Office 365 Supervision

If you did not now, there was a recent announcement for a feature called Office 365 Supervision.  This feature is a “gem” of a feature for enterprise organizations that have complex compliance or regulatory requirements.  Office 365 Supervision feature is part of the Office 365 Advanced Data Governance (E5) service.

What Supervision provides is the ability to review (“supervise”) inbound/outbound data for your organization.  This is not a data loss prevention (DLP) solution; DLP is already provided through the Office 365 service.  What Supervision does is provide you the ability to create policies to monitor communications and designate reviewers who perform that monitoring (“supervision”).  Supervision can be done on more than just Office 365 data; if there is inbound/outbound data (including data going to Facebook, Twitter, etc.), these reviewers can review data that meets criteria. 

When creating a policy you have the ability to scope it to users, groups of users, and specify complex search criteria to identify the data.  For instance, you may have scenarios where you need to monitor how different groups within your organization talk with each other (i.e. make sure conversations are being firewalled) or you need to monitor communications are that are going external from your organization. 

Reviewers then have the ability to review messages that fall within a policy and then mark them as compliant, non-compliant, questionable and resolved communications.  Then you use Supervision reports to review policy compliance.

Announcement - https://blogs.office.com/2017/06/22/new-in-office-365-security-and-compliance-june-update/

Announcement - https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Announcing-GA-of-Supervision-in-Office-365-Advanced-Data/ba-p/69344

Supervision Policies - https://support.office.com/en-us/article/Configure-supervision-policies-for-your-organization-d14ae7c3-fcb0-4a03-967b-cbed861bb086?ui=en-US&rs=en-US&ad=US

Supervision Reports - https://support.office.com/en-us/article/Supervision-reports-2a762db5-e1c9-4c09-aa8e-bef49ce97209

Office 365 and SIEM Data Feeds

Another announcement that was recently made is the SIEM connector service has not been added to Office 365 Advanced Security Management (E5).  SIEM stands for Security Information and Event Management.  Many customers who have complex security requirements require the ability to centralize monitoring of alerts and events to do monitoring.  With this solution, customers have the ability to analyze application logs/events and then do contextual analysis to their organization’s security using your own SIEM solution.

To deploy this solution, the organization is responsible for deploying a SIEM agent which will poll the Office 365 REST APIs.  All communications are over HTTPS/443.  Once data is retrieved from the SIEM agent, syslog messages will be sent to your local SIEM solution.

Announcement - https://blogs.office.com/2017/06/22/new-in-office-365-security-and-compliance-june-update/

SEIM Integration – with install instructions - https://support.office.com/en-us/article/SIEM-integration-with-Office-365-Advanced-Security-Management-dd6d2417-49c4-4de6-9294-67fdabbf8532?ui=en-US&rs=en-US&ad=US

Microsoft Stream has gone Generally Available

What do you need to know about this release?

Microsoft Stream is an enterprise video service that allows you to upload, share, manage and view videos.  Microsoft Stream can become the location to search and discover all video content for your organization.  Microsoft Stream can become a communication hub, training center, used to support business and drive better social communications.

Some major capabilities of the Microsoft Stream service are:

• Create and organize content with channels and groups.
• View trending videos.
• Personal watch list of videos.
• Ability to upload, manage and share videos from a personalized home page.
• Like and comments on videos.
• Automatic closed captioning.
• Face timeline (using facial recognition) for better navigation of videos.
• Auto generated speech to text transcript; which help make videos more discoverable.
  Clickable time codes in comments section, transcript or table of contents allowing for easy video navigation.
• Ability to watch video across devices.
• Ability to manage permissions to videos.
• Ability to define metadata for classification of videos.
• Microsoft Stream is still highly integrated with the Office 365 service.  It has deep integration with SharePoint Online, Microsoft Teams, Office 365 Groups and Yammer.

Office 365 Video - Microsoft Stream is a replacement solution for the Office 365 Video service.  Office 365 Video will still be around for a while so there is time to transition.

