Sunday, February 11, 2018

Office 365 Customer Key

There have been many questions over the years many organizations have asked, is it possible for customers to apply their own encryption keys to data at rest stored in Office 365.  Office 365 already utilizes several encryption at rest solutions for all data in Office 365, but sometimes customers have compliance regulations that they must support so that they can have control of an encryption key to their data in Office 365.  Customer Key for Office 365 can be used to satisfy those requirements.

There are several considerations you should think about before using this solution.  Read the FAQs on this solution.  Key management becomes critical and there is a recovery key process.

Finally, this solution will provide encryption at the root and its intended purpose is for customers to use this key as a way to protect data if the customer ever intends to leave the Office 365 service.  Customer keys can be destroyed when leaving the Office 365 service ensuring that no one has access to data will the data is going through it final deletion stages.  This solution is not intended to change the dynamics of Online Service Terms for third-party data requests to Microsoft nor does it change access rules for customer data for Microsoft personnel who are supporting the service.  There are other capabilities like Customer Lockbox which can mitigate a customer’s concern for how Microsoft personnel access customer data.

To get this solution, you must purchase Office 365 Advanced Compliance which is part of the E5 Suite, plus customers must purchase Azure Key Vault licenses.




Please read all these references.
Customer Key General Availability Announcement - https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/GA-of-Customer-Key-in-Office-365-at-Ignite/ba-p/115134

Announcement - https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Bringing-deeper-integration-and-new-capabilities-to-Office-365/ba-p/109409
https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Bringing-deeper-integration-and-new-capabilities-to-Office-365/ba-p/109409

Presentation from Ignite - https://myignite.microsoft.com/sessions/53748?source=sessions

Video of How it works with SPO - https://youtu.be/y-BSmEhdk7c?t=8m18s

Customer Key FAQs (highly recommend reading) - https://support.office.com/en-us/article/Customer-Key-for-Office-365-FAQ-41ae293a-bd5c-4083-acd8-e1a2b4329da6

Overview and Configuration Instructions - https://support.office.com/en-us/article/Controlling-your-data-in-Office-365-using-Customer-Key-f2cd475a-e592-46cf-80a3-1bfb0fa17697

Azure Key Vault Reference - https://docs.microsoft.com/en-us/azure/key-vault/
https://docs.microsoft.com/en-us/azure/key-vault/

Office 365 Threat Intelligence Attack Simulator

Here is an interesting feature that I just learned about.  Office 365 Threat Intelligence has new feature being introduced called Attack Simulator.  This solution will allow administrators the ability to simulate different threat scenarios to assess how their end users would behave when a real attack would occur.  This could result in the admins of the Office 365 tenant to do some additional configurations to the service. 



Announcement - https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Bringing-deeper-integration-and-new-capabilities-to-Office-365/ba-p/109409

What is Office 365 Threat Intelligence - https://support.office.com/en-us/article/Office-365-Threat-Intelligence-32405da5-bee1-4a4b-82e5-8399df94c512

As of the time of this writing, this feature is marked as under development in the Office 365 roadmap - https://products.office.com/en-US/business/office-365-roadmap

Advanced eDiscovery for Non-Office 365 Data

I have been asked a few times, is it possible to use the Office 365 Advanced eDiscovery service to analyze data that is not in Office 365.

The answer is yes; it is possible.

In many cases, organizations have legacy file shares, archives, other cloud services that have relevant data that needs to be made part of an eDiscovery case.  With this solution you have the ability to import data for your case into an Azure container and then have Office 365 Advanced eDiscovery analyze this data.  To use this feature, you must have the Advanced eDiscovery licenses, plus it will require additional Azure storage purchase for storing all the additional non-Office 365 data that is imported.

One side note – This feature does not work with PST files.

Here is the article on how to do this - https://support.office.com/en-us/article/Import-non-Office-365-content-for-Advanced-eDiscovery-analysis-0ee60763-a30b-495b-8543-971c3384a801

Announcement about this feature was in Sept 2017 - https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Bringing-deeper-integration-and-new-capabilities-to-Office-365/ba-p/109409

Saturday, January 13, 2018

Office Customization Tool for Click-to-Run Preview

There was an interesting product release that has gone into preview that I felt was worth sharing.  For years, Office 365 ProPlus administrators had to use XML to write the configuration.xml file which is used with the Office Deployment tool to deploy Office 365 ProPlus client.

