Microsoft 365 Multi-tenant organizations (MTO)

Probably one of the more anticipated feature releases I have been talking about has gone GA.  Multi-tenant organizations (MTO is allows tenants to have richer user and management collaboration experiences across tenants.  It is commonplace that organizations require multiple tenants, for instance merger, acquisition, divestitures, regulatory, etc.  In these cases, organizations are seeking to allow their users to have streamlined user experiences across these tenants plus organizations need streamlined management experiences too.

Some features that you will have access to are:

• Cross tenant people search
• Streamlined workforce collaboration (default access to content, bypass meeting lobby, etc.)
• Cross tenant communications
• Manage incidents and tickets centrally
• Centrally manage tenant configurations

https://techcommunity.microsoft.com/t5/microsoft-365-blog/multi-tenant-organization-capabilities-now-available-in/ba-p/4122812

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/collaborate-across-m365-tenants-with-entra-id-multi-tenant/ba-p/4120309

Microsoft 365 GCCH FedRAMP and DFAR Compliance

Good updated articles on Microsoft 365 GCCH and how to meet DFAR requirements.

https://techcommunity.microsoft.com/t5/public-sector-blog/support-for-dfars-in-microsoft-365-government-gcc-high/ba-p/4076348

https://techcommunity.microsoft.com/t5/public-sector-blog/support-for-fedramp-in-microsoft-365-government-gcc-high/ba-p/4112262

Additional Logs to be made available

For the past few months, CISA has been working closely with the Microsoft team to identify solutions that will help US Government organizations and their partners to protect themselves from evolving threats.  In recent announcement is a result of this teamwork.  In the coming months there will be expanded access to additional security logs at no additional cost.  These logs are very useful for forensics and incident response teams examining potential intrusions.  Please read the article for additional information.

https://www.microsoft.com/en-us/security/blog/2023/07/19/expanding-cloud-logging-to-give-customers-deeper-security-visibility/

User Data Migration Across Tenants

Cross tenant data migration is capability that comes up a lot.  Customer tenants have to be merged or divested commonly through business acquisitions.  Tenant to tenant migration capabilities are now in full GA in our commercial cloud.  This enables organizations to move a user’s mailbox and OneDrive data.  

Note that this is for user data, not organizational data.  For instance SharePoint Online sites and Microsoft Teams data is not in scope at this time.  

Additionally, these features will be introduced to the GCC, GCCH and DoD clouds soon, and they are currently available in Preview.  

Finally, the capabilities only work within a cloud and are not intended to be supported across clouds.

Reference: https://techcommunity.microsoft.com/t5/exchange-team-blog/cross-tenant-user-data-migration-is-now-generally-available/ba-p/3667700

Microsoft 365 Account Switching

Coming in Summer of 2022, Microsoft 365 web apps will support the ability to sign into multiple accounts in a single web browser session without requiring you to do workarounds like sign in/out, private browser sessions, alternate devices, etc.  Super excited to see this coming because I have had to these same workarounds over the years.

Reference: https://techcommunity.microsoft.com/t5/microsoft-365-blog/announcing-account-switching-for-microsoft-365-web-apps/ba-p/3290787

Microsoft 365 Adaptive Policy Scopes for Retention

There is a new feature called Adaptive Policy Scopes is coming available soon that allows administrators the ability to apply retention policies and labels by user, site and groups.  This will allow you to create more granular rules that appropriate to for specific scenarios.  For instance, you may have exception policy where a retention policy may not apply or could be different based on set of criteria.

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/announcing-adaptive-policy-scopes-for-microsoft-365-records/ba-p/2857532 

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-adaptive-policy-scopes-to-apply-m365-retention-to-shared/ba-p/3053641

https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-settings?view=o365-worldwide#configuration-information-for-adaptive-scopes 

Microsoft 365 Lighthouse Public Preview

I am very excited to see the new Public Preview of Microsoft 365 Lighthouse.  Organizations and managed service providers have numerous tenants they manage with the goal of driving consistent cyber security posture across those tenants.  Azure Lighthouse has been in market for awhile now, and organizations can use Microsoft 365 Lighthouse to achieve similar outcomes.  Right now this solution is only available for the Small and Medium Business (SMB) Market.