Video Storage - Microsoft Stream uses pooled storage model for the entire tenant.  Each tenant is allocated pooled storage and then additional pooled storage is provided based on the number of licensed users.  The concept is identical to SharePoint Online storage.  Each tenant is provided 500 GB of video storage plus an additional 500 MB of storage per user.  If you need more storage, you can purchase more storage in 500 GB increments.

Azure Media Services - Azure Media Services provides the power behind Microsoft Stream.  You do not need to purchase any additional Azure Media Services.  All you need to do is acquire Microsoft Stream.

Microsoft Stream Plans - There are two plans for Microsoft Stream.  The big different between Plan 1 and Plan 2, is Plan 2 includes: A) Deep search based speech to text metadata and B) Interact with video content using face detection and audio transcripts. 
Office 365 Plans - You can acquire Microsoft Stream in several ways as it is part of Office 365 plans or as a standalone service.  If you have an Office 365 Suite (E1 or higher) you have access for Microsoft Stream.  You also have the ability to purchase Microsoft Stream as an independent service.   If you have an Office 365 E1 or E3 Suite, you will get the Microsoft Stream Plan 1.  To get Microsoft Stream Plan 2, you have two options: purchase Microsoft Stream Plan 2 as an add-on or purchase Office 365 E5 suite.

Public Announcement - https://blogs.office.com/2017/06/20/microsoft-stream-now-available-worldwide-new-intelligent-features-take-enterprise-video-to-new-heights/

Microsoft Stream Document – all of the documentation associated to this service is located here - https://stream.microsoft.com/en-us/documentation/stream-overview/ 

Microsoft Stream Site - https://stream.microsoft.com/en-us/

Microsoft Stream Licensing - https://stream.microsoft.com/en-us/pricing/ and https://stream.microsoft.com/en-us/documentation/stream-license-overview/ 

Skype for Business Online Ports Reduced

Back in April 2017, I wrote about how Skype for Business Online IP address ranges and ports were planning on being reduced (http://www.astaticstate.com/2017/04/skype-for-business-online-ranges-and.html).

The most recent announcement is that this has been completed.

Recent Announcement - https://techcommunity.microsoft.com/t5/Skype-for-Business-Blog/Simplified-port-requirements-for-Skype-for-Business-Online/ba-p/77094

This is a very big change which I know many Skype for Business Online customers will be happy to hear about.  The big change is that UDP/TCP 50,000-59,999 port ranges are now options for Skype for Business Online.  The reason for the change is that given the quality of service that that can be delivered out of Office 365 and the performance Microsoft Network does not require these ports.  Some other facts are:

• Must be on Skype for Business Online client.
• UDP/TCP 50,000-59,999 is being marked as optional for Skype for Business Online.
• If your organization is not blocking them today, still recommended that you keep them open.
• This change is only for users in Skype for Business Online (in Office 365).  If you have a hybrid environment these ports are still required.

I highly recommend that you review the details of the announcement.

Here is a reference to all Office 365 URLs and IP address ranges - https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US&fromAR=1

Office 365 and Azure EMS Overlap

I decided to create a simple cheat sheet for folks to help you understand how Office 365 suites such as E3 and E5 relate to Azure Enterprise Security + Mobile Suite (EMS).  There is a lot of cross-over and relationship between these capabilities.

I will assume in this discussion we are an Office 365 customer trying to understand how does EMS overlap and extend Office 365.

