Microsoft 365 Community Experts from the field, 29 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Microsoft Purview - 5 New & Updated Features that You NEED to Know!

Description

In this session I explore just a few of the new features that have enhanced Microsoft Purview. Including some cool enhancements that you simply must know. From Data Loss Prevention Policy’s to Information Protection, and Insider Risk Management. I’ll discuss the topics that matter along with full demos. With detailed walkthroughs this session is perfect for both experienced admins as well as newbies.

Check out my site Andymalone.org
Check out My Books
The Seventh Day by Andy Malone on Amazon https://www.amazon.com/Seventh-Day-Andy-Malone/dp/0993020208
Shadows Rising by Andy Malone on Amazon https://www.amazon.com/Shadows-Rising-Andy-Malone/dp/0993020240/ref=monarch_sidesheet
The Seventh Day YouTube Playlist https://www.youtube.com/watch?v=dbeEKd6lHTo&list=PLEgclf_4HA-iot2zFO8MOFngIcqskrIk1

Timecodes

00:00 Introduction
02:30 Demo Begins DLP Policy Enhancements
09:02 DLP Policy Enhancements
12:00 Insider Risk Management - New & Enhanced Features
21:50 Adaptive Scopes Explained with FULL Demo
24:25 Information Protection - Labelling & Classification Enhancements Full Demo!
31:41 Session conclusions

A

This time it's the turn of Microsoft compliance tool, Microsoft purview and we're going to take a look at five new and cool features that you simply have to know so. You're ready to learn.

A

Greetings, my fellow YouTubers: how are you Ali.

B

Malone Microsoft.

A

Mvp, you know every week, I punt other people's books on my channel and I was thinking you know. Maybe you should do this for your own books. So I don't know. If you know this about me, but I've written two books, uh one is the seventh day and the sequel is Shadows rising and these are sci-fi Thrillers um kind of. If you ask me to explain them, it's essentially Highlander meets The Da Vinci Code meets The Omen anyway, they're both available on Amazon and in bookstores.

A

So you can go and purchase them now and I'll stick the links below and you can have a look at it, um something that I did a couple of years ago. Actually I experimented at creating my own audio book, so I recorded the first five chapters of the seventh day. So, if you'd like to listen to that check out the links below it's actually on my YouTube channel as well, you can you can listen to it for free now.

A

This time, I thought I would take a look at Microsoft purview, so Microsoft compliances tool and I realized. You know there's so many changes that are making this tool better every single week and I thought I would pick out my top five things that I'd like to talk about.

A

So we're going to look at some, not necessarily new features, but also some new features and some updated features as well, so definitely uh stay with us, because I've got some cool demos for you now, if you've not subscribed to the channel and shame on you, click that subscribe button up there ring that Bell and come on board and join my great learning community that I'm trying to build, and if you enjoy the video, please bump the like button. It does make a difference to my channel now, questions comments as ever.

A

Get those down below and I'll do my very best for you, so without any further jibber, jabber I think it's about time. We take a look at my top five new and cool things that you need to know in Microsoft purview, let's check, yeah, okay, so I'm kicking off here in the Microsoft 365 admin, Center and I'm, going to come into compliance now. One thing that you need to know, of course, is that work never stops on this Evergreen service, which is Microsoft 365.. So it's not like a regular application that you install and forget.

A

This is something that you need to constantly keep on top of now. Just may I remind you I'll point you to the Microsoft 365 roadmap. This will give you an update into everything, that's currently being planned and which is currently rolling out in Microsoft 365.. So definitely put that on your list, so here in the 365 admin Center I'm going to come down to the first of my topics, which is data, loss prevention policies.

A

Now, data loss prevention policies is something that's been constantly being looked at and it's as it's so important, I like to think of it as data leakage, prevention of course. So a couple of things here, of course, it's all about protecting sensitive information, and this screen has been recently updated um to show all you know what you're currently working on and if it's detected any kind of sensitive files or sensitive information leaking out.

A

um It all starts with policies from a policy. It then will generate an alert. You've also got things like endpoint DLP settings which has just been updated and you've also got something called the activity Explorer. So let me just show you a couple of changes, I'm going to come in here and I'm going to create a new policy.