https://techcommunity.microsoft.com/t5/small-and-medium-business-blog/microsoft-365-lighthouse-is-now-in-public-preview/ba-p/2540515

https://www.microsoft.com/en-us/microsoft-365/blog/2021/07/14/from-collaborative-apps-in-microsoft-teams-to-cloud-pc-heres-whats-new-in-microsoft-365-at-inspire/?ocid=usoc_LINKEDIN_M365_spl100002353594927

Microsoft 365 Privacy Management (Preview)

There is a new solution called Microsoft 365 Privacy Management that has been released in preview which enables tenant administrators to safeguard personal data. You have the ability to identify privacy risk and mitigate it through automated policies. Policies can monitor data transfers, data overexposure and data minimization (identified unused data). Plus M365 Privacy Management also provides you capabilities to support subject rights requests which helps you to search for and produce reports about data stored in Exchange Online, SharePoint Online, OnDrive and Teams.

Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/privacy-management?view=o365-worldwide

New Microsoft Information Protection features being released

There are many organizations that put a high emphasis on control of their critical business data.  These organizations should be considering how to leverage Microsoft Information Protection to its fullest potential.  There are several new features that are now Generally Available (GA) or being released in Public Preview.

• Mandatory Labeling is now GA.  This is a pretty big deal.  It requires labels to always be applied to all data in Office 365.  The labels can be used to enforce policy on files.
• New improvements for Exchange Online Auto-Labeling.
• Public Preview for Co-Authoring files with Information Protection encryption on it.  I am extremely happy to see this because I always have felt this was a limitation for collaboration.
• Public Preview of new AIP audit log explorer.  
• DLP Alert Dashboard is now GA.  Exchange Online, SharePoint Online, OneDrive, Teams, etc. all have different DLP configurations and this single dashboard shows you a consolidated view of all DLP alerts.
• Track and Revoke is now GA.  I really like see this.  This allows you to revoke access to sensitive documents.  There are tons of scenarios (good and bad reasons), why you may need to revoke access to a file immediately.

Reference: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/what-s-new-in-information-protection/ba-p/2483154 

Microsoft Viva

I think everyone was surprised by the recent announcement of the new Viva capability.  The announcements state “Today we are announcing Microsoft Viva, the first Employee Experience Platform (EXP) built for the digital era. Viva brings together communications, knowledge, learning, resources, and insights into an integrated employee experience that builds on Microsoft Teams to empower people to be their best, from anywhere.”

When I started to dig into what Viva really is, in Office 365 terms I was super impressed with the vision.  When Microsoft Teams went to market a few years ago, it was solution that brought together many users experiences inside of Office 365.  Previously SharePoint Online, OneDrive for Business and Skype for Business Online were horizonal solutions with level of integration, yet Microsoft Teams brought them together into a single immersive user experience.  I see the same thing with Viva.

Viva is bringing together Microsoft Workplace Analytics and Microsoft MyAnalytics into an immersive experience within Microsoft Teams.  Viva Insights is the next revolution of these capabilities which I would say are being highly under utilized by customers and users.  This brings these capabilities to the forefront.

Additionally solutions like Microsoft AI is being used to create a solution called Viva Topics which will help users share knowledge and connect people with each other in their everyday jobs.

All of these capabilities will be critical in supporting workforces that are transitioning out of offices and into remote work scenarios.  I see tons of potential, and cannot wait to watch this evolve.

References:

https://www.microsoft.com/en-us/microsoft-viva/overview

https://www.microsoft.com/en-us/microsoft-365/blog/2021/02/04/microsoft-viva-empowering-every-employee-for-the-new-digital-age/

https://techcommunity.microsoft.com/t5/microsoft-teams-blog/introducing-microsoft-viva-the-employee-experience-platform-in/ba-p/2111481

Microsoft Search and Exchange Online

This week, I had to go into Microsoft Outlook to find an old HR benefit email I had gotten some time ago.  This case, as Microsoft employee get a benefit of free Xbox Game Pass subscription.  I had some old emails on it, and wanted to find the link.  When I found the old emails, none of the links worked because there old.

