New M365 SharePoint and OneDrive storage pricing models

A new Microsoft 365 SharePoint and OneDrive storage solution is now available in public preview. This solution uses a pay-as-you-go pricing model, which is very compelling.

Many customers have faced SharePoint storage challenges for years. Enterprise customers, in particular, have accumulated significant amounts of data over time. Customers have implemented many creative solutions, including policies for deleting old data. They also have access to Microsoft 365 Archive, which can archive large volumes of data at a much lower price point. Removing data that users no longer actively use is beneficial because very old data can also affect how Microsoft 365 Copilot generates responses.

Until now, customers have had to purchase additional SharePoint storage in fixed amounts ahead of time. As a result, they have had to estimate data growth and maintain a storage buffer. Otherwise, whenever they exceed their allotted SharePoint storage quota, tenant administrators receive repeated reminders to purchase more storage.

With this new Microsoft 365 SharePoint storage pay-as-you-go framework, administrators can connect their tenant to a Microsoft Azure subscription, monitor consumption, and create storage budgets and thresholds. You no longer have to purchase storage upfront; you simply pay for what you use and can create policies to maintain cost control.

This new Microsoft 365 SharePoint storage pay-as-you-go framework can be used alongside Microsoft 365 Archive. When both are used, you can achieve a more cost-effective blended rate across active and archived data.

Additionally, this new solution extends to OneDrive for Business data. Administrators can set limits on how much additional storage an individual user can have beyond their entitlement, allowing storage to grow while placing a cap on that growth.

I know many customers will use this solution to help optimize their data costs.

 

Reference: https://techcommunity.microsoft.com/blog/microsoft_365blog/now-in-public-preview-microsoft-365-sharepoint-storage-and-onedrive-storage/4559758

New SharePoint AI Pages

AI is now being introduced into SharePoint Pages.  Now when you are authoring SharePoint pages, you will be given AI prompts to assist you with the authoring of content directly in SharePoint.  See here for more information.

Reference: https://techcommunity.microsoft.com/blog/spblog/sharepoint-pages-introducing-sections-with-ai/4422571

Introducing SharePoint Agents

SharePoint Agents are a new solution currently rolling out.  SharePoint Agents are scoped agents aligned to a site and all the documents and content within it.  On every SharePoint site, you will see a copilot icon with a default agent that has been created.  Now you can leverage agents on targeted content.

It is also very simple to create additional agents that are scope to a site, library, folder or even relevant files.  Creation of agents is integrated in with the SharePoint Ribbons and menu system.

Once a SharePoint agent is created, these agents can be shared via email, Microsoft Teams or referenced through Microsoft 365 Copilot Chat.  

SharePoint Agents are licensed through the Microsoft 365 Copilot License without any additional charges.  Users who do not have a Microsoft 365 Copilot License can still create and use SharePoint agents if they have Copilot Studio capacity packs or pay-as-you-go meters enabled.

References:

https://adoption.microsoft.com/en-us/sharepoint-agents/ 

https://techcommunity.microsoft.com/blog/microsoft365copilotblog/introducing-new-agents-in-microsoft-365/4296918

https://techcommunity.microsoft.com/blog/microsoft365copilotblog/ignite-2024-sharepoint-agents-now-in-general-availability/4298746 

SharePoint Syntex Document Translation

Microsoft has a feature that translates documents in SharePoint Online called “Document Translation”.  Today, Document Translation is under the SharePoint Syntex brand, and at some point in the future this will move under a new brand called SharePoint Premium (announcement Nov 2023).  This was supposed to happen in CY24, but this has not occurred yet so for the time being will continue to refer to SharePoint Syntex brand.  

Microsoft Syntex offers a robust document translation service that allows you to create translated copies of files while preserving their original format and structure.  Some of the key features are:

• Supported Files: It can translate .csv, .docx, .html, .markdown, .pdf, .pptx, .txt, and .xlsx. For legacy file types like .doc, .rtf, .xls, .ods, .ppt, and .odp, the translated copy is created in the modern equivalent format.
• Language and Dialects: Will translate tons of languages, see references below.
• File Size Limits: Maximum of 40 MB file.
• SharePoint and OneDrive Integration: You can translate files directly in document libraries.  It is literally as simple as finding a document, going to the menu bar, and then selecting what language you want the file translated to.
• Automation: It possible to create rules that will automatically translate a document when a file is added or when a value changes in a column.
• Video: Syntex also supports translating video transcripts and closed captioning files. 

Microsoft Syntex Document Translation Services is part of the new pay-as-you-go model.  With pay-as-you-go, you can use Syntex without any license commitment or upfront purchasing. Any user in your organization can use Syntex services and only pay if and when services are used.  Pay-as-you-go requires an Azure subscription.