A

The first thing is it's going to ask you to choose a template so, depending whether it's privacy, medical and Health financial and so on, I'm going to choose a financial template here and I'm going to scroll down and let's just choose, U.S financial data, and you can see that it's giving me credit card numbers, bank account numbers and, of course, routing numbers there I'm going to click on next and next again- and this is the first change that you'll notice- you can now assign DLP policies to admin units in 365.. This is a big difference.

A

So again, I can add this and I can say: I've only got one on admin unit. At the moment, of course, an admin or administrative unit is where you can group numbers of users or groups who are in a similar location, and you can then assign, let's say, a local administrator who might be, for example, a SharePoint admin or an exchange admin, or something like that note that it wouldn't be a global admin. There wouldn't be any point doing that I'm going to assign this to the Bergen office and I'm going to say yeah.

A

So this data loss prevention policy will be assigned to all the users and groups within the Bergen office, and you can see it can bring out things like exchange, SharePoint, OneDrive I, don't have any sites in the Bergen office. That's the reason why it's grayed out by the way um things like teams, chat messages um devices if you've got devices enabled, of course, through endpoint.

A

um The other things here you can see. These are grayed out at the moment. It's because I I'm, not in hybrid and I, don't have any I, don't have Defender for cloud apps installed and configured at the moment, all right, so I'm going to click next, and you can see here that it brings the policy. But, like all templates, you can customize this.

A

If you want to all right, I'm just going to go ahead and say yeah, that's fine again, I can add in so this is the sensitive information, so I can add in additional sensitive information types as well as something called trainable classifiers, which I'll explain later I I. Think for the purpose of this demo. That's pretty good I'm going to click on next and you can see if it matches the policy and the condition send a notification to the email.

A

Of course you can customize all of that notifications as well, and you can also set a specific amount of time and you can set thresholds, send an incident report to let's say an owner or somebody like that, and also you can send an alert as well. Now you can also restrict access or encrypt the content in Microsoft 365 locations as well. So if it does come up as a sensitivity label, you definitely well, you would probably want to restrict that content. So this then brings me on to this screen so restrict in 365 locations.

A

You can either let people um have you know. Do you want to block everyone or block only outside of your organization, so I'm going to say I I'm a bit kind of sensitive about sharing data outside my organization? You can also require a business justification. So, for example, if you are blocking a credit card number, you might want to say: well, you know um the end user.

A

um Will you know if they want to say no actually I do need to send the credit card information. They can justify it all right. Do you want it audited on specific devices? So again you can audit the device as well. um So you can do that. You can set up various auditing options, which is really nice, and it can also monitor things like file activities.

A

So if you're monitoring devices and managing them in InTune, which I'm not here, you can see, you can also restrict third-party apps from accessing the data as well, and you can also restrict access or remove if you're, if you're, in, like hybrid and you're working with on-premises files, as always it says hey, do you want to test the policy out first? Do you want to turn it on or do you want to keep it off?

A

If you've created any policy tips um again, it will show those if you want to so that's it I've gone ahead and created my policy and the cool thing is. This will just affect the users in the Bergen organizational unit. How cool is that so another interesting area in data loss prevention is the new endpoint DLP settings. These have really been enhanced lately. So if you've not had a look at them, definitely check them out.

A

Okay, so um again, if you are using InTune, for example, if you're managing devices, this is something that you're going to want to take a look at so Advanced classification and scanning and protection. So you can do that again. You can limit the bandwidth and the it is possible that maybe Microsoft will start billing for this eventually, because, ultimately, it's about how much data you use, if you want to do any file exclusion pass for both Windows and Mac, you can do that remember.

A

This is for Max and PCs and I do believe that this will be extended later, as well to include include things like Chromebooks and so on. So the other thing is set up evidence collection on file activities for devices. So again, if you want to enable this, if you're managing the devices you can set this up and you can manage it's essentially a cache and it's files that you can use as potential evidence if things ever did get legal.

A

um The other thing that we've got is Network share, storage and exclusion. So again, if you want to exclude any uh SharePoint or any path exclusions, uh you can do that so I'll, just uh close that um restricted, apps and app groups. So if you visit this is any apps that you want to restrict uh from running on those devices. Maybe the apps are causing problems with sensitive files and things like that.

A

um You've got things like on allowed Bluetooth apps. You can restrict apps things like browser and domain restrictions to sensitive data, so you can specify only certain types of browsers that could be quite useful and also things like additional settings for endpoint, so things like, if you're using business justification.