Then all of a sudden a message came up saying, “Link from your organization”, here is the correct link.  I clicked it, it took me straight to the internal benefit site.  This was awesome and I was totally surprised I did not even know about this feature.

I then did some additional investigation.  I put in some other Microsoft corporate terms into Outlook search and got back tons of other result “Link from your organization” section which gave me links within the Microsoft intranet to webpages that had the information for me.

Well, there was a simple reason for this.  Many folks may not have seen this but Outlook and Office are now integrated with Microsoft Search.  This all started about a year ago.  Basically, whenever you put in a search in Outlook, there is a search in your email however additional resources available to you will be searched.  If you organization has set up Microsoft Search appropriately, you will get items in your mailbox plus items across the organization that you have access to. 

Resources

Microsoft Search | Microsoft Docs

Search in Outlook puts your results on top - Microsoft Tech Community

Enhanced performance, designed for simplicity – the new Outlook for Mac - Microsoft Tech Community

Microsoft Search—cohesive search that intelligently helps you find, discover, command, and navigate - Microsoft 365 Blog

Important Office 365 Security Recommendations

To mitigate threats consistent with the recent security incidents, here are some really good recommendations organizations should consider with regards to Office 365.  Go here - Protecting Microsoft 365 from on-premises attacks - Microsoft Tech Community

There are strongly recommended configurations that customers should be doing moving forward.

Teams Breakout Rooms GA

 This week Teams made a GA release of a new feature called Breakout Rooms.

This new capability gives meeting organizers the ability to create up to 50 breakout rooms.  Meeting participants then transition to the breakout rooms and participants can move between the breakout rooms.  Announcements can be made to each breakout room, and participants can be brought back to the main room.

I see some really interesting tele-work and tele-education scenarios where Teams Breakout Rooms can really help out.  

Announcement

Breakout rooms generally available today in Microsoft Teams - Microsoft Tech Community

Office 365 Secure Score and Azure Sentinel

This is actually really neat.  A new feature of Office 365 Secure Score was released as a Preview release that will allow customer to continuously sending Secure Score reporting to Azure Sentinel (or other third party SIEM).  Tons of customers are looking for way to “monitor” their tenant configuration and react to changes that they view as risky for their organization.

See announcement: Continuously Export Secure Score for Over-Time Tracking and Reporting (Preview) - Microsoft Tech Community

What is Office 365 Secure Score: https://docs.microsoft.com/en-us/microsoft-365/security/mtp/microsoft-secure-score

What is Azure Sentinel: Azure Sentinel – Cloud-native SIEM | Microsoft Azure

Office 365 Access vs Refresh Tokens

I had to provide a short write-up to some folks to help them with the understanding of how Office 365 and Sessions Tokens worked.  Hope this helps.

Access Token Definition

Clients use access tokens to access a protected resource. An access token can be used only for a specific combination of user, client, and resource. Access tokens cannot be revoked and are valid until their expiry. A malicious actor that has obtained an access token can use it for extent of its lifetime. Adjusting the lifetime of an access token is a trade-off between improving system performance and increasing the amount of time that the client retains access after the user’s account is disabled. Improved system performance is achieved by reducing the number of times a client needs to acquire a fresh access token. The default is 1 hour - after 1 hour, the client must use the refresh token to (usually silently) acquire a new refresh token and access token.

Refresh Token Definition

When a client acquires an access token to access a protected resource, the client also receives a refresh token. The refresh token is used to obtain new access/refresh token pairs when the current access token expires. A refresh token is bound to a combination of user and client. A refresh token can be revoked at any time, and the token's validity is checked every time the token is used. Refresh tokens are reissued every time they are  used to fetch new access tokens.

Access Tokens

• Purpose: Give users access to resources (i.e. Exchange Online, SharePoint Online, Teams).
• Duration: Expire after 1 hour.
• Customer Revoke: Access Tokens cannot be revoked once it has been created.

Refresh Tokens

• Purpose: Alleviate the end user from having to continually input in their credentials and have no context to resources the user is accessing.
• Duration: Expire after 90 days.
• Customer Revoke: Refresh Tokens can be revoked at any time.