References

https://learn.microsoft.com/en-us/microsoft-365/syntex/translation-overview

https://learn.microsoft.com/en-us/microsoft-365/syntex/syntex-overview

https://techcommunity.microsoft.com/blog/sharepoint_premium_blog/introducing-sharepoint-premium-%E2%80%93-the-future-of-ai-powered-content-management-and/3981076

https://learn.microsoft.com/en-us/azure/ai-services/translator/language-support?source=recommendations#translation

https://learn.microsoft.com/en-us/microsoft-365/syntex/syntex-licensing

https://learn.microsoft.com/en-us/microsoft-365/syntex/translation

M365 Copilot with SharePoint Pages

Copilot in SharePoint has now been delivered.  You probably have already been using Microsoft Copilot in M365 Apps like Word, Outlook, PowerPoint, etc.  You can now leverage several of the came capabilities when authoring content in your SharePoint Pages.

Some of the key features are:

• Auto Rewrite: Which will rewrite content making it cleaner and professional for broad consumption.
• Change Length: Copilot will rewrite content so that you can fit it in pages that may have limited space.
• Change Tone: Copilot will modify your content to better deliver as causal, professional, enthusiastic, etc.

This feature started rolling out in WW in Sept 2024.  This does require a M365 Copilot license to leverage.

Reference

https://techcommunity.microsoft.com/blog/spblog/rewrite-with-copilot-in-sharepoint-tailor-your-content-with-ease/4319824

Microsoft 365 Backup GA

A new solution called Microsoft 365 Backup and Backup Storage recently went GA.

This is a really cool new capacity that assists organizations in protecting themselves from disaster recovery and security scenarios when you need to recover your data.  Microsoft 365 has tons of data protection services built natively into the service.  Microsoft 365 Backup helps protect you against ransomware attacks and gives you the ability to have self-service recovery capabilities.

Microsoft 365 Backup is currently scoped to OneDrive, SharePoint and Exchange data.  With Microsoft 365 Backup you have the ability to mass backups and recovery points for your most critical business data.

For more information, read here: https://techcommunity.microsoft.com/t5/microsoft-365-backup-blog/microsoft-announces-general-availability-of-microsoft-365-backup/ba-p/4205300

New SharePoint Online Coauthoring Web Pages

Pretty cool, SharePoint Online is now rolling out the ability to do coauthoring of SharePoint Pages.  This allows multiple users to do real-time editing of web pages, web parts, etc.

https://techcommunity.microsoft.com/t5/microsoft-sharepoint-blog/introducing-coauthoring-for-sharepoint-pages-and-news/ba-p/4192161

Cross-Cloud AAD B2B Public Preview

Public Preview for cross-cloud B2B collaboration is now available.  This will enable guest users can access your resources (such as LOB/SaaS apps), SharePoint sites, and OneDrive files.  

Reference: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/build-2022-new-frontier-of-collaboration-with-external/ba-p/3407091

Terms of Use with Office 365

There is a new capability in AAD that is available Terms of Use which a lot of Office 365 customers may want to utilize.

An organization will want users to accept a Terms of Use agreement to access their environment.  The Terms of Use solution can:

• Required all users accept a terms of use agreement to access Office 365 services.
• There is a new feature that can be used for B2B scenarios for such services SharePoint Online and Microsoft Teams.  If you invite in an external user that is on AAD, that external user will be required to agree to a Terms of Use.

This is awesome because I find tons of customers who want this type of capability.  Here are some other features that are part of this.

• Can require users sign it once or every time they access.
• Can associate a Terms of Use document that is organization specific for users to review.
• Require users to expand and scroll through entire terms of use before accepting.
• Can expire the Terms of Use agreement after a specific amount of days or associated a frequency for when they must accept the Terms of use.
• Can enforce Conditional Access policies against the Terms of Use policy.
• Access to reports of who accepted and declined a Terms of Use.
• Works for browsers and mobile device scenarios.

Here are some detailed articles about this capability.

https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Updates-to-Azure-AD-Terms-of-Use-functionality-within/ba-p/294822

https://docs.microsoft.com/en-us/azure/active-directory/governance/active-directory-tou

Office 365 Data Delete

I receive lots of questions about how to remove data from Office 365.  There can be lots of business scenarios: for instance, someone leaves the organization and you no longer want to retain data another instance is critical business or mission data needs to be deleted.  If you are looking to build procedures for data deletion, recommend that you review these:

Deleting Personal Data - https://docs.microsoft.com/en-us/microsoft-365/compliance/gdpr-dsr-office365#deleting-personal-data

eDiscovery solution series: Data spillage scenario - Search and purge - https://docs.microsoft.com/en-us/office365/securitycompliance/data-spillage-scenariosearch-and-purge?redirectSourcePath=%252fen-us%252farticle%252fediscovery-solution-series-data-spillage-scenario-search-and-purge-d945f7dd-f62f-4ca7-b3e7-469824cfd493

SharePoint Online Storage Increase!

Major announcement was made in late April that SharePoint Online storage allocation is increasing significantly.

Previously SharePoint Online storage was 1 TB plus .5 GB per user license purchased.

Now SharePoint Online storage is 1 TB plus 10 GB per user license purchased.

