(gears clicking)
- Coming up, we look at Azure's role as a global service
and how we enable privacy,
from what we give you within our control framework
as well as the new policy controls within Azure
to ensure consistency over where your resources reside
and how they're managed.
And if you're starting your GDPR implementation
we'll feature new options to help with compliance,
such as the compliance manager and service trust portal,
to respond to data submit requests in Azure.
(upbeat instrumental music)
So I'm joined today by Pradeep
from the Azure engineering team.
Welcome.
- Thanks for having me on the show.
- So privacy is a continued hot topic,
from who owns your data, who's got access to it,
what they do with it, and there's increased regulation
to protect the rights of individuals.
When people think about privacy,
there's a tendency to assume that maybe your privacy's
more at risk in the cloud.
- Yeah, we hear that a lot.
You know from the moment we got into the cloud space
around a decade ago, we have always
taken our responsibilities seriously, to ensure that we
protect your information and our service.
For us as a global cloud provider,
privacy isn't an afterthought, it's by design.
We bring privacy into the service.
- Right, so in practical terms, what does that mean?
- [Pradeep] There are around 74 main standards
and regulations that we need to comply with, worldwide.
And out of that around a dozen are related to privacy.
So we have a compliance framework with controls that
we have doubled up and that built directly
into the services.
So we have over 1,000 code controls that are mapped
to specific regulations.
For example, we meet some of the most rigorous regulations
with our control set.
And when we come across a new regulation,
we are typically assessing the data
in terms of what does not exist
and adding new controls to our control set.
- Great, so there's rigor built into the service level,
as the cloud operator and there are also controls
that we give you, as the outer user.
- Yes, so when you build an app,
there's also a need to architect them
to meet your organizations requirements.
For example, GDPR requests you do implement controls
to protect data hard pressed
and we give you the options for encryption,
in Azure storage, in Azure SQL,
and many more.
And also, with GDPR, one of the key requirements
is to enable the right to information
and the right to be forgotten.
- Great, can you show us an example?
- Sure Matt.
So here I'm in the Service Trust Portal
and this is the center portal to discover
resources and tools for your privacy and compliance needs.
From here I can get to compliance manager.
Compliance manager's a powerful way to track and manage
your privacy and compliance
based on a risk assessment score.
So I'll click into the Azure GDPR.
As I scroll down, you can see here,
the assessment is based on two perspectives.
First is the Microsoft Managed Controls.
And these are the controls that Microsoft leverages
as a service provider.
They also provide you in-depth details
on how Microsoft has implemented these controls
and how third party auditors have tested them.
As I scroll down, you will see the
customer managed controls.
These are the controls you are responsible for managing
and maintaining the test information.
- How would you respond to GDPR requests
as they start to come in?
- We have built in tools to help you with that.
For example here, our Service Trust Portal
also allows you to submit, export and delete requests
to meet GDPR obligations.
You can click Privacy tab here.
Select Data Subject Request.
Scroll down, and here you will see links for data log export
and forget user data.
For here, I will start first with the data log export.
This will take you to the Azure portal,
where we can create a request to export
a users' telemetry log data.
For example, here I'm gonna add export request
for the user Alex.
So select the username.
I select my subscription
and I select the storage account I want this to be.
And then I click create.
"The export request is being created".
Note, that you have to be logged in as an admin
to submit this request.
- Okay so this is going to store
all the logs on this particular user
into the storage account that you just selected,
but how long is this going to take to complete?
It depends, this can take a few days to run,
depending upon the amount of data
and the service the user has used.
So in this case, I've run of these in advance
and you can see, that will put off my request here.
You can see a folder structure here
and when we look within the exported folders,
you will see that the data is in a machine-readable format.
Most of it is in .json.
- Right, so we've satisfied the request
for the user to know what information is held on them
in the activity logs.
And obviously this is gonna help us find system level data
about the individual.
Then you combine that with Office 365 DSR,
for example, to discover content related to that individual
as well.
And we've covered that on Mechanics previously,
but what about if the user wants the account
to be removed from the system completely?
- You can then submit a delete user request.
Let me show you how that works.
So you go back to the user privacy experience page
in the Azure portal.
Click, Go to Azure AD to Delete.
And I type in the user name I want to select to delete.
I select user and then submit, Delete User.
Now this puts the user in the queue for delete.
So it allows you a grace period,
in case you want to recover back.
To permanently delete, go to the deleted users
and then select the user you want to delete.
So this also deletes the users affinity
with activity logs I've just showed.
- Great, so those controls are baked into the service,
as well as controls that we give you just to ensure
greater privacy and in this case, GDPR compliance,
but privacy also speaks to controlling
where your data resides.
- Yes it does.
When you deploy resources, like a VM in Azure,
you pick the region where it runs.
For example, here, I can select the location.
This also extends to other Azure resources,
like Cosmos DB, I can choose exactly which regions
I want my data to be stored.
We have over 50 regions available
in more than 140 countries.
Azure offers a consistent hybrid approach
across identity and access management
for integrating video data.
We also help you to protect unaccessed data
For example, the Azure Information Protection Scanner
can scan your on prompt file share,
or your SharePoint service to discover
sensitive data types, classify and label them
for increased data governance.
At the other end of this spectrum,
we also have Azure Stack, which allows you to use
Azure services, but keep everything
in your own data center.
- Awesome, it's great to see these options
for sovereignty and privacy,
but what can we do to help enforce privacy requirements
if, for example, you've got new developers,
or off-shore developer teams?
- So we just launched the down level ability
of the Free Azure Policy Service,
which is a central way to apply controls
across your Azure resources.
This gives your developers the necessary guardrails
to provision and manage your resources
without impacting their productivity.
- Great, so from here you can define
your organization standards centrally
and enforce them through policies.
- That's right, you can search for the Azure Policy Service
in the Azure portal.
We give you a number of built in policies
that can help you get started quickly
and you can then assign them to a scope,
which is a management group, or a subscription
where that policy applies.
Or, you can build your own custom policies
using here, under the Policy Definitions.
A few examples, as I scroll down the list
include setting policies to block
certain resources from being deployed,
or which locations, certain resources can be deployed.
Now let's take a look at the allowed locations policy.
This enables you to enforce the allowed locations
that the resources can be provisioned.
- So a great way to enforce your geo-compliance requirements.
- That's right, so here I selected
the allowed locations policy
and then now I go select my management group.
So I select my subscription here,
then click select, go down
and I select which locations I want to allow.
So for example, say here, I say select West US
and then say click assign.
So now, my policy's created.
- Okay, so what happens if I were to try
and create a resource that violates that policy?
- I have gone through and created a policy in advance
and if I try to create a storage account,
violating that policy,
this is what you will see on the error message,
it will not allow you to create a storage account
violating the policy.
- Great, so you can really control,
at a very granular level,
the location and the resources that you use in Azure.
And that's a really strong privacy foundation here
and across all Microsoft services and the controls
baked into the service, the controls we offer you.
Where can we go to learn more?
- So the Service Trust Portal is a great place to start.
It's a hub for resources and tools
and you can learn more about the Azure policy
at the link shown.
- Great stuff and thanks for the overview
on this incredibly important topic.
And to everyone else, thanks for watching
and if you haven't already, subscribe to
Microsoft Mechanics for the latest in tech updates.
See you next time.
(upbeat instrumental music)