(upbeat techno music)
- Hello, and welcome to Microsoft Mechanics Live.
Coming up, we'll take a closer look
at all the updates for the Microsoft 365 admin experience,
including everyday time savers with user templates,
tailored and interactive quick setup recommendations,
the brand new global reader role.
There're updates to the Compliance Center as well.
New information barriers and those policies
to actually stop internal collaboration,
where there might be a conflict of interest.
And to do that, I'm joined once again,
by Navjot Virk, a leader on the team
that builds the Microsoft 365 admin experiences.
Welcome back.
- Thank you for having me.
(applause)
- All right, so you've done a ton of work
for IT-Admins, I think there's probably a few IT-Admins here
with us today.
So, what's the team been working on,
and how do you make things better?
- So we've been doing a lot of work,
and you'll see a few teams emerging
in the work we've been delivering.
First, we want to save you time with common tasks.
And beyond that, we want to make it really easy
for you to protect all of your information
and keep up with your regulatory needs.
- All right, well slowing us up by showing us
a few things that we can do now, kind of at the top level
of the Microsoft 365 Admin Center.
- Sure, so given the amount of time all of you spend
in the Microsoft 365 Admin Center,
we want this experience to be really intuitive.
So the first thing you'll notice on the landing page
is that it is a streamlined view
of the things we use most often based on a telemetry.
It's clean, there's no clutter.
You can easily find what you're looking for.
You can use Search if you're looking for something deeper.
You can customize this page to meet your needs.
So, it's very easy for you to add a card
for something you're interested in,
if that's not already on the page.
You can easily move these cards around
to make the page look exactly the way you want.
You can even customize the left navigation bar.
So I happen to be the Compliance Admin for my organization,
so I'm going to quickly add the Compliance Center.
- [Jeremy] And I love this, this is great, yeah.
- [Navjot] Yeah, and just with one click.
So I can easily get back to this Compliance Center,
and get my job done quicker.
- [Jeremy] Awesome.
- Now the next thing I want to show you,
is not going to save you time,
but it might save you your eyes.
So we introduced the Dark Mode
in many of the user applications earlier this year,
and I'm happy to announce, that we're bringing it--
- [Jeremy] I think you can clap
- [Navjot] Yes, yes!
- [Jeremy] I'm a big fan of dark mode.
I use this in all my phone apps.
I use it in all the portals I can,
with debuggers, all these things should be dark mode.
In my opinion.
- [Navjot] Yes, so you can use it now in M365 admin as well,
but actually I happen to like light mode,
so I'm gonna switch back to light mode.
Now I know that there's another where
a lot of you spend a lot of time
and that is user management.
So, over the last year we've done a lot of work
to bring all user controls across Microsoft 365
into the single pin here.
So you can see all the user settings and you can manage them
without having to dig deep into various admin experiences.
- [Jeremy] Right.
- And beyond that, you're also making it really easy
for you to add a lot of users
especially, if you don't want to use PowerShell or CSV files
- Nothing wrong with PowerShell or CSVs, I love them.
- We love them, nothing wrong with them
but in case you want to use UX,
you can now use user templates
to add users with similar attributes.
- [Jeremy] Okay.
- [Navjot] So in my case, I need to add a bunch of
new employees, temporary employees in the New York office.
So I'm going to create a template for that.
And to do that, all I need to do
is give this template a name, hit next.
I am happy to have all of these users
have an auto-generated password.
I'm going to assign all of them the same E3 license.
And then there is some profile information
that is common for all of these employees.
So all of them are going to have the same job profile.
They have the same department
and they're all going to be part
of the same office in New York.
I hit next.
I'm done editing.
And I save this template.
Now, I can quickly add these users using this template.
So let me try and add a user.
So I'm gonna go back to the templates.
I'm gonna use this newly saved New York Temp Staff template,
and all I have to do, is give the first name,
the last name, I want the same display name,
and then I give the user name, which is the email address.
And then, I'm done!
Add the user, and that's it.
With three clicks, I've added a user.
And of course--
- [Jeremy] Amazing, and this is amazing,
especially for things like seasonal
where you're hiring maybe 50, 100 people
with the same attributes.