So, if you have 100,000 users in your organization, you have 1001 TBs of storage.  Wow!

This is usage and it being driven by the usage and consumption of file storage in SharePoint Online.

Reference - https://techcommunity.microsoft.com/t5/SharePoint-Blog/Increase-in-SharePoint-Online-storage-allocation/ba-p/187617

OneDrive On-Demand

OneDrive On-Demand
There was a recent announcement of some new features coming for OneDrive for Business and SharePoint Online that I am very excited to see.  The new feature is called OneDrive On-Demand.

The OneDrive On-Demand capability allows you to access files without having to download them and use storage locally on your device.  Effectively, File Explorer has connectivity to data in the OneDrive for Business cloud just like it has with data on network attached storage.  When you select a file, that file will be synced locally and then opened in the app.

Additionally, there are reasons why some folders and files you will always want to ensure are available locally.  With this new capability, you have the ability to designate which files and folders you want to have as always available locally.

Benefits
A major benefit is not having to use local device storage.  This becomes important because storage available on a per user basis with OneDrive for Business in cloud can be more than what is available on the device itself.  So, if a user has 1TB of data of OneDrive Storage in the cloud, and they

Another benefit is more efficiency in data synchronization to a corporate network.  When lots of user sync a SharePoint Online site, all the files are synced to that device.  Additionally, when a file is updated, that update is pushed to all devices.  Now files are only synced at the user’s designation if the file must be available locally all the time.  This will reduce the amount of data being pushed.

Other Notes
OneDrive On-Demand is available as part of the Windows 10 Fall Creators Update.
This feature will work with OneDrive for Business, OneDrive (personal) and SharePoint Online.

What about Mobile?
Mobile Apps for OneDrive have always been on-demand.  A new solution is being introduced into the iOS and Android Apps which allow users to designate folders as “offline”.  This allows you to access those files while you have no internet connectivity.  Now we have some feature parity across devices.

References
https://blogs.office.com/2017/05/11/introducing-onedrive-files-on-demand-and-additional-features-making-it-easier-to-access-and-share-files/
https://blogs.office.com/2017/05/16/new-sharepoint-and-onedrive-capabilities-accelerate-your-digital-transformation/

SharePoint Framework is GA

SharePoint Framework now GA
The SharePoint Framework went generally available (GA) in Feb 2017.  I am personally very excited to see the next evolution of SharePoint development be made available to Office 365.

One of the toughest discussion with organizations transitioning to Office 365 is how to transition SharePoint to SharePoint Online.  For organizations with complex deployments, SharePoint Online is transition could be challenging.  The biggest challenge was what to do with Full Trust code that was either developed internally or part of a third-party solution that was acquired.  Over the years since SharePoint Online has been released, organizations and third-party solution providers have transitioned over to the APIs and the SharePoint Apps model.  However, there was still gaps in what could achieve with SharePoint Online.  With the introduction of the new SharePoint Framework, these gaps have been closed.

What is the SharePoint Framework?
Simply put, the SharePoint Framework is a new web page and web part development model that supports open source tools providing new flexibility in the creation of apps using modern web technologies.  This framework works for either SharePoint on-premises or SharePoint Online.  The new SharePoint Framework will give you a smooth transition from .Net development to Javascript development using this new method.

Up this point, SharePoint Online development options were:

• Full Trust Code: Not supported in SharePoint Online.
• Sandbox Solutions: Limited set of Full Trust code APIs available however this solution is being deprecated; so it was not recommended to invest time in Sandbox Solutions.
• SharePoint Apps:  Was first introduce in SharePoint 2013 days and was used by many to transition complex solutions to SharePoint Online.  This solution moved complex code to other locations and then provided a user experience through a iFrame that was integrated into SharePoint Online.  This approach had many benefits however iFrame boundary created some barriers for building an integrated solution with the SharePoint user experience.
• Script Editor: Has been and will continue to be as a solution to inject javascript and customizations into web pages.  This solution has several limitations around configuration and its ability to integrate deeply into the SharePoint API. 

How have things changed from the old way?
With the new SharePoint Framework, we can get back to writing web-parts the way we used to; which is truly exciting.

• Development Environment – The first big change is that Visual Studio is no longer required to do development.  Yeoman generator is used to create your project artifacts that can then be used to do your development is Visual Studio, Subline, Atom, etc.
• API – Instead of using server side code using .NET, you will use Node.js.
  Strongly Typed Scripting – Even though development is done in Javascript; Typescript is the primary language providing developers the ability to do object-oriented development that they were used to do with .NET.
• Build – Instead of using MSBuild to compile and build your solutions, you will use Gulp which is operating agnostic.  It will build solutions using Node.js.
• Deployment – Deployment of code is no longer pushed out to the GAC.  With the SharePoint Framework code is built and then deployed to any CDN service.  For instance a public CDN used to make the solution publicly available or can be deployed in a SharePoint CDN only make the solution available to a tenant.

References

I highly recommend you start reviewing these articles.