A

um So if somebody wanted to lower let's say a data loss prevention settings you can and it will show options things like policy tips and things like that. This is new. We've got printer groups, so if you're, if you're taking advantage of internet-based printing, then you can create printer groups there and, of course, with those printer groups, you can also restrict that removable USB device groups so again things like VPN settings. You can take advantage of all of that here as well. So the VPN settings, of course data loss prevention.

A

So if you've got your an inbound VPN again, you can configure that. So that's quite a useful feature. So, ladies and gentlemen, there you go. That's the endpoint DLP setting Now One Premium feature which I really love is something called Insider risk management in Microsoft 365.. However, um to get the most out of this, you really do need something like a HR connector, which you can find up here at data connectors. Now many of these data connectors are free. Some of them, however, are carry premium charges, so things like HR.

A

um So if you've got things like HR connectors, there's a number of them here, you can link those and connect them directly into Azure, active directory, of course, as well as into tools like Microsoft purview.

A

So in this demo, I don't have a connector installed, but you'll see what it looks like I'm going to come down into Insider risk management, and this is a really exciting area for me as a security person, because this is something that's been missing for quite a number of years now again I've done demos on this in the past, but it's really nice to talk about some of the enhancements here, and the first thing you need to do is before you start looking here.

A

Is you just need to go up to the wheel here and have a look at The Insider risk management settings um so the important things like do? You want anonymized names and things like that and now in this case, of course you probably don't, um but there are a number of things that you can go in and you can have a look at so, for example, policy indicators. So obviously what are you looking for? That would indicate that there is a potential issue with a potential malicious Insider here.

A

So again there are device indicators, so if I had devices in InTune, this would be lit up and I could then choose those options again if I've got Defender for endpoint. This demo doesn't have that. Unfortunately, but you can see things like if somebody's browsing fishing website hacking websites, abuse websites. You know these are the things that you probably would want to know from a HR perspective.

A

um You know, would you really want people in your organization looking at this type of content, so again check out the settings Pages first of all, now um in here, of course, um you can go in and you can create policies now, just a couple of things about the policies.

A

um We also have something called adaptive protection, um so adaptive protection essentially means that you can set risk levels for adaptive protection. Adaptive essentially means that you're using Dynamic rules. Okay, so you can essentially set up different Dynamic rules um now I'm gonna. What I'm gonna do here is I'm, going to go into policies first, I'm going to go ahead and create a new policy, and, of course, with this, there are a whole bunch of new policies that you can have a look at things like security policy violations.

A

So obviously somebody looking at inappropriate websites like I just mentioned things like health record access and risky browser access things like that again criminal activity websites. This would bring great concern within your organization for this demo I'm just going to use the data leaks option and you can see to get the best out of this. If you had a HR connector in that would be really good, um so essentially what it's looking for is looking for indicators. It's monitoring people within your organization once they leave.

A

It monitors the account for 30 days afterwards and up to 90 days before they leave all right, and it would look for any kind of triggering events. So I'm going to call this my what will I call this I'll call this my Bergen levers: okay and I'm just going to click next and do you want to include all users or do you want to include specific users and groups again for the purpose of this demo? I'll choose all levers and do you want to prioritize any specific content?

A

So if you leave those selected, it will go through and you can then add in specific content right now, I'm just going to say for time's sake. I, don't want to do that so I'll, just click on next, all right. What's a triggering event. So, if I had a HR connector, it would pick up all the HR signals, but as it is at the moment, I'm only using Azure ad. So the signal when the user account is deleted from Azure ad, so I can go in now and I can choose those indicators.

A

So if there are things that I don't think are appropriate again, I can switch those off and you've got these for both office device, physical devices and also, if you're, using things like Defender for cloud apps as well.

A

um So again you can choose detection options. So again, some of these are grayed out at the moment, because I've not got any devices in this tenant, but if I had devices and I was monitoring devices, then you can see it would monitor. Obviously things like downloads and things like that and in essence it's inappropriate behavior so again, I'm just going with the default thresholds and again I'm now going to submit and I'm going to create that policy, so I'm going to click on done. So this policy is now active for all of my users.