So the user management task,
I think is something that everybody uses,
including myself, every single day but,
what else have we been focusing on to save people time?
- So, another thing we know that many times
you don't know what you don't know.
And we wanna make it really easy
for you to log on to Microsoft 365
and get the maximum value out of your subscription.
So to help you with that,
we're now introducing guided setups.
On this page,
you can discover different services and controls
that are available to you as part of your subscription.
But not just that, it actually gives me recommendations
for things I should consider enabling to get the most value.
- [Jeremy] Okay.
- [Navjot] So in this case you'll notice that, for example,
it's recommending that I increase protection
from advanced threats.
So if I want to learn more I can click view,
it takes me to this page that
tells me more about this control,
tells me all the user impact
that'll happen if I enable this control
and also tell me where I can go to learn more about it.
- [Jeremy] Okay.
- [Navjot] Now, if I want to turn this on,
I can do it right from here.
I say get started.
It picks up some great defaults.
If I'm happy with these defaults,
I say create policies, and that's it.
With two clicks, I have enabled advanced threat protection
without having to go deep into the security center.
- [Jeremy] Awesome and did all that stuff
kind of pre-default gave you some recommendations there
you got it all out of the box.
But you can always go back later
and it gives you the deep link to be able to go back later
and kind of tweak those setting
and configure them to your needs.
- Yes. Absolutely.
We've also been on a journey to make
the wariest admin experiences across Microsoft 365
more cohesive so that they look and feel the same
but they also act the same.
So, I'm gonna show you the new
security admin center landing page.
You'll notice it looks a lot like
the landing page of the M365 admin center.
I have a similar concept where I can add cards.
To customize this page, I can move these cards around.
I can even customize my left navigation bar
just like in the M365 admin center.
The idea is to save you time by giving you experiences
that are consistent and predictable.
- Alright, what I want to drill into an issue.
I think a lot of people probably have,
tell me if this isn't true,
you might have to many global admins,
people want to able to see the reports,
the usage, those kind of things.
Are we doing anything to where we can stop
having everyone get global admin access to our tenants?
- [Navjot] Yes.
We all know this is a major ask from a lot of you.
We know it's not a great conversation,
but for example your manager asks you
for a global admin right, just so they can look
at some report on a portal or some configuration
and you know that they're just one click away
from accidentally either taking down the service
or locking it down to much.
- Anyone every have something like this happen to you?
(light applause)
two people yeah, don't be ashamed.
I've had this happen, it happens to us.
- Yes and you know it's not safe and secure
to have so many global admins.
So to help you with that,
we're introducing the new global reader role.
The idea is that users with this role
can view things in the admin experiences
but they cannot make any changes.
So in fact, Jeremy...
(light applause)
- [Jeremy] All right, you can clap for that.
The only thing I'm not clapping about though
is it looks like you don't trust me.
Could be a global admin in your tenant.
- Oh, I absolutely trust you but I don't want you
to have more power than you can handle.
- [Jeremy] Okay. (laughter)
- [Jeremy] Yes, that's the bad thing.
I can get myself in trouble.
- [Navjot] So, I've assigned you the global reader role.
So why don't you show us your experience.
- Okay, so I've got my user pane kind of opened up here.
Everybody's pretty familiar with this
and I know that you're logged in as Megan.
So I'm gonna actually do my best
to take away your global admin powers.
So, I'll click into Megan,
and now I can see all the information come up.
So I see like all the things in terms of alias
kind of the common things licensing state
all of that stuff but when I go to manager role
you see that in this case I can't change or edit this page.
I don't have any saved dialogue.or anything there.
You see that I don't have permission through
this nice dialogue that I've got to tell me
I don't have the permissions to edit that.
So, I can't get in trouble 'cause
the worst thing I could probably do is reset your password
or take away all of your admin right just mistakenly
like you said because I've got to much power.
I don't know what to do with it.
- Exactly, so the idea here is
that you can see stuff, but you can not change anything.
That's the extent of your power
but it's still pretty useful
because you are getting great visibility
into how your tenant is set up and being used,
you just can't do any harm.
- [Jeremy] All right, so these updates look
like you gonna save a lot of time,
to get services up and running as well,
and save our bosses from themselves,
and maybe save our own jobs in cases in terms of,
if something gets shut off
but we also have a long history
in terms of security compliance controls.