SharePoint Framework GA Announcement - https://blogs.office.com/2017/02/23/sharepoint-framework-reaches-general-availability-build-and-deploy-engaging-web-parts-today/
Overview from Ignite - https://myignite.microsoft.com/videos/2723
Overview - https://dev.office.com/sharepoint/docs/spfx/sharepoint-framework-overview
Enterprise Guidance - https://dev.office.com/sharepoint/docs/spfx/enterprise-guidance

Location Based Conditional Access for SharePoint Online and OneDrive for Business

I have been waiting for this capability to be released for some time now – Location Based Conditional Access.

SharePoint Online and OneDrive for Business has released a new solution that will allowing admins to control where data is synchronized to.  Specifically, you can create policy that can block synchronization of SharePoint Online and OneDrive for Business data based on IP address ranges. 

Why this is important?  For instance, there are many enterprise organizations that do not want their documents and files to be synchronized to non-managed devices or non-managed networks.  In many cases, administrators may only allow browser based access to documents when the user access documents from non-managed devices or non-managed networks.

Note if you have, Azure Active Directory Premium (AADP) configured, AADP will enforce its policy first and then the new SharePoint / OneDrive policy will be enforced.

Reference - https://techcommunity.microsoft.com/t5/SharePoint-Blog/Introducing-Conditional-Access-by-Network-Location-for/ba-p/39274

New ATP Features for Office, SharePoint and OneDrive

There were some new ATP features being released.  For instance there is new reporting capabilities, better performance with lower latency for emails/attachments that are being scanned, deeper URL detonation, and intelligence sharing with Windows Defender.

However, what got be excited is that ATP is being extended beyond Exchange Online.  ATP will now include protection for SharePoint Online, OneDrive for Business, Word, Excel and PowerPoint.  I found this to be really exciting.

Reference
New ATP Features Coming - https://blogs.office.com/2016/09/26/applying-intelligence-to-security-and-compliance-in-office-365/

Introducing Microsoft Teams

Introduction
Microsoft Teams was just announced as being released as Preview to customers.

Microsoft Teams is a continued promise by Microsoft to bring together best of breed capabilities from such solutions as Skype for Business Online, SharePoint Online, Office Online and Exchange Online together to deliver feature rich productivity applications that are not siloed.  Office 365 Groups was the first, now we have Microsoft Teams.

Microsoft Teams introduces a new Persistent Chat solution that allows users to see chat discussions over time.  The chat discussions can be viewed over time between a group a people.  But it is much more than persistent chat.  Microsoft Teams will become a hub for teamwork.  Which quick integrated capabilities as Skype for Business Online, SharePoint Online and Office Online collaboration around content can initiated.  The team experience can also be customized as new tabs can be added to quickly access documents and other cloud services.

General Availability (GA) is set for CY 2017 Q1 with more features and capabilities being added after this.

Where does Microsoft Teams fit in the Overall Office 365 Picture
When you hear about Microsoft Teams you may immediately ask what about SharePoint Teams, Yammer, etc. and then ask when should I use Microsoft Teams.  I say the answer depends on what you are trying to accomplish and you should carefully look at how you end users work and what they are try to accomplish.  Each solution has its place in the enterprise.

• Microsoft Teams – Recommend using when you have a defined group of users who are specifically working on a specific project.  Good for small groups of people who need to collaboration in reach time with each other.
• Office 365 Groups – Recommend using when you have small groups of people who share conversations, group mailbox, files and content with each other, however they may not work in real-time with each other.
• Yammer – Recommend using Yammer for across the “company wide” type of conversations and collaboration and communication.  Communities can be cross business disciplines.
• SharePoint Online -  Recommend using when you have sharing and collaboration across an organization, or longer standing formal content management solutions.  Company intranets, repositories, applications, etc. are great for SharePoint Online.
• Skype for Business Online – Continue using it phone calls, instant message, web meeting, etc.  Skype for Business Online is available across the Office 365 service and is the “glue” for collaboration.

As you can see, all these solutions are still relevant with the introduction of Microsoft Teams.

Turning Microsoft Teams On
It is pretty easy to do.  In the Office 365 Admin console, just go to Settings >> Services & Add Ins >> Microsoft Teams.

Some Other FAQs

• Microsoft Teams is a Suite capability and is available through such plans as E1, E3 and E5.
• There are Office 365 Connectors which can be used to receive updates from third party tools and services
• There is a developer API preview available.
• Microsoft Teams is a cloud feature only, and not available on-premises.

References
Announcement - https://blogs.office.com/2016/11/02/introducing-microsoft-teams-the-chat-based-workspace-in-office-365/
Video - https://blogs.office.com/2016/11/02/take-an-in-depth-look-at-microsoft-teams-now-in-preview/
Developer Preview - https://dev.office.com/blogs/microsoft-teams-developer-preview

Office 365 Business-to-Business (B2B) Capabilities

Introduction

This has come up a lot lately and I want to write something about this.  Business-to-business (B2B) capabilities are available in Office 365 and here are some features can consider turning on.

