Microsoft 365 Community Community Demos, 13 Dec 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Introduction to App Compliance Automation Tool for Microsoft 365

Description

In this 10-minute developer focused demo, Sreekanth Thirthala highlights a service in Azure portal that simplifies the process of demonstrating security and compliance for applications published on Microsoft 365 by automating many (40%) of the validation processes, i.e., collecting and analyzing compliance data, generating compliance reports with prescriptive guidance. The compliance report integrates seamlessly into the Microsoft 365 Certification process in Partner Center. See creation of report in Azure portal, remediation, and integration in Partner Center. This PnP Community demo is taken from the weekly Microsoft 365 Platform Community call recorded on December 13, 2022.

Demo Presenter
• Sreekanth Thirthala (Microsoft)

Supporting materials
• Documentation - App Compliance Automation Tool for Microsoft 365 | aka.ms/acat

Learn more
• Microsoft 365 Unified Sample gallery - https://aka.ms/m365/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Microsoft 365 Platform Community - http://aka.ms/m365/community

A

A

Microsoft 365 team um introduced what we call as app compliance program for third-party developers to be able to get certified and to get secure and compliant, and this program was introduced about three years ago or so. uh What we have seen is our developers. Our partners need a lot of help.

A

We also found that there is a way we can automate several of those processes like, for example, if there are controls around. What's your firewall uh or what's your vulnerability scanning, so things like that, so there are quite a few controls which we can automate in the essence that if we can, we can, if we give us access to your infrastructure, we can run a set of policies set of controls and we can identify whether you're compliant to those.

A

In mind, with the intent of actually automating your certification process, or with the intent of actually making it easier for you to get secure and compliant and to actually share your data with your customers very easily of your compliance, we built a tool called the app compliance automation tool, which is what we are going to talk about today. uh We're going to talk about some of the benefits of using this tool, both from your perspective as a developer and also from the End customer perspective, uh Enterprise customers, and how it kind of helps.

A

You accelerate your adoption cycle, we're going to talk about that, and then we will do a very short demo. So uh what is the app compliance automation tool? um Our goal is ultimately to simplify the process of security and compliance. Our goal is to actually make sure that you are secure and compliant. uh What we've done here is. We've used some of the core fundamentals of azure security, Center and the Microsoft Defender for cloud and we've we've let the app developer Define the compliance boundary for an application.

A

Once you, you find a compliance boundary for an application. We collect the compliance data, we run a set of policies, we'll collect the compliance data, and then we generate a compliance report. This report tells us and tells you exactly what are the controls that need to be fixed? What are the controls that need to more attention, and what are the things that you can do? What are the sequence of steps that you can follow to actually fix those controls? Once you actually meet those control requirements?

A

We let you actually. We integrate the process with the overall certification, Microsoft 365 certification process in partner Center. That way, we actually can get you compliant faster um and we can also make we can also enable your Enterprise customers see the certification request, see the certification status.

A

We can also let them see all the compliance controls that you have satisfied, so that is the damp compliance automation tool, um just to give a take a step back and think about what what are we talking about when we talk about control, automation right, um our first party products today is automate about, or today have about satisfy about 1200 art controls. uh When we created this app compliance program. Three years ago, or so, we identified a set of 110 controls which most Enterprise customers want.

A

um They ask for uh they ask for any app developer to meet those controls and what this tool does. Is it automates about 35 40 of those controls, and our goal is by early next year we're going to automate about 40 yard controls right now it automates about 35 percent. Today the tool is in public preview and I'll share all the documentation uh with the offline I'll paste it on the chat. Right um before we see a quick demo, I want to reiterate some of the benefits uh from from a End customer standpoint.

A

What do you get out of this tool right? So it accelerates a compliance cycle grade, but it increases the trust it create. It probably actually provide a badge on the storefront against your app saying that your app is certified. We actually let the compliance, let any sort of security and compliance admin, see the control status, see the control details and thereby it increases the trust and provides complete transparency into Apps compliance status and the controls from a solution Builder perspective. Ultimately, our goal is to kind of get compliance integrated with your development cycle.