So, what's new there?
- So, security and compliance continues to be
a huge area focus for us because we know
it's critically important to you and your business.
So, earlier this year we introduced the compliance center
and know we're introducing a compliance score.
The idea is that the score gives you
a very easy way to both access
and manage your risk in this space.
So as you can see for my tenant,
our compliance score is 78%.
I see most of it is coming from Microsoft manage controls.
This page also gives me key improvement actions
that I can take to improve this score.
And as I scroll down, it actually gives me break down
of different categories that contribute to this score.
So, I just noticed that protect information,
which is a very important category, I have a 51% score.
Now I would really like to do better here.
So I'm gonna click on view improvement actions
and it gives me specific actions I can take
to improve this specific category.
Now one of the simplest and highly recommended way
of improving protection for information in your organization
is to use data classification.
On the data classification page, you can see
that I have two different types of labels
I can apply to my organizations data.
I have retention labels that I can use
to apply consistent retention policies,
and I have sensitivity labels that I can use
to apply consistent security policies
to data depending upon classification of the data.
- [Jeremy] Nice.
- [Navjot] This page gives me a great overview
of how I'm using these labels in my organization,
what kind of data is being protected.
I can also go to the sensitivity labels tab
in the compliance center and see
the various sensitivity labels in my organization.
For example, the confidential label.
You'll notice that for this label
I have enabled certain security policies.
I want anything that is labeled confidential
in my organization to have encryption,
it'll be Artemis protected.
- [Jeremy] Right.
- [Navjot] I want it to have a water mark,
a header, footer, and some settings that
are specific to groups and sites as well.
Once I cleared these labels and published them,
end users can apply these labels
to file, emails, teams, groups and sites
across Microsoft 365 to consistently protect the data.
- And this is great but I know even with
the information protection, kind of bars up there,
in terms of being able to manually label
their sensitive files, not everybody does this manually.
So is there anything you can do to protect that as well
- Yes.
So now not only can you users apply these labels manually
but you as a admin can create an auto classification policy
that'll automatically detect files that are sensitive
and apply these labels on your behalf.
- [Jeremy] Okay.
- [Navjot] So, let me show you how this works.
So here I'm gonna create an auto-labeling policy.
I give the policy a name
and I'm going to associate this policy with some rules.
So I wanna make sure that any data in my organization
that is a financial information.
So it has more than 10 credit cards
or bank account numbers or routing numbers.
I want it to automatically get labeled confidential.
Once I cleared this policy, it'll give me a little summary,
So basically apply confidential label
if it meets these rules.
Now anytime you as a user are creating documents
that have this information,
or even existing documents that have this information,
they will automatically get labeled on your behalf.
- [Jeremy] So, why don't I show you what that looks like?
- [Navjot] Yes.
- So on my computer I'm actually working on a doc.
It's just starting, so
I've got some great stuff from the clipboard
so I'm gonna hit CONTROL + V here.
Put everything in that I'm working on
and I've got some really legit credit card numbers here
that I'm typing.
So all of this stuff here,
it's kind of scanning the document now.
If I hit enter, it's gonna look for that
and it gonna actually meet your threshold
and you'll see here that I've got
this business bar that comes up.
In here we've got these organizational recommendations,
I've got a policy tip, I could learn more,
I could even change it if I want to.
So, I'm gonna go ahead and do that.
So, I will go ahead and change this.
That's gonna apply the label here,
it's gonna apply all the protection like you mentioned,
The RMS, the encryption and now I've protected the document
but not everybody is quite as, kind of tech savvy
and willing to kind of press these buttons
even with a nice yellow bar.
So can we protect them as well.
- Absolutely, so there're many users who will ignore the bar
and if that happens, don't worry,
your data is still protected.
The service will automatically scan
for files that meet this criteria
and apply the label on your behalf.
So your data is always protected.
So why don't you go look at some
SharePoint document libraries
and see what's happening there.
- [Jeremy] Okay,
so I've got my share point library open here.
You can see I've got quite a few different labels
in place already so if I go ahead and click on this one
one of the interesting things that you'll see here is
that we've actually got some financial services
of different things that we've detected
and it's through Contoso Autoclassification.