Skype for Business Online

Federation

Skype for Business Online external connectivity (federation) enables a Skype for Business Online user to connect with users in other organizations that use Skype for Business (as well as those that host their own Skype for Business Server on-premises). Federated contacts can see presence, communicate by using IM, and make Skype-to-Skype audio and video calls.

Skype for Business Online external connectivity requires the consent and correct configuration of both parties of the federation relationship. After the federation is set up by the administrators of both sides, users in each organization can see presence and communicate with users in the other agencies.

References

• Skype for Business Online Service Description - Federation
• Allow users to contact external Skype for Business users
• PowerShell Commands for External Sharing (optional)
• Configure Federation between Skype for Business Online and Skype for Business on-premises

Public IM Connectivity

Additionally, Skype for Business Online can be configured to allow communications to consumer Skype.  This can enable communications scenarios with citizens and constituents.  Presence, instant messaging and video conversations is supported.

References

• Let users contact other Skype users
• PowerShell Commands for External Sharing (optional)

Exchange Online

Federated Sharing

Federation refers to the underlying trust infrastructure that supports federated sharing, a method for Microsoft Exchange Online users to share free/busy calendar data and contact information with recipients in other external federated organizations or with users that have Internet access. These include organizations that are also hosted by Exchange Online, or external Microsoft Exchange Server 2010 or Exchange Server 2013 organizations. Using organization relationships and sharing policies, Exchange Online administrators can enable users to send calendar-sharing invitations from Microsoft Outlook Web App or Microsoft Outlook 2010 or later.

Once configured, an organization will have the ability to coordinate schedules with people in different agencies or with friends and family members so that you can work together on projects or plan social events. With Office 365, administrators can set up different levels of calendar access in Exchange Online to allow businesses to collaborate with other businesses and to let users share their schedules with others. Business-to-business calendar sharing is set up by creating organization relationships. User-to-user calendar sharing is set up by applying sharing policies.

References

• Exchange Online Service Description - Federated Sharing
• Sharing in Exchange Online
• Organization relationships in Exchange Online (business-to-business)
• PowerShell - Federation sharing (optional)
• Sharing policies in Exchange Online (person-to-person) 
• PowerShell - Sharing and Collaboration (optional)

Exchange Online Protection

Trusted Partner Messaging

Organizations can set up secure mail flow with a trusted partner by using Office 365 connectors. Office 365 supports secure communication through Transport Layer Security (TLS). Agencies can create a connector to enforce encryption via TLS for business-to-business emails. Additionally, there is the ability to apply other security restrictions such as specifying domain names or IP address ranges from which your partner organization sends mail. TLS is a cryptographic protocol that provides security for communications over the Internet. Using connectors, you can configure both forced inbound and outbound TLS using self-signed or certification authority (CA)-validated certificates.

Note - this solution does not impact the actual end user experience of sending email between organizations, however it adds an additional level of security if desired for sending email between agencies.

References

• Exchange Online Secure messaging with trusted partner
• Set up connectors for secure mail flow with a partner organization
• PowerShell - Mail flow (optional)

SharePoint Online and OneDrive for Business

Guest Access

If an organization performs work that involves sharing documents or collaborating directly with vendors, clients, partners, or customers, it is possible to use SharePoint Online sites to share content with people outside your organization who do not have licenses for your organization’s Microsoft Office 365 subscription. When a site is shared in SharePoint Online, an email message is sent to the external user containing the invitation to join the site.

• If the external user is already associated to an Office 365 tenant, that user can use that identity to access SharePoint Online sites and documents that are shared. 
• If the external user does not have an Office 365 account, they can access SharePoint Online using Microsoft Account (Your Microsoft account is the one that you use for personal services like Xbox Live, Outlook.com, Windows 8, Windows Phone, and more).  Invitations can be sent to people with any type of email address, such as user@gmail.com, user@contoso.com, or user@Comcast.net. External users sign in to the shared site via a one-time association of their email address with a Microsoft account.

Additionally, site users can generate a Guest Link (an anonymous link to a document) to share documents stored in SharePoint Online with external users without requiring the external user to sign in. Site users can create a Guest Link right from where the document is stored, such as in OneDrive for Business or a team site library, by using the “Get a link” button.

Finally, there is solution called Restricted Domain sharing that you can consider using.  This allows for an Allow/Deny List based on email domain.  At the tenant level, administrators can limit sharing invitations to a limited number of email domains.  This is a powerful feature that will allow you to set-up controlled external sharing with your partners.

References

• SharePoint Business to Business Collaboration: Extranet for Partners with Office 365
• Share sites or documents with people outside your organization
• Manage external sharing for your SharePoint Online environment
• Set up and manage access requests
• Create a partner-facing Extranet Site in Office 365
• Restricted Domains Sharing in Office 365 SharePoint Online and OneDrive for Business
• PowerShell - Manage tenant external config (optional)
• PowerShell - Manage External Sites (optional)
• PowerShell - Manage External Users (optional)
• SharePoint Online Service Description - External Sharing: External Access
• SharePoint Online Service Description - External Sharing: Guest Link 

What is Office 365 Groups?

