►
From YouTube: Updates on Microsoft 365 Information barriers
Description
In this 40-minute IT Administrator focused feature overview, Sesha Mani and Nikita Bandyopadhyay walk through Microsoft 365 Information Barriers (IB) and how IB policies interplay with SharePoint, OneDrive and Teams experiences. Capabilities are demonstrated and Q&A addresses licensing, availability, future direction. Essentially, IB is a 2nd layer of authorization, the first being SP permissions, explicitly associated to people and sites for controlling access to and dissemination of information for compliance purposes. Information Barriers - already available for Teams was extended to SharePoint and OneDrive in June. This PnP Community demo is taken from the SharePoint (PnP) Community call – July 2020 – Monthly sync call recorded on July 14, 2020.
Topic Presenters:
• Sesha Mani (Microsoft) | @SeshaManiS
• Nikita Bandyopadhyay (Microsoft) | @nikbango
Supporting materials:
• Use information barriers with SharePoint | http://aka.ms/SPOInfobarriers
• Use information barriers with OneDrive | http://aka.ms/OneDriveInfobarriers
• Information barriers in Microsoft Teams | http://docs.microsoft.com/en-us/microsoftteams/information-barriers-in-teams
Learn more:
• Learn more about the SharePoint developer community at: http://aka.ms/m365pnp
• Visit the SharePoint PnP Developer Community YouTube channel: https://aka.ms/spdev-videos
A
All
up
and
I
have
here
with
me
today
and
Nikita
band
yo
Patti
and
she
is
a
program
manager
in
my
team
and
specifically
focusing
on
this
particular
information
barrier
feature.
So,
let's
actually
get
started.
The
agenda
that
we
were
thinking
to
share
with
you
is
to
share
the
top
level
industry
trends.
What
we
are
seeing
in
the
security
and
compliance
space
and
then
what
is
the
information?
Various
scenario?
A
Some
of
you
might
be
already
familiar
with
this
and
we
like
to
give
you
set
the
stage
for
what
is
the
scenario
indeed
and
then,
more
importantly,
how
the
information
barrier
interplays
within
sharepoint
one
dry
and
also
teams
experiences
as
well,
and
we
will
walk
you
through
that
quicker
demo
and
also
share
with
you
how
you
can
take
advantage
of
these
features
and
what's
next
there
and
definitely
we'll
make
sure,
there's
a
Q&A
session
at
the
end
as
well.
So
let's
get
started
of
the
industry
trends.
A
The
first
and
foremost
thing
I
would
say
here
is
the
exponential
growth
that
we
are
seeing
in
that
digital
data.
So
gone
are
the
days
where
you
really
have
physical,
informational,
corporate
information
in
the
physical
format.
But
now
everything
is
being
digitized.
Every
industry
is
becoming
a
software
technology
company
and
what
it
means
is
in
any
industries
companies.
A
The
other
key
industry
trend
that
we
are
seeing
is
increasing
the
regulatory
needs.
Compliance
and
regulations
are
definitely
increasing
in
this
digital
world,
especially
as
more
and
more
data
is
becoming
digitized
and
it
is
exponentially
growing.
The
regulators
are
watching
very
carefully
and
ensuring
that
the
governance
is
put
in
place.
A
It
actually
happens
across
all
the
different
verticals
and,
for
example,
if
you
just
take
one
example
of
verticals,
which
is
finance
companies,
there
is
a
compliance
called
FINRA
and
this
Authority
has
enforced
that
thin
serve
customers
being
able
to
showcase
that
they
can
stop
insider
trading
within
the
company.
What
it
means
is
so
imagine
you
have
Investment
Banking,
Department
and
advisory
department
inside
a
finance
companies
of
insured
company.
A
Now,
because
of
the
nature
of
these
two
departments,
it's
quite
possible
that
investment
bankers
who
work
with
normally
individuals
like
you
and
me,
helping
us
to
choose,
write
stocks
to
trade
and
things
like
that.
They
might
have
some
additional.
You
know,
potentially
some
information
they
may
get
from
the
heart
rate
advisors,
which
are
typically
Department,
the
users
that
are
working
with
corporates,
such
as
Microsoft,
LinkedIn
and
so
on.
So
they
have
much
more
higher.
Information
like
Microsoft
is
about
to
acquire,
let's
say
LinkedIn.
A
So
if
that
kind
of
information
is
getting
leaked
over
to
the
Investment
Banking
Department
users,
then
investment
bankers
could
use
that
for
helping
their
clients
together.
This
is
what
they
mean
by
insider
trading.
It's
a
conflict
of
interest
in
their
job
duties
that
they
do
in
their
organization,
so
FINRA
and
in
through
the
sec
has
required
that
customers,
especially
the
fin
sub
customers,
need
to
be
able
to
showcase
to
sec
that
they
have
controls
in
place
to
block
the
communication
and
collaboration
between
these
two
departments,
and
I
want
to
be
super
clear.
A
This
isn't
one
example
in
a
one
particular
vertical,
but
I'm
pretty
sure
many
of
you
are
already
having
this
kind
of
requirement
in
your
own
industries
as
well,
be
it
energy
industry
or
healthcare
industry
where
the
HIPAA
compliance
is
super.
Critical
and
also
many
other
government
agencies
is
the
other
one
too.