A

You can see it's up and running if a policy hit does happen, it would then generate an alert. Okay. You can go in and you can there's no alerts yet so there's nothing going on, but again I could go and review those policies and fine-tune them if I wanted to now from an alert. It will also create a case, and that case can obviously include things like forensic evidence, so I can claim up to 20 gig of capacity for forensic evidence. Again. This may depend on your plan with Microsoft 365..

A

You can also, if you prefer, you can also create what we call notice templates as well. This works for both Communications compliance and Insider risk management. So you can see here: I can go in. I can create a little just a notice here. We've noticed a violation, so in many countries around the world, it's a it's a legal requirement to inform them hey, you know, we've just noticed something and please contact your it team again, whether that's a policy for you or not. We also, as I mentioned.

A

We also have this adaptive protection as well and with the Adaptive protection. This is new. You can choose an Insider risk policy, so this is my Bergen lever and again you can see um Define the conditions for the different risk levels. So what's a minor risk, what's a moderate risk and what's high risk within the organization, so, for example, things like high severity of alerts generated for a user, so I could say that a moderate risk might be medium to high and then a minor risk might be user performs at least one data exfiltration.

A

So again that might just be a minor thing, so you can set the thresholds so you're not constantly being monitored all the time or notified all the time. Rather um things like past activity, so you can choose um the time period, so you can increase that or decrease or decrease. That and again you can choose the risk level time frames as well, so again, I'm just going to click on that and then you can see what are the users assigned to the different risk levels.

A

So at this point, if you're using things like, if you've assigned any particular users, for example, sensitive groups, they would appear here now- you can see that I created a DLP policy previously. So I can also create a data loss prevention policy.

B

A

And again you can choose, let's say this time: let's say privacy, so it's looking for personal identifiable information and but this time again I won't bother with the admin group this time, but you can see what it monitoring so everything and again it's looking for that sensitive information.

A

So again and it's you can see the risk levels so select one or more of those risk levels, so I, say medium and high risk are going to be affected by this particular data loss prevention policy and from that on from that point on, rather it's just pretty much the same so again, I can say: yeah I want to restrict the access externally, I can set up the auditing if I want to and again as always, you can test that policy out.

A

So there you go so on the subject of adaptive protection, we need to have a quick word about something called adaptive Scopes and you can find these in roles and Scopes and they come in adaptive Scopes. So what's the difference between what is an Adaptive scope, so essentially an Adaptive scope is a set of dynamic rules. So again, I'm going to select this scope I'll just edit.

A

This one here is one I made earlier and I'll click on here and you can see you can either do it by an admin unit, so an administrative unit or, alternatively, you can basically base the scope on a particular user, a SharePoint site or a Microsoft 365 group, depending on what you want- and you can see in this demo- I've selected mine on users. So basically I add my Dynamic rule set here.

A

So I've said: if the use sir, if the department is equal to sales and the user in the city equals Oslo, they will automatically be affected by this particular score. Now, where do you? Where does this hit of course? Well, if I come into Microsoft 365, if I come into the active users and if I scroll down I've got a user here called let's say Diego, so if I go into Diego's account, what I'll do is I'll come in here and I'll scroll down? You can see.

A

You've got the contact information here and I'm going to scroll down. You can see that at the moment, Diego is in it support so I'm going to change that I'm going to make him in sales I'm going to place him in sales and I'm, also going to say: hey which offices he in or which city in this case so I'm going to say actually Diego is now in Oslo and as soon as I set those changes that Diego will now be affected by that adaptive scope and that's the concept behind these Dynamic rules.

A

Okay, so you can have as many as you want if and you can use things like, if and or rules, and to really kind of fine tune exactly what you need so very, very nice feature that and by the way, once you've created an Adaptive scope. That would be then used by all the compliance features that support it now. Lastly, I want to feature one of my absolute favorite topics and I think probably one of the most important areas in Microsoft purview, and this is information protection, now, information protection or labeling and classification.

A

It continues to pretty much amaze me and it goes from strength to strength, including this new interface here, and you can see here that the main portal is actually looking really good these days and by the way you can also apply labeling to things like Microsoft teams. If you have the teams premium license again, that's maybe something that you want to add on and there's also a trial that you can sign up for there as well I'll cover that in a future session by the way.

A

So um again, I've created some labels, but you know what I'm going to go through and just do a good demo here. So let me create some labels.

A

um I'll call this label I'll call this Bergen uh classified okay and I'm, just going to copy that and I'll just paste that in.