Office 365 Groups is the next generation of collaboration solution available in Office 365 that brings together “best of breed” collaboration experiences.  Office 365 Groups bring together Exchange Online, SharePoint Online, OneDrive for Business, Office Online, and Skype for Business Online into a unified end user experience.  When a group is created:

• A mailbox is created for the group for shared email
• A shared calendar is created for group meetings and events
• A shared library is created to store files and documents
• A OneNote notebook is created to share project information and meeting notes
• A planning tool is available to organize and assign tasks

Note that Office 365 Groups is a “suite” feature requiring the acquisition of an Office 365 E3 (or higher) Suite.

Guest Access for Business-to-Business Collaboration

Office 365 Groups supports the ability to invite guests in a similar manner as SharePoint Online and OneDrive for Business.  Office 365 Groups has been available for time and this is a new feature that US Federal agencies should consider leveraging for cross-business collaboration.

• Video - Introduction to Office 365 Groups
• Video - Office 365 Groups: Quick tour of new user and admin experiences
• Learn about Office 365 groups
• Office 365 Groups - Admin help
• Introducing guest access for Office 365 Groups
• Guest access in Office 365 Groups
• Guest access to Office 365 Groups - Admin Help   

Parnter Sharing with Office 365 and Azure AD B2B

Background
With Office 365 and SharePoint Online, a common question is how can I external sharing with Partners. 

In SharePoint Online, the concept of External Sharing has been around for a while.  You have the ability to identify users you want to share with and administrative capabilities to manage external users.

One challenge people have is doing B2B sharing with SharePoint Online.  SharePoint Online external sharing does have PowerShell, so you can do some automation external sharing, however sometimes you just need a better approach.

Azure AD B2B Collaboration
Another approach to do external sharing with partner organizations is with a feature called Azure AD B2B.

With this capability you can:

• Organizations no longer have to managed a separate directory for external users nor have to go through the complexity of setting up federated auth on a per partner basis.
• Allows partner/external users to use their own credentials to access data you are sharing getting you out of the password management business.
• Removes partner/external user access with the user leaves their organization.  If the partner organization is turning off the accounts when the person leaves, you are assured their access to your data and applications is also being removed.
• Capability allows you to perform bulk invites of partner organizations.
• Partner users are invited and confirmed through an email notification process.
• If the partner organizations do not have Azure AD, no problem.  The partner users will complete the invitation process and have a free Azure AD account created for them that they will use to access shared data and applications.
• Set-up external sharing with partner organizations that goes beyond just Office 365 and SharePoint Online.

References
Azure B2B Collaboration - https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2b-collaboration-overview/

Azure B2B Video - https://channel9.msdn.com/Series/Azure-AD-Identity/AzureADB2B

Learn all about the Azure AD B2B Collaboration Preview - https://blogs.technet.microsoft.com/enterprisemobility/2015/09/15/learn-all-about-the-azure-ad-b2b-collaboration-preview/

Manage external sharing for your SharePoint Online environment - https://support.office.com/en-us/article/Manage-external-sharing-for-your-SharePoint-Online-environment-C8A462EB-0723-4B0B-8D0A-70FEAFE4BE85

Office 365 MDM or Microsoft Intune?

Introduction
I have been asked several times, what are the MDM capabilities available in Office 365 versus what additional capabilities do you get with Intune?

In this quick article I will explore the differences.

What is Office 365 MDM?
In Office 365 there are several native MDM capabilities.

First there is Exchange ActiveSync (EAS) which is part of Exchange Online.  With EAS you:

• Have the ability to manage an inventory of mobile devices that are connected to Exchange Online. 
• Have the ability to remotely wipe email from a device.
• Have the ability to enforce mobile device configuration settings, such as PIN requirements, PIN lengths, etc.

Second with E1, you also get Office 365 MDM.  With this you:

• Can prevent access to both email and documents based on device enrollment and compliance policies.
• Protect against root and jail broken devices.
• Have reporting on devices that do not meet IT policy.
• Have selective wipe capability that allows you to wipe Office 365 data without impacting personal data.

Behind the scenes, Office 365 MDM leverages Microsoft Intune to help deliver these solutions.

What is Intune?
Microsoft Intune is Microsoft’s cloud mobile and PC management platform.  Sometimes customers will want to add this to help them manage devices and applications beyond what Office 365 natively provides.  With Intune you:

• Have the ability to manage traditional PCs MACs; not just mobile devices.  Plus you can manage Linux and UNIX servers.
• Have a full Mobile Device Management (MDM) platform available to you to protect enterprise assets beyond Office 365.
• Have the ability to create profiles for certificates, VPN, email profiles and Wi-Fi settings.
• Have the ability to enroll and manage corporate owned devices.
• Can deploy and protect customer built line of business apps using Mobile Application Management.
• Can securely protect access to corporate data using Office mobile and custom line of business apps by using Mobile Application Management by restricting such actions as copy, cut, paste, save as to only applications managed by Intune.
• Can enable more secure web browsing.