EMS Suites

First, we must first understand what is in the EMS Suites.  There are two EMS Suites E3 and E5.  Here is an overview site - https://www.microsoft.com/en-us/cloud-platform/enterprise-mobility-security-pricing

EMS E3 is made up of:

• Azure Active Directory Premium P1 - Designed to empower organizations with more demanding identity and access management needs, Azure Active Directory Premium edition provides feature-rich enterprise-level identity management capabilities and enables hybrid users to seamlessly access on-premises and cloud capabilities. This edition includes solutions for the information worker and identity administrators in hybrid environments across application access, self-service identity and access management (IAM), and security in the cloud.  Solutions available are: Secure single sign-on to cloud and on-premises apps, Multi-factor authentication, Conditional access and Advanced security reporting.
• Azure Information Protection Premium P1 - Control and help secure email, documents, and sensitive data that are shared outside the customer walls with Azure Information Protection Premium (formerly known as Active Directory Rights Management Service (AD RMS)). From easy classification to embedded labels and permissions, enhance data protection at all times with Azure Information Protection—no matter where it’s stored or who it’s shared with.  Solution provides encryption for all files and storage locations and cloud-based file tracking.
• Microsoft Intune - Microsoft Intune provides mobile device management, mobile application management, and PC management capabilities from the cloud. Using Intune, customer can provide personnel access to corporate applications, data, and resources from virtually anywhere on almost any device, while helping to keep customer information secure.  With the increasing volume and diversity of both ‘bring your own device’ (BYOD) and corporate-owned devices being used in organizations today, a growing challenge for IT departments is keeping corporate information secure. Microsoft mobile application management (MAM) and mobile device management (MDM) solutions help minimize this complexity by offering management capabilities both on-premises and in the cloud, all from a single console.  Solution provides mobile device and app management to protect corporate apps and data on any device.
• Microsoft Advanced Threat Analytics (ATA) - Microsoft Advanced Threat Analytics (ATA) protect customer from advanced, persistent cyber threats.  From detecting known malicious attacks to uncovering abnormal activity with machine learning and behavioral analytics, identify advanced persistent threats to customer quickly and act swiftly with Microsoft Advanced Threat Analytics.  Solution provides protection from advanced targeted attacks by applying user and entity behavior analytics.

EMS E5 is made up of:

• Azure Active Directory Premium P2 - Builds off Azure Active Directory Premium P1, enhanced with advanced identity protection and privileged identity management capabilities.  Solution includes risk-based conditional access and privileged identity management.
• Azure Information Protection Premium P2 - Builds off Azure Information Protection Premium P1 providing intelligent classification policies to classify and label data at time of creation or modification based on source, context, and content. Classification with Azure Information Protection is fully automatic, driven by users or based on recommendation.  Additionally, this services provides Hold Your Own Key (HYOK) that spans Azure RMS and Active Directory RMS for highly regulated scenarios.
• Microsoft Cloud App Security - Microsoft Cloud App Security provides enterprise-grade security for customer cloud applications.  Whether or not you're in the cloud, customer personnel are. Bring the security of on-premises systems to cloud applications—both approved and unapproved—for deeper visibility, comprehensive controls, and enhanced protection against cloud security issues.  Solution provides enterprise-grade visibility, control, and protection for cloud applications.

How does this compare with Office 365 solutions?
There is overlap with Office 365 solutions.  There are tons of good reference articles that show you exactly where deltas are.

Azure AD Overlap
As you know when you have an Office 365 instance, Azure AD is used underneath the hood.

Azure AD Comparison Table - https://www.microsoft.com/en-us/cloud-platform/azure-active-directory-features.  This table shows you the difference Office 365 and the features and capabilities you get with Azure AD Premium Plans 1 and 2.

Azure Information Protection / Rights Management Overlap
If you are an Office 365 E3 customer, you may know you get some Office 365 Rights Management.  However Azure Information Protection Plans 1 and 2 provided extended capabilities.

Information Rights Management Comparison Table - https://www.microsoft.com/en-us/cloud-platform/azure-information-protection-features - Shows you exactly what you get between the different plans.

Office 365 MDM / Microsoft Intune Overlap
Office 365 natively provides some MDM capabilities.  EMS Intune is the enterprise capability for MDM.  Office 365 MDM is just providing a subset of Intune for Office 365 only.