So it's automatically been labeled
as confidential by the system.
So pretty cool stuff.
Even if I neglect to label it,
even with that yellow bar saying,
"Please, add the label, it's gonna protect me on my behalf"
just using the system itself and the auto classification
- [Navjot] That's the idea.
If your users are not being proactive,
the service still has you covered.
So your data is always automatically protected.
- All right, so there are other controls
that we can use to protect information?
- Yes, another thing that many of you have been asking for,
especially those of you who work in regulated industries,
like financial services, is the ability to create
barriers between different types of users
in your organization.
So imagine that I'm a bank and I have some users
who work in the investment banking side,
and then I have some users who work
on the customer advisory side.
Financially regulations require that these two sets of users
not be able to collaborate or communicate with each other
in order to avoid insider trading.
So to help you with that,
we are introducing information barriers.
So I'm going to create and information barrier policy
but first I'm going to create some user segments.
So here I have a segment called Investment Banking.
I've assigned some user to this segment
and in fact Jeremy, you are a part of this segment.
- [Jeremy] That's actually my day job.
I'm an investment banker.
- [Navjot] I'm sure you are.
- [Jeremy] I'll be on the Squawk Alley next week.
- [Navjot] Yes!
I also have a few other users here, Sesha and Jeff,
who are also part of investment banking.
I have another customer segment called Advisory.
And Nikita is part of the advisory segment.
And now I am going to create a barrier between these two.
So I'm going to create a policy.
Which is going to block all communication
and collaboration between these two segments of users.
- [Jeremy] Okay.
So your telling me, I won't be able
to talk to Nikita anymore?
- Why don't you try it?
- [Jeremy] All right, so I'm in my teams console here
and I'm gonna go ahead and just
like I normally would search for Nikita.
And she is in my same badger ID
but I doesn't even resolve the user name.
So I don't see Nikita there.
So I'm blocked and it's kinda nice here
that I don't get a you're blocked from communicating.
She's literally not there at all.
So if I go ahead and try then to
to go into teams and manage a team
and say I want to add Nikita, in that case to the team.
So I'll go into teams management,
and then I will add a member,
and so I'll type Nikita's name there as well.
And you'll see we don't find any matches again.
Not kinda putting it in my face
that yes we see Nikita but you can't talk to her.
This is actually a good thing for-
- [Navjot] Yeah, but you can still collaborate with Jeff
because Jeff is in your segment.
- [Jeremy] Right, exactly.
So if I try to add for example Jeff,
not Jeff Teper but Jeff McDowell, another awesome Jeff.
So I'm gonna go ahead and add him
and then we have Jeff, as you'd normally expect,
being added to my team,
there he is as part of my normal members and guests.
So now I'm able to work with you or with Jeff
but not Nikita 'cause she's in a different segment
then I'm able to communicate with.
Now this also applies to SharePoint, right?
- Absolutely, in fact, information barriers are enforced
across all Microsoft 365 endpoints and experiences.
- [Jeremy] All right, so let me go into SharePoint
into the document library here.
So I've got one, I wanna actually try to
share something with Nikita, in this case.
So I'll go ahead and type Nikita's name
and you'll see again its not resolving Nikita,
even though, again, she's in the same directory
but of course if I want to share with Jeff,
I can do that and there's Jeff
and of course the sharing works
because Jeff's in my segment,
he's also an investment banker like me.
- [Navjot] Correct and that's the idea.
We wanna make sure that you can meet your regulatory needs
and create the barriers that
are appropriate for your business.
- So, thank you so much Navjot.
This is a great set and sampling
of all the recent updates that we have
for Microsoft 365 Admins but what would you recommend
people go to learn more about all the things
that we saw today?
- So everything that I showed you today
in Microsoft 365 Admin Center
is available for you to use today.
Please go try it, give us feed back
and also please go check out
aka.ms/CompliancePreviews to learn more
and sign up for previews for the compliance previews
I just showed you.
- Excellent tips, and of course keep watching
Microsoft Mechanics for the latest updates,
if your an admin, or even just a global reader
and we'll see you next time and goodbye for now.
(applause)
(techno music)