(low whooshing)
(low thudding)
- Welcome back to Microsoft Teams for IT.
Today, I'll walk you through our approach to security
and compliance in Teams, as well as the main considerations
you have to think through to protect your users
and corporate data.
We know we need to strike the right balance
between keeping your users productive
and in their flow, while allowing you the visibility
and control to protect your users
and keep your organization's data safe and compliant.
As part of Microsoft 365,
Teams provides a platform for chat-based communication
on top of a mature and secure foundation
backed by SharePoint, OneDrive, and Exchange
to deliver a hub for teams to work together,
with their calls, meetings, apps, and files in one place.
As we covered in the first episode of this series,
by design you need to provision SharePoint Online,
OneDrive, and Exchange to deploy Teams.
When you set up a new team, a dedicated SharePoint site
is automatically provisioned
to store files and other content.
And for every chat conversation,
files are stored in the sender's OneDrive,
while text and images are stored in Exchange.
Leveraging SharePoint and OneDrive ensures that Teams
inherits the rich security
and compliance foundations of those services.
This compliments the controls that we give you
to configure the core experiences in Teams, with chats,
meetings, calls, and apps for internal and external users.
That said, enabling the right level of security
and compliance for your organization
is a shared responsibility.
It combines the customer controls we give you
to customize Teams with how Microsoft
runs the Teams service.
So let's talk about how we run the Teams service.
When you adopt Teams,
you are trusting your data to Microsoft.
As you optimize for security
and compliance, knowing where your data resides
in the service is top of mind for you.
Data in Teams resides in Microsoft's secure network
of data centers in supported regions
and countries around the world.
Your data is kept in the regional data center
or in-country data center available
at the time that you provisioned your tenant.
You can see which data center your data resides in
by going to the Office 365 Admin Center
and selecting Data Location under Organization profile.
And of course, as Teams usage expands,
we'll be adding more locations over time
and you can learn more about
data center coverage at aka.ms/teams-locations.
As you would expect, all data within Microsoft data centers
is encrypted at rest and in transit.
Also, we use the Secure Real-time Protocol
for audio, video, and desktop sharing.
Files created, shared, or stored in a Teams team,
including OneNote files, are stored
in an encrypted SharePoint document library.
And files shared and uploaded in a chat are stored
in OneDrive, which is also encrypted at rest.
Then, as your data flows within Teams, as a cloud operator,
we make sure the Teams service is compliant.
To help you answer questions from your auditors,
we publish auditor reports for Microsoft 365
in the Service Trust Portal at aka.ms/STP.
Of course, one of the advantages of Teams,
like the rest of Microsoft 365, is that we help you keep up
with evolving regulations and standards.
Teams is built on top of Microsoft 365's
robust compliance control framework
and meets some of the most rigorous
industry regulations today.
We maintain around a thousand compliance controls
that are common to most regulatory requirements
and as new requirements emerge that may be specific
to your country or industry,
we have the agility to add new controls as needed.
You can learn more about
supported regulations at aka.ms/complianceofferings.
In fact, the Microsoft Compliance Score
allows you to see the service level controls implemented
and tested by Microsoft, as well as recommended
Microsoft 365 customer controls that you can configure
to improve your compliance posture.
Speaking of which, let's now look at some of the controls
available to you, starting with some of the ones
specific to the chat, meetings, and calls.
These controls can be organization-wide settings,
such as allowing or disabling external access,
or policies that you configure for specific users.
To set these controls, think through the different needs
of each group in your organization.
For example, users in the research
and development team may need stricter controls
versus users in your marketing team.
If needed, you can restrict the Teams experience for guests
and other people outside of your organization,
such as external meeting participants.
For example, you can disallow screen sharing in meetings
or the ability to make private calls.
Under meeting policies, at a teams level,
you can stop external participants from giving
or requesting control to a machine.
To prevent unauthorized or early call access,
you can prevent people that haven't been authenticated
from starting a meeting.
You can even go the extra step in Meeting settings
to determine if anonymous users can join a meeting.
And if you use live events, you can specify
the types of users allowed to join scheduled events
from everyone down to specific users or groups.
As part of your retention and compliance strategy,
you can also determine who is able to
edit and delete persistent chat messages.
And of course, as we have covered previously,
you can govern what apps your users have access to.
These are just a few examples of security
and compliance controls tailored
to the core Teams experience.
To learn more, go to aka.ms/teamssecurityandcompliance.
As mentioned, Teams is part of Microsoft 365
and at that level, we give you a wide number of controls
to support a holistic approach for information protection
across Microsoft 365 services.
To get the right levels of protection,
your users will play an important role,
so you'll want to ensure that they take
the right actions with their content.
By design, protection policies can be configured
to follow the content generated by your users.
First, to help users make the right decision
around who can view Teams content, we highlight
if team members are guests or external users.
Second, users can set appropriate read or write permissions
as content is shared in chats.