Office 365 MDM and Microsoft Intune comparison table is located here - https://support.office.com/en-us/article/Choose-between-MDM-for-Office-365-and-Microsoft-Intune-c93d9ab9-efb2-4349-9b93-30c30562ee22.

Microsoft ATA and Office 365 Advanced Security Management Overlap
Office 365 Advanced Security Management (ASM) is part of the Office 365 E5 Suite.  Microsoft ATA is part of the Azure EMS E3 Suite.

Unfortunately, there is not a good comparison table like with the other service offerings previously discussed, yet there are some good references.  Just like previously discussed, Office 365 ASM is providing a subset of Microsoft ATA but Office 365 ASM is a subset of capability for Office 365 only.

Office 365 ASM - https://support.office.com/en-us/article/Get-started-with-Advanced-Security-Management-d9ee4d67-f2b3-42b4-9c9e-c4529904990a?ui=en-US&rs=en-US&ad=US – This is a good reference article that describes the types of alerts that you can sign-up for, monitor cloud app usage and set-up SIEM integration for logging.

Azure Threat Analytics (ATA) is a broader approach that extends to on-premises.  Here is the top-level article on it - https://docs.microsoft.com/en-us/advanced-threat-analytics/what-is-ata.

OneDrive On-Demand

OneDrive On-Demand
There was a recent announcement of some new features coming for OneDrive for Business and SharePoint Online that I am very excited to see.  The new feature is called OneDrive On-Demand.

The OneDrive On-Demand capability allows you to access files without having to download them and use storage locally on your device.  Effectively, File Explorer has connectivity to data in the OneDrive for Business cloud just like it has with data on network attached storage.  When you select a file, that file will be synced locally and then opened in the app.

Additionally, there are reasons why some folders and files you will always want to ensure are available locally.  With this new capability, you have the ability to designate which files and folders you want to have as always available locally.

Benefits
A major benefit is not having to use local device storage.  This becomes important because storage available on a per user basis with OneDrive for Business in cloud can be more than what is available on the device itself.  So, if a user has 1TB of data of OneDrive Storage in the cloud, and they

Another benefit is more efficiency in data synchronization to a corporate network.  When lots of user sync a SharePoint Online site, all the files are synced to that device.  Additionally, when a file is updated, that update is pushed to all devices.  Now files are only synced at the user’s designation if the file must be available locally all the time.  This will reduce the amount of data being pushed.

Other Notes
OneDrive On-Demand is available as part of the Windows 10 Fall Creators Update.
This feature will work with OneDrive for Business, OneDrive (personal) and SharePoint Online.

What about Mobile?
Mobile Apps for OneDrive have always been on-demand.  A new solution is being introduced into the iOS and Android Apps which allow users to designate folders as “offline”.  This allows you to access those files while you have no internet connectivity.  Now we have some feature parity across devices.

References
https://blogs.office.com/2017/05/11/introducing-onedrive-files-on-demand-and-additional-features-making-it-easier-to-access-and-share-files/
https://blogs.office.com/2017/05/16/new-sharepoint-and-onedrive-capabilities-accelerate-your-digital-transformation/

Office 365 and Azure Government Support DFARS

Azure Government services is not able to support DoD contractors and the Defense Industrial Base (DIB) by supporting for Defense Federal Acquisition Regulation Supplement (DFARS) requirements. Office 365 US Government Defense is also able to accept the flow down terms based on FedRamp+ requirements (as defined in the DoD Cloud Computing Security Requirements Guide (SRG)).  This allows DoD's mission partners to host Covered Defense Information (CDI) in Microsoft's secure, compliant cloud dedicated to US government workloads.

A lot of work had been completed by Microsoft and demonstrates a commitment to satisfy the stringent requirements for a major market segment to use compliant commercial cloud solutions.

For more information, please read this public announcement - https://blogs.msdn.microsoft.com/azuregov/2017/05/11/microsoft-azure-government-expands-support-for-defense-industrial-base-and-defense-contractors-announcing-support-for-dfars-requirements/