Commonality

• Requesting New Token: Whenever a new Access Token is requested, a new Refresh token is also provided to the requesting client (re-starting the 90 day count).
• Evaluation of Conditions: Every time a client presents a Refresh Token to AAD to obtain a new Access Token to resources, AAD Conditional Access will revaluate all conditions defined for the tenant and then provide the client new Refresh and Access Tokens to the client.

Office 365 Compliance for Commercial, GCC, GCCH and DoD

I am commonly asked, what is Microsoft’s accreditation stance for Office 365 Commercial, GCC, GCC High and DoD for years.  Lately I get tons of questions bubbling up to me from System Integrators who work with the US Government.  In many cases they are seeking information on ITAR, CMMS, NIST 800-171, DFARs, etc, etc.

My colleague wrote this blog entry and I always suggest they read it.  Seems to always clear out the questions.

https://techcommunity.microsoft.com/t5/public-sector-blog/understanding-compliance-between-microsoft-365-commercial-gcc/ba-p/718445

Skype for Business Online End of Life Coming

Remember Skype for Business Online will be reaching end of life July 31, 2021.  This was announced over two years ago and organizations should be making every best attempt they can at transitioning over to Microsoft Teams.

Reference

https://techcommunity.microsoft.com/t5/microsoft-teams-blog/skype-for-business-online-will-retire-in-12-months-plan-for-a/ba-p/1554531

Office 365 Split Tunneling

With COVID-19 many organizations are dealing VPNs that are stressed and saturated.  One solution many organizations have been considering is using Split-tunneling for Office 365 traffic.  If you have not looked at it, please do.  There are several good articles that you should read up on.

https://docs.microsoft.com/en-us/office365/enterprise/office-365-vpn-split-tunnel

Office 365 Records Management

A few days ago, it was announced that a new Records Management solutions went GA for Office 365.  I was super excited to see this because I have done a lot of Records Management work in the early days of SharePoint 2007 and 2010.  Back then, the SharePoint Server Records Management records collection was pretty basic.  However after reading what we are now doing with Records Management with Office 365, I can see some huge steps forward.  This is much more sophisticated than in-place records management using the content organizer.

Here are the key takeaways I had.

• New and advanced capabilities to classify, retain and dispose data.
• Advancements leverage cloud machine learning capabilities to identity and classify records.
• New capability for event based retention policies.
• Works for SPO and EXO plus documents stored in Teams (which uses SPO).
• Requires you to purchase of E5 because it is leveraging advanced cloud features inside of data governance, labeling, etc.  Minimally you need the Office 365 Advanced Compliance SKU.  Apparently not everyone in the tenant needs to be licensed, only users with edit access where records management features are used must be licensed.

Announcement - https://techcommunity.microsoft.com/t5/security-privacy-and-compliance/announcing-general-availability-of-records-management/ba-p/1347879
Announcement - https://www.microsoft.com/security/blog/?p=90980
Service Description - https://docs.microsoft.com/en-us/microsoft-365/compliance/records-management?view=o365-worldwide
Licensing - https://docs.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#records-management

Office 365 and Azure Sentinel

I have been working with some customers on how to do analysis on their Office 365 audit logs.  Here are some quick things to think about.

Here is a reference to the Office 365 audit logs.  Remember, Office 365 logs are generally only stored for 90 days.
https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide

You can additionally purchase Advanced Audit logging, which gives you the ability to retina logs for a year.
https://docs.microsoft.com/en-us/microsoft-365/compliance/advanced-audit?view=o365-worldwide

The Office 365 Management API provides rest services you can use to download data.
https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-apis-overview

It is possible to sent the Office 365 Management API logs to a SIEM solution.  This allows you to retain the logs for longer.
https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference

Here is the schema to all the data in the Office 365 Management API.
https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema

Here is information on Azure AD Audit logs.
https://docs.microsoft.com/en-us/azure/security/fundamentals/log-audit

Also there is Azure Sentinel; it is a SEIM solution in the cloud.
https://docs.microsoft.com/en-us/azure/sentinel/overview

Here is how to connect Office 365 to Sentinel.
https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365

Here is how to connect Azure AD to Sentinel.
https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-activity