Microsoft has a new solution in Preview called the Office Customization Tool for Click-to-Run.  This tool provides a nice GUI that will generate your configuration.xml file for the Office Deployment Tool.  You can also input existing configuration.xml files to the tool to modify them.

Sometimes it is the small things that count, and doing this does not require you to memorize the configurations, and make mistakes within the XML file itself.

References
Announcement - https://techcommunity.microsoft.com/t5/Office-365-Blog/Customizing-Office-365-ProPlus-using-the-Office-Customization/bc-p/143275#M334

Office 365 Deployment Tool Reference - https://docs.microsoft.com/en-us/deployoffice/overview-of-the-office-2016-deployment-tool

Office Customization Tool for Click-to-Run (Preview) - https://config.office.com/

Tuesday, December 19, 2017

Microsoft Graph Reporting APIs are now Generally Available

Microsoft Graph Reporting APIs are now Generally Available.  These reporting APIs allow organizations to get the data feeds that are used to populate reports in the Office 365 Admin Center, and use that data to create custom usage reports.

Note this new capability replaces the old Office 365 Reporting Web Service feeds; these old APIs will go out of support on January 29, 2018.  There is a reference in the announcement for where the feeds for the old reporting web service are now located within the Microsoft Graph.

Public Announcement - https://techcommunity.microsoft.com/t5/Office-365-Blog/Announcing-the-General-Availability-of-Microsoft-Graph-reporting/ba-p/137838

Technical Reference for Graph Usage Reports - https://developer.microsoft.com/en-us/graph/docs/api-reference/beta/resources/report

Thursday, November 23, 2017

New Microsoft Cloud Compliance Manager

I would like to draw your attention to the announcement about the new Compliance Manager Preview which as recently announced.

Announcement - https://blogs.office.com/en-us/2017/11/16/microsoft-365-helps-businesses-increase-trust-and-innovation-through-compliance-with-compliance-manager-preview/

The new Compliance Manager is a new cross-Microsoft Cloud services solution that is focused on helping customers protecting their data.  The Compliance Manager provides real-time risk assessment that reflects your entire compliance position for data protection.

The Compliance Manager gives you insight to controls you have implemented versus controls that Microsoft has implemented.  Over the years this is something that I have discussed extensively with Microsoft Office 365 cloud customers.  Microsoft does all the work on our side to implement all the required controls defined in such standards FedRAMP (NIST 800-53), FedRAMP+ (DoD CC SRG IL5), ISO, HIPPA, etc. yet there are still controls that are required customer implementation and configuration.  Microsoft gives you the features and capabilities to complete customer owned configurations, yet these configurations remain the responsibility of the customer.  This Compliance Manager will give you better insights, recommendations and guidance.



For more information about the Compliance Manager, please go here - https://servicetrust.microsoft.com/

How to Launch the Compliance Center - https://support.office.com/en-us/article/Go-to-the-Office-365-Security-Compliance-Center-7e696a40-b86b-4a20-afcc-559218b7b1b8
https://support.office.com/en-us/article/Go-to-the-Office-365-Security-Compliance-Center-7e696a40-b86b-4a20-afcc-559218b7b1b8

Office 365 Secure Score – Another good tool focused on Office 365 - https://support.office.com/en-us/article/Introducing-the-Office-365-Secure-Score-c9e7160f-2c34-4bd0-a548-5ddcc862eaef?ui=en-US&rs=en-US&ad=US

Going to Office 365 Product Group

I am super excited yet again.  When I started this blog a little over 10 years ago, I was a fledging developer goaled on writing efficient code and helping others out.  The blog evolved over the years as I transitioned into technical sales at Microsoft.  I was focused on Office 365 government technical sales for past 7 years.  As of last week, I joined the Microsoft Office 365 engineering / product group directly supporting our delivery of Office 365 GCC, GCC High and DoD cloud.  I did not think an opportunity would ever come to me like this.  I have to truly thank all the great people around me that gave me an opportunity to excel.   Will continue to contribute to this blog about interesting topics as they come up.