Coming up, we look at the Security Compliance Updates
in SharePoint and how it's the foundation for keeping your files safe
across Office 365.
We're gonna show you new conditional access controls to safe guard against insecure networks
and devices.
And new governance capabilities for site classification,
and Unified Auditing within hybrid environments.
Microsoft Mechanics
I'm joined today by Navjot Virk
from the SharePoint team, welcome.
Thank You Jeremy, glad to be here.
So, people know SharePoint for site creation and document collaboration
among all the other things that it does.
But, what's it's broader role in Office 365?
SharePoint is the foundation of secure file collaboration in Office 365.
It is the file store for all Office 365 apps and experiences,
including Office 365 groups, Microsoft Teams,
SharePoint team sites, and OneDrive for Business.
And by virtue of that, all these apps and experiences inherit our security and compliance controls.
So what's behind the direction that you and the team are taking with SharePoint.
So the way we work is very different now than be used to a few years ago.
We are more mobile.
We work from home, we work from coffee shops, we work on our own personal devices,
and sometimes even kiosks at an airport.
This puts the owner on SharePoint to make sure that you the admin
have the right visibility and controls to keep your data safe while keeping your users productive on the go.
Right, and your team is really building the tool to help protect information that gets generated
and stored and accessed by SharePoint.
How have things evolved in the recent months?
So in the last few months, he focused on three key areas.
First, to give you the right conditional access policy
so you can control the level of access
your users have when using insecure devices and locations.
Two, giving you better visibility into how SharePoint data is consumed
in your entire organization.
And, giving you better governance controls.
So what work has been done to address these areas?
Let's start with conditional access policies.
So here I am in the SharePoint admin center.
You'll notice that there is a new tab on the left called "Device Access".
This page shows you all the new conditional access policies for SharePoint.
The first policy I want to show you
allows you to control the level of access users will have
when they're using a non-compliant or a non-domain join device.
Or in other words, an un-managed device.
It's like a home computer?
Correct.
SharePoint relies on Intune to give us the signal on wether the device is compliant or domain joined or not.
You can use this policy to decide the level of access
users can have when using these devices.
Now if you want you can block all access
to these devices using Intune or some other MDM solution.
That's very restrictive and does not let your users be productive at all
on their personal devices.
So that's why we've introduced a new policy
that allows you to give limited access.
And in this mode, the users can still access that content in a web browser,
but they're not allowed to perform any actions.
that would bring the data down to this potentially insecure device.
So in other words, they cannot download print, or sync.
So I've set the policy on my tenant.
Why don't you show us what that looks like from the user perspective.
Now we'll move over to my computer and you'll see that I've got both
the experiences of a managed computer.
And were going to simulate what the un-managed computer looks like.
So here I'm joined on a machine that's domain joined manage.
I've got all these different buttons on top that you would expect to see if you were a SharePoint user.
Create new files and uploading.
I can even select a file and I'll see the download button appear.
All of that stuff is there for me and I'm completely unencumbered.
If I click on the file itself,
you'll see that when I'm in Office Online and Word Online, here.
Even a print button shows up.
So I can do all the things to create, download, print and access those files.
Now again, simulating that I'm on my home computer.
First thing that I'm going to see up on the top is that my organization
is not going to allow me to download, print or sync
using this specific device.
So I get a nice user-friendly acknowledgement
as to why I can't do all the things that I'd be able to do on the other machine.
So I can see here that I can still open.
I can share and I can get a link to this document.
And if I click on it,
in this case I can see another message here.
My organization doesn't allow me to download, print, or sync it on the device.
I don't have that print button that we saw in the other browser on my managed machine.
And, because I'm computer proficient,
I'm going to go ahead and try to actually work around that.
So I'm going to go ahead and open up the settings tab inside of Google Chrome.
I'm going to use that native print functionality and try to print that.
You'll see that even here I'm blocked from printing and I just have a blank document.
So that's the device and things that I can do there.
You also mentioned locations, so what are we doing there?
Yeah, so what we just showed you was that users are productive on their devices,
but you can accidentally bring the data down and leak it from be devices that might be insecure.
Now the second policies in the same direction.
This policy allows you to control access based on network locations.
The idea here is, if you want you can restrict your users access
only from network locations that you trust.
If you don't want your data to leak to potentially old networks, you can do that.
Now this is a very restrictive policy.
It's probably more applicable to organizations that
have regulated requirements for high levels of network security.
If you want to set this policy, all you have to do is enable the policy, here.
And, supply the IP ranges of the networks that you trust.
You can do IPV6 or IPV4 addresses.
Once you set the policy, it's pretty simple
The users will have access while their on one of these secure networks.
They moment they lave the network, they lose access.
When they come back, of course the network is restored.
So pretty simple.
Alright, so let's see if this works.
I'm going back to my computer and I'm going to go back to the same team site, here.
You'll see in my case, I've actually got MSFTCORP our corporate network connected.
That's a permitted IP?
Correct, yes.
Now if I connect to this MSFTOPEN, that's our guest network.
I'm going to go ahead and connect to that.
And then at that point I won't be part of the defined allowed IP ranges.
Now let's say I take my computer home.
I've connected to my home network or another network that I didn't trust.
If I go and click on any of the files there,
immediately I'm going to see
that access is restricted.
It's going to be another nice message saying,
"Due to organizational policies you can't access those resources on the network".
However, if I go back into my corporate IP address in that network,
I'll be able to access what I was accessing before.
So that lets me have secure connections as long as I am on a trusted network.
So how does this all compare to what we can do right now for my conditional access standpoint in Azure AD?
SharePoint conditional access policies enhance the access policies that you have in Azure.
Azure conditional access policies are good for applying policies across multiple workloads.