As you can see, this is a much more comprehensive solution you have access to.

Why do you need both? 
All depends on your approach.  Microsoft Office 365 has the ability to integrate with many third-party MDM providers.  Customers do have the power of choice.  Intune does provide unique capabilities for Mobile Application Management (MAM) to protect data on mobile devices without compromising the end user experience.  However, the big value sell of Intune is the expanded set of solution to manage PCs and MACs.

What are these new plans?
Intune is bundled into EMS.  EMS used to stand for Microsoft Enterprise Mobility Suite.  Now, EMS stands for Enterprise Mobility + Security.

Plus, the new EMS Suite has taken very similar plan structures as Office 365.  For instance:

• EMS E3 includes Azure AD Premium P1, Intune, Azure Information Protection Premium P1 (Azure Rights Management (RMS)), and Advanced Threat Analytics
• EMS E5 includes Azure AD Premium P2, Azure Information Protection Premium P2 (Intelligent classification) and Cloud App Security.

As you can see Intune, lands in the EMS E3 bundle or you can purchase it a-la-carte.  See references below.

References

Exchange ActiveSync - https://technet.microsoft.com/en-us/library/aa998357(v=exchg.150).aspx
Overview of Mobile Device Management (MDM) for Office 365 - https://support.office.com/en-us/article/Overview-of-Mobile-Device-Management-MDM-for-Office-365-faa7d8e5-645d-4d59-839c-c8d4c1869e4a
Controlling Access to Office 365 and Protecting Content on Devices - https://www.microsoft.com/en-us/download/details.aspx?id=53317
Capabilities of built-in Mobile Device Management for Office 365 - https://support.office.com/en-us/article/Capabilities-of-built-in-Mobile-Device-Management-for-Office-365-a1da44e5-7475-4992-be91-9ccec25905b0
Choose between MDM for Office 365 and Microsoft Intune - https://support.office.com/en-us/article/Choose-between-MDM-for-Office-365-and-Microsoft-Intune-c93d9ab9-efb2-4349-9b93-30c30562ee22
Create and deploy device security policies - https://support.office.com/en-us/article/Create-and-deploy-device-security-policies-d310f556-8bfb-497b-9bd7-fe3c36ea2fd6
Enroll your mobile device in Office 365 - https://support.office.com/en-us/article/Enroll-your-mobile-device-in-Office-365-c8ac722d-dcaf-4135-8345-3e6327f5d3c5
Introducing Enterprise Mobility + Security - https://blogs.technet.microsoft.com/enterprisemobility/2016/07/07/introducing-enterprise-mobility-security/

Azure Information Protection with Office 365

Introduction
If you are a reader of my blog, you know for the past few years I have been very focused on discussing Office 365 services.  I recently decided to some catching-up on EMS and how it relates to Office 365.  Well as it turns out there have been several recent changes.  One thing that caught my attention very quickly was Azure Information Protection.  In this blog I will explore this solution.

I will say I am super excited to see the vision of this feature given I work with customers who have the most complex security and information protection policies out there.

Note that Azure Information Protection services is currently in Public Preview.

What is the new Azure Information Protection solution?A major challenge that organizations face is protection of their data.  Data loss prevention is constantly on customers’ minds.

With Azure Information Protection we can protect data at the lowest common denominator.  Instead of solely relying on the data storage systems to classify and protect data, we now protect the data directly at the source as email and documents move from place-to-place.

With Azure Information Protection:

• Classify, label and protect data at the time of creation or modification.
• Persistent protection travels with the data with rights management.
• Provide users simple intuitive controls help users make the right decisions and stay productive.
• Enable safe sharing of data both internally and externally.
• Ability to create organizational enforceable policies to protect data.
• Visibility and control over the shared data.
• Deployment and management flexibility through the cloud.

What is the difference between Azure Information Protection and Azure RMS?
Simply put, Azure Rights Management Services (RMS) got a bunch of new features added to it.  Azure Information Protection building upon RMS with several new capabilities that have been introduced as part of the Secure Islands acquisition.

The new capability that should catch your attention is the intelligent classification and labeling solution that has been integrated with Azure RMS.  This is super exciting capability.

With the new labeling capability in Azure Information Protection services, you have the ability to be able to create enforceable policy to classify and protect your more important critical data.  You have the ability to create labels (classifications) like Personal, Public, Internal, Confidential, Secret, etc.  Then you have the ability to create policies define how data should be tagged with these classifications.  Once data is classified, that data can visual indicators applied to it, RMS protection policies pro-actively applied to the data, and DLP rules (like Exchange transport rules) can watch for this data and take action.

Additionally, there are new reports available to you that allow you to see how the most critical data in your organization is being accessed and managed.  This provides an audit trail for your most critical data.