Content classification in Microsoft 365
is respected by Teams.
Users can classify files by assigning labels
related to the sensitivity of their content.
These are tied to specific policies defined by IT
and we're working on broadening our capabilities
to classify content within the Teams app.
Then, using data loss prevention,
you can also set granular policies that govern your data
and define the specific actions
to be taken when sensitive information is shared.
Here, as a user creates a chat
that contains sensitive information,
they are warned of the possible risk through policy tips,
their message is blocked,
and further actions are triggered
based on the policies that you have set.
Then, as Teams is used on mobile devices,
should the device be compromised, you can enforce app
or device level authentication
using Microsoft Application Management,
or MAM, in Microsoft 365.
MAM allows you to selectively remove Teams corporate data,
prevents the copying of corporate data into unmanaged apps,
like non-corporate email,
and can prevent saving files to local storage and more.
At the core of information protection
is our robust identity-based security for access management
and authentication powered by Azure Active Directory.
This allows you to grant and revoke access to Teams users
and protect against rogue admins
by determining different admin role privileges.
One of the most effective access controls
that you can enable is multi-factor authentication,
which requires users to use a second form
of authentication to sign into Teams.
You can take advantage of conditional access rules
that govern access to corporate information
based on the network location and device being used.
To protect against attacks targeting your users
or that could compromise your data,
such as impersonation attacks or phishing,
Teams is integrated with
the advanced threat protection capabilities
of Microsoft 365, such as Safe Links.
This provides time-of-click verification of URLs.
Even links shared in a chat are scanned for each click.
Safe links remain accessible
and malicious links are dynamically blocked.
Equally, malware weaponized files
can be detected in chats with safe attachments.
And to take advantage of these capabilities,
you need to enable them
in the Security & Compliance portal.
Okay, let's switch gears now
and talk specifically about compliance.
This is where you think through all potential audits
you need to be prepared for
and regulations that you need to comply with.
From the Security & Compliance center,
you can see all the activities in Teams that are auditable.
You can also set email alerts around specific activities,
such as when a new team is created
or use this visibility to retire teams over time.
As Teams usage progresses within your organization,
it becomes more important for you
to monitor and manage data.
For your team files, we help you get a handle of your data.
You can choose to either retain the data that you need
for compliance purposes or delete it after
a specific period of time to manage your liability.
Files in teams retain the policies applied to SharePoint.
By design, Teams chat is persistent
and by default, content is retained forever.
However, you can set retention policies
independently for chats
and channel conversations, allowing you to delete data
within time periods as short as one day.
Of course, sometimes you'll have the need to hold data
and information to investigate
internal incidents or for legal review.
We allow you to search and analyze the information in Teams
and to export Teams data from chat and channel messages.
Rich filtering capabilities allow you
to gather data across all users for further review.
You can define conditions such as keywords, date, author,
recipient, locations containing Teams data,
or target your search to certain users or specific domains.
We also help you discover meetings that took place
and the participants in each one.
Teams is integrated with Microsoft Stream,
so meeting transcripts from meeting recordings
are also discoverable via search and eDiscovery.
By placing content found in search on legal hold,
you can ensure that data associated to a user or team
is preserved immutably for potential use as evidence.
This way even, if a user deletes or edits channel messages,
immutable copies of that content are maintained
and available in eDiscovery search.
Beyond after-the-fact review of activities,
there may be times where you want to be proactive
by imposing specific policies around communications
that promote compliance to your corporate standards
or industry requirements.
With information barriers, you can restrict content
and communications being exchanged between
a specific set of users due to conflicts of interest.
To leverage this capability,
consider who should know what information
and what are the risks of different groups
getting access to that information.
For example, in the financial industry,
there are specific concerns with how information flows
in order to prevent insider trading.
You can block certain user segments from communicating
via chat or the sharing of files with each other in Teams.
Lastly, if you need to comply or address
a code of conduct in your organization,
communication compliance, as part of Microsoft 365
Insider Risk Management, allows you, for example,
to monitor your organization for communication violations
in Teams, such as the use of offensive language.
As an IT admin, you can set intelligent filters
that use machine learning to detect inappropriate conduct.
So that was an Essentials overview on security
and compliance for Microsoft Teams.
Please check back soon to watch our hands-on demonstration
on configuring Microsoft Teams to meet
your security and compliance needs.
You can follow our full playlist
at aka.ms/MicrosoftTeamsforIT, with upcoming topics
such as Skype for Business to Teams migration
and how to scale Teams with end user adoption.
And if you are in a government cloud service,
such as the U.S. Government Community Cloud, or GCC,
GCC High, or Department of Defense
and don't see some of these capabilities available yet,
rest assured, we're working on it.
And you can keep up to date at aka.ms/TeamsGovRoadmap.
And of course, to continue learning more about Teams,
check out aka.ms/SuccessWithTeams.
Thanks for watching and see you next time.
(calm music)
(low whooshing)
(low thudding)