The policies I just showed you are very specific to SharePoint and only applied to SharePoint.
I would recommend you enable both the SharePoint policies
and the Azure conditional access policies
in case you want to control access from multiple workloads.
Okay so we've covered now location-based conditional access,
and you mentioned new data governance control as well earlier.
Let's switch gears and talk about what's new there?
So let's start with classification.
You can now apply custom classification tags to SharePoint team sites and groups.
You can use these tags to help educate your users about
how to use the content and share the content that is stored in a team site.
You can create these tags using PowerShell in Azure AD.
You can specify the names of the tags,
the description of the tag,
and even the order in which the tags show up in the team site creation and group creation experience.
So why don't you create a new team site and let's see what this looks like.
Ok will do.
So I'm back on my PC and I'm in the managed and logged-in environment.
i'm going to go ahead and create a site
using the normal path that I would usually use.
I'm go ahead and call this one "Mechanics".
And I can see that name is available.
And, I also see my different settings.
So i'm going to set this to "Private".
Then i'm going to look at the site classification, this is what you're referring to here.
We're going to go ahead and make that confidential.
Maybe we're going to start building some new shows
for Mechanics that are about products that we haven't released yet.
We'll go ahead and click next.
Now I can assign people in the group.
So I'm going to give you ownership of the group, Navjot.
And I will assign another member here, Karrissa.
And, click finish.
And what happens is every team site has a group.
And, every group is associated with the team site.
When you apply one of these tags to a team site,
it automatically also shows up for the group and vice versa.
Right, so we see that here then, Mechanics, Private Group.
And it's already got that classification confidential on that.
That means I don't want to share this out to external users, for example
because this is a confidential site.
Now the nice thing here is it also happens to work
across the other experiences in Office 365.
Now it takes a moment for that to happen and I just did this here.
I'm going to go over to a previous group that I created called "Project Redstone".
Now that private group also has the confidential tag assigned to it.
I did that in the same way and its assigned those classifications.
And if you like, you can programmatically assign additional SharePoint security policies
to these classification tags.
In the future, you'll be able to do that automatically.
When you create a tag, you'll be able to specify security policies to go with that.
All these controls apply to things beyond just the sites that were doing.
Maybe I'm going to be using things under the covers with the SharePoint like teams or groups.
Just to illustrate that even further,
here I'm in Microsoft teams.
A lot of people don't know that Microsoft teams are using SharePoint document libraries
to store all the files for the group chat that happens
in OneDrive for business for the one-one-one chat.
Here you can see I've already got a chat going with the team here for Project Redstone.
I've uploaded the doc "Project Redstone.docx".
You'll be able to audit all this through SharePoint, right?
Yes, absolutely.
And because SharePoint is the file store for teams and groups and other experiences,
you can audit all file activity across all of these experiences in Office 365.
Here I am in "Audit log search" in Office 365 security and compliance center
Let's search for this document that you just added to your teams conversation.
It's called "Project Redstone".
I'm going to search for that.
Let's restrict our search to see the last time this document was uploaded.
Here I am, I'm going to search for
anything related to Project Redstone which was uploaded in the last few days.
Right here you can see "Project Redstone.docx
Which was uploaded by Jeremy.
This was part of the teams conversation, but it shows up right here.
And that's the point.
You should be able to audit all file activity
that's happening across all Office 365 apps and experiences,
because they're all powered by SharePoint.
So does this extend to On-premise SharePoint as well?
Oh yeah, we've just introduced unified auditing
across SharePoint online and SharePoint On-Premise servers for our hybrid customers.
So that the admin can go to one place to find all file activity across the entire organization
Now I'm going to search for all the files that were deleted in the last few days.
I don't want to look for uploaded anymore.
I'm just going to pick all the files that were deleted in the last few days
across my entire organization.
Here you will see that I have results
for files that were deleted in SharePoint online,
and files that were deleted On-premises.
One of the ways to tell that is by just looking at the username.
For SharePoint online activities, you can see the username
in the format of "username@contoso2016".
Whereas for all the activity that have happened On-premises
you will see usernames by "contoso/usernames".
So you can tell i'm seeing all activity that is happening across my entire organization,
including all Office 365 experiences and apps and On-premises SharePoint.
Right, we've also done a lot of work around data retention in Office 365
that's taking advantage of classifications.
Now these are things like sensitive information types,
and using document fingerprinting.
All the stuff that's pre-defined by industry.
For example, health care and financial services are also pre-defined.
Yes, absolutely.
You can now apply retention
either based on custom tags you create,
or based on fingerprints that just look for patterns on file.
Recently we had Kamala Janardhan the show to film something around
Advanced Data Governance that you might want to check out to see more.
It's really great seeing all the updates for SharePoint across security and compliance, but what's next?
In the coming year we're going to focus on continuing to provide more security controls and access policies.
We're also going to focus on making access policies more granular.
You can apply them at team site level versus the entire tenancy.
And I just mentioned this before but, were also going to extend classification
so you can apply automatic SharePoint
security policies to certain classification tags.
And of course, we're going to continue to focus
on better integration between teams and groups experiences.
So where can I go to find more information to get started?
So today we've only touched on some aspects of security in SharePoint and OneDrive.
There is obviously a lot more including things like data center security,
compliance, and privacy.
Please check out our detailed security and compliance white paper at the link below to learn more.
When can I start using some of the controls that we've seen today?
You can start using auditing and classification right now.
Conditional Access Policies are in preview.
A lot of exciting capabilities, thanks for joining us today.
And of course, keep watching Microsoft Mechanics as the technology continues to evolve.
And we'll be bringing you all the updates.
Thanks for watching and goodbye for now.
Microsoft Mechanics
www.microsoft.com/mechanics