A

So as we sort of build all of these tools uh to automate your compliance processes, we want to actually get to a state where your compliance, securing the compliance or decreasing a compliant app became is integrated with the development life cycle.

A

Let me actually play a quick demo, and hopefully you can hear the audio and the demo I've actually shared the audio. If you cannot um please let me know um I'm just going to show you a quick demo of this particular tool.

A

The compliance automation tool for Microsoft 365 enables app developers to get secure and compliant and to achieve the Microsoft 365 certification, the tool is enabled as a service in Azure folder. You can start the process by creating a new compliance report to do that. Navigate to the reports. Tab click on create new report provide a new report. Name select the appropriate resources corresponding to your application.

A

You can select resources based on subscription or Resource Group, or additional filter criteria such as resource tags. Once you have selected all your resources, click on ADD and confirm the process to create a new compliance report.

A

Once the report has been created, you will be navigated to the reports tab where you will see the list of all your compliance reports and their certification, statuses, click on any report, name to remediate specific controls that need to be fixed. You can filter for customer responsibility equal to fail to see all the controls which need to be fixed, for example, in this case, I need to fix the TLs configuration to do that. I click on the actions icon.

A

Look at all the resources which are unhealthy, look at the remediation steps and take the corresponding actions to fix this resource. Once all the controls have been fixed, I can download the Microsoft 365 certification report and share it with my customers. The Microsoft 365 certification report will give a complete view into all the controls that have passed and the corresponding resource deep tips, hopefully that uh that gave you a quick overview of the tool and how it is enabled as a service in the Azure.

A

We have now started with apps, which are built on the Azure um uh are back in infrastructure and Azure um and as we go along in the next year, we will see a lot of uh we'll see a lot of enhancements to this release where we are going to bring in apps from other clouds.

A

Also, uh let me show you how a quick another quick demo of how we have taken this app compliance, automation, tool, report and then integrated that with your certification process, because right now, we've created a report, as you saw in the PDF output. But how do you actually bring that in? How do you integrate that with the certification process is what this video is going to talk about?.

B

In order to use app compliance automation tool to achieve Microsoft, 365 certification easily, you need to connect your report with your Marketplace offered during the report creation process or modify the report settings later after creation.

B

Once the report is connected with Marketplace offer, you could use it easily in the initial documentation phase of app compliance in partner Center.

B

When you move to the next step control requirements phase, you could find that the controls, which are automated by app compliance automation tool, are already approved by certification reviewer. You only need to focus on remaining controls.

A

Okay, so uh that gives you a quick highlight of how the automation process is actually integrated with the certification step yeah. That covers pretty much a very quick overview um of the tool and I'm happy to take on any questions. Let me uh let me go back to the SlideShare mode and then take on any questions from the team.

C

When this is in preview, is a question for Mike? Yes, it's already out.

A

Yeah, this is already in preview. uh Let me share the documentation link here on the chat thread, or actually we can email all the. If there is a package going out with all the emails and with all the documentation, I can send that I actually put the link to the documentation right here. Yep.

C

We'll put it in the blog post, which will be shared in the social media, so not only for the attendees, but also for the rest of the community. Cute now Kim is asking for the app compliance. How come passing threshold not revealed not quite sure what that question is all about. Did I miss that one.

A

um Does that mean uh what is the minimum number of controls that need to be set.

C

And thank you. Cash for uh is still the first time. Sorry and Kim is the last name, but uh can you clarify the question so in that page it says you're not required to comply with with the controls with in this Microsoft certifications.

C

A

C

A note yeah we'll need to come back on, probably on that one or srikant.

A

Yeah I was gonna say, like I think there is a certain number of controls, but to be satisfied. I think there is a complexity around what I've heard and I'm, not in the certification team, but I about that from the PMS that there is a complexity here around like different combinations. If you're running as your pass versus is, for example, uh what is the threshold should be quite very different.

A

um So that's why they've, actually, maybe maybe that's why they have not mentioned it, but uh I I think that's something that I can come back and discuss with it right pm and come back. So let me take that action item.

C

Thank you question on the question and then here's three content on following up on that.