Coming up on today's show, we take a look at recent updates for information protection
management of OneDrive for Business. From limiting syncing to domain join machines that
you manage to additional controls to govern the scope of file-sharing and updates to mobile
device management and how you can protect the flow of data from OneDrive. Keep watching
as we'll check back in on the OneDrive for Business roadmap.
Microsoft Office
Office Mechanics
I'm joined again by Reuben Krippner, welcome!
Thanks for having me.
There have been a lot of updates for OneDrive for Business, why don't you walk us through
a few of those.
Sure, let's start with something that's been commonly requested from IT and that's the
ability to block sync on non-domain joined or unmanaged PCs.
So the typical scenario
from IT is that they want to restrict sync on personal home computers or on PCs
that are on domains that they don't want sync to be applied, maybe R&D, maybe the legal
team. So it's important to note also that this particular feature will automatically
block all Mac sync simply because they can't be truly domain joined.
This is a really good option if you don't want to have corporate data find its way onto
unmanaged computers but how does it work?
Initially we'll be providing this by a PowerShell cmdlet and it's really really simple so firstly
what you do is you identify the domain GUIDs of the domains that you want to allow sync
to occur on and then it's simply the case of running this PowerShell command and very
very simple to setup. We have a look at the cmdlet here it's Set-SpoTenantSyncClientRestriction,
I can then set the parameter of enable and then all I need is a semi-colon delimited
list of the domain GUIDs once that's actually run, then what's
going to happen is that sync is only enabled on those domain joined PC's. In this case,
let's have a look at the end-user experience and if the user goes in with that setting
they're in either a home PC or a blocked domain. When they actually run sync, what will actually
happen is, it will go through the standard sync process, connect to the actual server.
But what happens when they actually click on sync now, is it will prompt them and say
we couldn't sync this library, you're not able to take this offline. It's very clear
for the end user there's no way to take these files offline.
A lot of great stuff there in terms of managing, again unmanaged or
personally owned PCs from syncing. Again, this stuff will work on a Mac computer as
well. Let me show you something, you talked about domain GUIDs and I know a lot of people
might not be aware of how I can actually get that value. I have here on my computer the
method of getting the domain GUID, it's also via PowerShell. In this case I'm checking
my domain, getting my ADForest, looking for each of those which identity in terms of domain
GUIDs I have available to me. In my case, I have just one object GUID that gets displayed,
now that's the value that we're going to pipe into your domain GUID value you showed earlier.
We have even more to show in terms of OneDrive for Business, right?
That's right. On top of that, with all of this ability to control and restrict sync
on domain or managed PCs, we can also have a look at the new auditing and reporting capabilities
in compliance center. I can actually go and filter on action, such as those computers
that were blocked or those computers that were allowed. So when I actually run that
report you'll see here's a list of all of the requests, the sync requests that have
been blocked and I've got information like the client IP so I can actually follow up
with that user, maybe give them some more coaching or training about how they can actually
sync their content offline on a managed PC.
Great. Lots of great reporting. Beyond just what we can do on the desktops. Lot great
updates that were doing in terms of mobile devices. If I think about it, a
lot of people are just connecting to data through email but as that
progresses into OneDrive for Business I want to be able
to protect that traffic as well. One of the great things that we have now in Office 365
is the ability to enroll mobile devices straight into MDM even if they're only attached via
OneDrive for business. I want to flip over to my computer here and we'll see that I've
got a couple of machines joined. I have even a Windows 10 PC joined as well as the iPhone
and a Samsung Android phone, all these are here. And you'll notice that I've also got
the ability to either do a full wipe like we're used to from Exchange ActiveSync side
or a selective wipe. Let me show you what I got on my phone itself because what I want
to show you is the how the selective wipe actually works because I can get rid of even
OneDrive for business content on that device now not just the Exchange content. I'm going
to fire up my phone and we'll see that if I open up OneDrive first it's managed by my
company, so we see that straight away. If I go into my accounts, I have both my personal
account as well as my Contoso Office 365 account now if I go back to my computer. I'm going
to issue that selective wipe. Now again, this phone only has OneDrive for Business set up
on it not anything with email. I'm going to go ahead
and click 'selective wipe'. It will give me a warning. Alright, so now if I pick up my
phone again you'll see that the accounts here are actually going to perform a wipe against
my phone. My company then has removed access, in this case to OneDrive, for me. Leaving
my personal data on the device and my personal OneDrive data intact but basically resetting
that application so doesn't have any of the corporate data on my phone. Really cool stuff
there in terms of managing not just email but also OneDrive on a mobile device
And a course with the offline capabilities coming to the mobile apps before the end of
this year it will not only be about blocking app
access but also being able to remove corporate files as well
Right, so what other controls we have to really limit the flow of data on devices?
Another option we are providing is to limit the amount of storage
that each user can have on OneDrive for business and again so this is based
on a a very simple PowerShell cmdlet and I can go
in and set for individual uses a particular storage
quota. In this particular case what I'm going to go and do is set the limit from one
terabyte down to 500 gigabytes. All I need to do is set SBOSite, set the identity
or the URL of the site and then we've got this
parameter storage quota. That in megabytes 512,000
megabytes, so when I actually and go run that it
will apply that onto the site and what we'll see when we actually go
into the site itself, when I look at the storage metrics for that particular site, we'll see now,
there it is, set to 500 gigabytes
Just another mechanism at ITs disposal to help limit
the flow or the ability to manipulate or use corporate files maliciously
A lot of people also been requesting additional controls around limiting the scope of file-sharing
That's right, so we've been finding that many users
rather than specifically nominating who they want to share files with
a simply dragging files into the 'Shared with Everyone' folder, makes them universally
discoverable and can cause a challenge for IT and control about
the scope of sharing. What we're actually doing is we're
bringing in some controls that allows IT to force the user
to nominate who they specifically want to share that with and again we're doing that
via PowerShell cmdlet so in this case we
want to be able to turn off the 'Show Everyone' we want to be able to
turn off 'Everyone Except External Users' and 'All Users' so basically
limiting all the means to share with everyone. On top
of that, what we're also doing is, by default, the 'shared with everyone' folder
won't be provisioned for all new tenants and all
new users. You can enable that if you want to. We're really allowing IT to control that
Let's show you this cmdlet. All I need
to do is, in this case, I'm turning off the 'everyone claim' and I just
set that to false. Really really simple. Now when I
actually go back to the user experience let's say that I want to go and share
this particular file. Standard share dialogue here and as I type in 'everyone' ordinarily
that would resolve. You'll see in this case we haven't turned off the 'Everyone except
external users' but I can go and do that as well so
really limiting the flow and the scope of sharing to have more control over that
So you can also turn off the
'All users' item from the people picker as well. These are some really great features
and capabilities a lot of people have been asking for to manage OneDrive
for Business but there's a lot of new additional stuff coming this year as well right?
That's right, at Ignite we obviously made some big
announcements and we can confirm we're on track as far as the next gen sync the
new sync client coming out before the end of the calendar year. We'll also,
as we talked about add offline support to our mobile app's. We've got a complete
webclient refresh which I'll be really excited to talk about
the next time we're together and finally a bunch of enterprise IT
features including the ability to set and allow
or deny lists of domains that users can share with
externally. Lots of really exciting stuff coming and all
before the end of this calendar year
All the IT management controls around limiting
in file sync to domain join PCs and the MDM capabilities are available today and you
can start using those right now also keep checking back to the Office blog
and Office Mechanics on Wednesday's or as news hits. Thank you all for watching
and goodbye for now.
Office Mechanics
Office.com/Mechanics