiscovery of private channels,
you will need to include the user mailbox
and the SharePoint site of the private channel.
For more information about eDiscovery,
please go to aka.ms/m365ediscovery.
Of course, beyond keeping your data for legal reasons,
you also need to be able to set the right retention policies
to reduce your compliance risk.
Teams chats are persistent and retained forever by default.
You can create retention policies
in the Microsoft 365 compliance center.
Under Policies, select Retention.
Here, you can click New Retention Policy.
You can add a name and a description,
and as an admin, you can set up two types of policies;
preservation, which allow you to retain data
for a given period of time,
even if a user deletes the information
from Teams, and deletion.
This type of policy ensures that data
is not a liability for your organization.
After a specific duration,
data is deleted from all relevant storage in Teams.
Next, I need to select the specific location
for my retention policy.
In this case, I only want to apply this policy
to Teams chat, so I deselected the rest of the options.
As you can see here, you can create
different retention policies
for channel messages and Teams chats.
Policies can be applied to specific users
or teams or to everyone.
With the last option, you have the ability
to exclude specific teams or users.
Finally, let's talk about how to manage
and monitor the flow of communication in your organization.
There are two capabilities that can help you with this;
information barriers and communications compliance.
Information barriers help you avoid conflicts of interest,
such as insider trading, within your organization
by limiting which individuals can communicate
and collaborate with each other in Microsoft Teams.
You can create information
barrier policies using PowerShell.
Here, we first create user segments or dynamics filters
and then, we configure information barrier policies.
In this case, I'm blocking communications
between these two segments.
You can create block policies to prevent one group
from communicating with another group
or allow policies allowing a group to communicate
with only certain other specific groups.
Then, you will need to set your policies to Active.
This can be done individually using
the Identity GUID for each policy.
This list is generated using
the Get-InformationBarrierPolicy cmdlet.
And finally, you enable them using
the Start-InformationBarrierPoliciesApplication cmdlet.
You can learn more about information barriers
at aka.ms/informationbarriers.
Next, Communication compliance in Microsoft 365
helps you minimize communication risks
by helping you detect, capture,
and take remediation actions
for inappropriate messages in your organization.
We have an upcoming demo bench in Microsoft Mechanics
that will go through the step-by-step guidance
for this capability.
So that was a closer look at how you can leverage
Microsoft 365 Admin controls to ensure that Microsoft Teams
is another endpoint in your security
and compliance strategy.
Please keep checking back on Microsoft Teams for IT
for more guidance on deploying
and managing Teams for your organization,
including how to upgrade to Teams from Skype for Business
and onboarding your users to Microsoft Teams.
Thanks for watching.
(low whooshing)
(upbeat music)