B

A

I'll paste that into a description, and you can also choose a label color as well so I'm going to go ahead and I'll I'll choose a blue label here and I'll click on next now, as you can see before it just said content, but now it's been extended to actually break that down into more a more granular approach. So this includes things like files, so anything that's created in Microsoft, Office or anything that's stored in OneDrive things like SharePoint document libraries, things like emails of course meetings.

A

To be honest, this only works by the way if you've got teams premium so I'm going to leave that off just now things like groups and sites, of course, and if you've got any labels, you want to assign to things like SQL or, if you're, using any databases, not just in Azure, of course, but also in the other platforms there as well. You can do that so I'm going to click next. So do you want to apply or remove encryption? Do you want to apply content marking again, you can see the teams.

A

Option is grayed out because I don't have teams premium, so I want to configure encryption options. So if that label, if a content is labeled, I want to know that it's been secured it's encrypted, so I can assign the permissions now. Do you want to allow user access to content? Do you want to set an expiry date on that I'm not going to bother with that? Do you want to allow offline access again, depending on the sensitivity of the data, so again, for this purpose? I'll say: yes, that's! Okay!

A

um I can now assign the permission so I'm going to assign it for all users and groups. I'll simply choose the permission, and here is where you choose a role, a permission role, so you can see. Obviously you can customize those permissions individually or you can choose one of these preset roles, so a viewer is essentially read only and for the purpose of this demo. I'll choose the co-author option, so I click on Create and again I'll go next.

A

Now, content marking, of course, do you want to add a watermark so again, diagonally across the paper. Do you want to add a header or a footer, so I'll go ahead and add a footer here to my document: I'll call it Bergen classified again: you can change the color, you can change the size of the font and whatever you want.

A

I'll click next Auto labeling. So basically what this does. It allows you to create a data loss prevention policy and it will assign a label to that policy or vice versa. So, if you assign a label, it will also assign a data loss prevention policy for automatic labeling.

A

Alternatively, you can do manual labeling, so I'll just leave that that blank now, as well as the privacy settings for users and things like conditional access, you can actually set this now at individual policy levels. So you can see with the Privacy with the sharing option, things like groups and teams. I could say that, yes, any anything here is private. Let group owners add people outside the organization, so that's on or off. So this is all kind of new and Define external sharing and conditional access settings.

A

So again you can say control external sharing from labeled SharePoint sites of the SharePoint permissions comes in here and I can say. Okay I only want this to go to existing guests um again, you can also do it for SharePoint sites as well. Again, you can choose what level of access for SharePoint sites I'm going to say, allow only limited web access again.

A

You've got Auto labeling, so that's data, loss prevention policies and I'm happy with this, so I'm going to go ahead and confirm that now so, just as I said you can see, there have been quite a number of enhancements now at this point, I don't want to create a policy because I already have a policy.

A

So if I come down to a label policy, here, I'll choose project obsidian I'm, going to edit that policy and again, if I click on edit you can see here- is my new Bergen label I'm just going to add that in click on next again, you can see that this admin unit has now been integrated. Again. I could actually add Bergen here, I suppose, because it is Bergen.

A

So this is just affecting the Bergen office, okay, so all users and groups within the scope of the Bergen office and again do you want these are policy settings.

A

So if you want to allow the user to lower the label sensitivity or make changes again for the purpose of this demo, I'm not going to bother um putting in default labels here so I'm, just going to say, yeah I'm, happy that the user can go off and they can actually custom their own labels and add them in now um that can take about an hour to filter through, but you can see essentially, if I go to a Word document here. So you can see here. I've got a sensitivity: option.

A

I can now choose that sensitivity label for that document. So that, ladies and gentlemen, is just some of the enhancements that information protection brings in Microsoft 365..

A

So there you have it my top five new and cool things in Microsoft purview, Isn't that cool Hey, listen, I, really hope you enjoyed it and if you did pump the like button, it does make a difference to the channel and if you've got questions or about this or any of my other sessions as always get them down below and I'll do my best for you. Okay, if you've not subscribed, of course bump that subscribe button, it does help and come and join my great Learning Community. That's it for this time you stay safe.

A

I'll, see you next time.

B

Foreign, hey thanks so much for dropping by today. Here's a couple of videos that you may enjoy and while you're here go ahead, click on the Subscribe button and you won't miss out.

B