How can an organization use Azure Information Protection?
Let’s look at Azure Information Protection a little closer.

When a user is in Office, they will see a new ribbon item (Protect) along with new labeling mechanism in the ribbon.  Users have the ability to tag any document or email on the spot.

Administrators have the ability to create the labels that customers see.

Within each label you can:

• Associate RMS policies you want to apply (if any) to a specific label.  For instance, if you have a Confidential or Secret label, you may want to associate that label to an RMS policy.
• Create visual markings that would be applied to the email or document once the label is applied.  For instance, add headers, footers, watermarks, etc.
• Define conditions that could automatically label email and documents.  For instance, if you see data patterns within the content, a label can be auto applied.

There are numerous ways these labels can actually be applied.

• Automatic – Labels can be applied by IT based on information it can see in the documents and emails.  This means as the user is creating the content, the label can be applied for them. 
• User Drive – Users have the ability to choose to apply sensitive labels to email or file as they work on it.
• Recommendation – Instead of automatically applied the label, you can make recommendations to the user on how classify/label.
• Reclassification – Depending on your policy, you can allow users the ability to re-classify email and documents.  You can even require them to enter a justification which will be logged.

I see endless opportunity for organizations to use Azure Information Protection services to protect their data.  For instance:

• An organization could create a policy that all documents are automatically classified as Internal.  The Internal does not have to have a RMS policies associated to it, but doing this will set a baseline that all content in the organization has been tagged.
• As data needs to be become public, the data can be re-classified (labeled) as public by the end user.
• For documents as classified as Secret or Confidential, an RMS policy could automatically be applied.
• Re-classification can be allowed without justification for Internal and Public, but for any re-classifications of Secret or Confidential a justification must be provided.
• I really think there are endless opportunities here with Azure Information Protection services.

How does this relate to Office 365?
As part of the Preview, Azure Information Protection services can be integrated with Office 365 ProPlus.  This means files that you author in Word, Excel, PowerPoint, etc. as well as emails in Outlook will have this user experience.  This will expand with time.

I thought Office 365 already had DLP, where does this play in?
Yes, Office 365 already has DLP capabilities within Exchange Online, SharePoint Online and OneDrive for Business.  Azure Information Protection services provides another layer of protection to data protection along with labeling solution.

For instance, SharePoint Online DLP will identify sensitive documents that were put in a location that has too broad access.  That file can be locked down and then remediated with SharePoint Online DLP by the user or an administrator.  However, what if the end user made a mistake (or worse was malicious) and then tried to send a file tagged as secret outside of the organization?  Azure Information Protection could protect that data tagged as Secret based on your policies.  For instance, you can automatically apply an RMS policy to Secret data and not allow users to re-classify that data.  There are several other mitigations you can take such as watch for documents tagged as secret being emailed externally.

From what I have observed, a challenge customers have had with RMS is educating users on how they should use it.  With Azure Information Protection services classification and labeling solution, the decision has just been super simple for end users.  End users do not need to know complex RMS policies and rule sets; all they need to know are organization contextual tags and the RMS policy is applied for them.

How is Azure Information Protection related to the EMS Suite?
There are two plans, there is Azure Information Protection Plan 1 and Plan 2. 

Plan 1 provides the encryption for files and cloud based file tracking.  From a legacy perspective, this is what you know of as Azure RMS as part of the EMS suite.

Plan 2 adds the new intelligent classification and labeling policies.

There are as well EMS Suites (E3 and E5).  Azure Information Protection Plan 2 is part of the EMS Suite 5.

If you are an Office 365 E3 suite customer, you already get access to Azure RMS service.  However, having Office 365 E3 does not give you access to all the EMS E3 or E5 capabilities.  So to get access to Azure Information Protection Plan 2, to get this new classification and labeling solution, you will need acquire some additional EMS plans.

References
Announcing Azure Information Protection - https://blogs.technet.microsoft.com/enterprisemobility/2016/06/22/announcing-azure-information-protection/
Azure Information Protection Public Review Announcement- https://blogs.technet.microsoft.com/enterprisemobility/2016/07/12/azure-information-protection-public-preview-available-now/
Introducing Enterprise Mobility + Security - https://blogs.technet.microsoft.com/enterprisemobility/2016/07/07/introducing-enterprise-mobility-security/
Acquisition of Secure Islands - http://blogs.microsoft.com/blog/2015/11/09/microsoft-to-acquire-secure-islands-a-leader-in-data-protection-technology
Azure Information Protection product page - https://www.microsoft.com/en-us/cloud-platform/azure-information-protection
What is Azure Information Protection (good video) - https://docs.microsoft.com/en-us/rights-management/information-protection/what-is-information-protection 
Azure Information Protection FAQs - https://docs.microsoft.com/en-us/rights-management/information-protection/faq
Azure Information Protection Quick Start for Preview - https://docs.microsoft.com/en-us/rights-management/information-protection/infoprotect-quick-start-tutorial