So
we
do
see
this
increasing
need
for
controlling
internal
collaboration
and
sharing,
just
because
of
the
nature
of
the
job
on
the
role
that
the
individual
is
playing
in
your
organization.
A
So
let
me
actually
give
you
a
quick
view
of
building
it
down
to
Microsoft
365.
So
you
imagine
that
in
an
organization
like
contoso,
a
Bank
Corporation
Investment,
Banking
Department
has
their
own
teams
and
SharePoint
sites
that
they
manage
and
they
work
with
and
then
say
there
are
thousand
users
in
that
Investment
Banking
Department
and
then
you
have
corporate
advisor
Department.
Let's
say
there
are
500
users
in
that
department
and
they
have
their
own
teams
experiences.
A
There
is
investment
bankers
and
then
there
are
advisors
but
then
also,
more
importantly,
you
have
the
rest
of
the
employees
in
your
organization.
So
really
really,
if
you
think
about
this,
there
are
actually
three
segments
here.
One
is
investment
bankers,
then
advisers,
then
the
third
one
is
the
yellow.
Color
in
this
picture
is
all
the
rest
of
the
employees
in
your
organization.
A
Really
the
requirement
is
investment.
Bankers
should
be
able
to
access
their
investment
banking,
related
information.
The
advisers
should
be
able
to
access
their
adviser
related
information,
but
then,
more
importantly,
only
they
should
be
able
to
access
it,
investment,
banking
resources
or
should
not
be
accessible
by
advisory
department,
users
or
even
the
rest
of
the
employees
in
your
organization.
That's
why
the
conditional
access
information
barrier
must
match
in
order
to
access
a
Content.
A
SharePoint
site
are
a
onedrive
content,
is
has
to
be
there
and
I
want
to
take
a
minute
to
call
this
particular
out.
A
This
is
really
the
crux
of
this
whole
feature,
which
is
all
of
you
know.
Already.
There
is
a
SharePoint
permissions
model,
which
is
you
can
share
a
file
or
a
site
with
a
person,
and
now
that
person
has
access
to
the
site
and
a
file.
Now
we
have
actually
added
an
additional
authorization
layer.
On
top
of
that,
it's
not
enough
to
have
authorization
provisions
just
for
the
site
and
a
file.
You
must
also
match
the
conditional
access
for
information
barrier
segments
as
well.
A
That
means,
if
a
given
SharePoint
site,
if
it
is
tagged
as
investment
bankers
site,
then
you
must
be
one
of
the
investment
bankers
to
access
that
particular
site,
no
matter
whether
you
have
permissions
already
given
to
the
site
through
some
other
means
or
not.
So
in
a
way,
it's
a
two
layer.
Authorization
is
what
we
have
introduced,
and
this
is
a
very,
very
powerful
security
permissions
mechanism,
because,
as
you
can
imagine,
no
matter
what
your
permission
says
in
the
given
site
or
a
file
the
moment
you
flag
a
site
as
investment
bankers.
A
Specific
site,
then
immediately
is
the
union
of
you
must
be
an
investment
banker
and
you
must
have
access
to
the
SharePoint
site
in
order
to
actually
gain
access
to
the
content
inside
the
site.
So
we
believe
this
is
really
a
transforming
authorization
and
permissions
model
and
will
help
many
organizations
that
are
in
need
of
this
insider
trading
related
regulations.
A
The
second
important
aspect,
I
would
call
out,
is
if
I
am
inside,
that
investment
banker
site,
who
can
I
actually
share
the
file
with
so
that
is
you're
actually
taking
the
experience
level
as
well.
So
if
I
am
an
investment
banker,
say
sure
and
now
I'm
trying
to
share
file
with,
let's
say
Nikita
and
she
happens
to
be
advisory
user.
A
Are
they
who
happens
to
be
coming
from
rest
of
the
organization
in
my
company,
then
I
will
be
blocked
from
sharing
that
particular
site
for
a
file
in
the
site,
mainly
because
I
am
the
investment
banker
and
I
am
also
working
in
the
context
of
the
SharePoint
site.
That
is
flagged,
as
meant
for
investment
backers,
so
we
actually
have
done
I
would
say
a
comprehensive
analysis
on
which
experiences
also
where
we
need
to
apply
this
investment
information
barrier
policy
as
well.
A
I
gave
you
a
10,000
foot
view
on
what
is
information,
barriers
scenario
and
how
in
Microsoft
365
we
are
bringing
this
forward.
To
put
it
in
a
simple
terms,
you
will
be
able
to
segment
your
users
in
your
organization
based
on
your
compliance
requirements.
So,
for
example,
you
can
say
these
thousand
users
are
investment
bankers.
These
500
users
are
corporate
advisers
and
then
you
have
restaurant
the
company
and
the
way
you
can
segment
them
and
again
I
will
walk
you
through
in
details.
A
In
a
minute,
just
based
on
your
existing
Azure,
Active,
Directory
properties,
so,
for
example,
location
of
the
user
are
the
department
property
of
the
user.
So
you
can
choose
a
specific
SharePoint
product
directly.
Property
are
a
security
group
and
then
use
that
to
segment
the
users
and
then
be
very
clear.
A
This
is
the
compliance
segmentation
that
you
are
bringing,
so
it
is
very,
very
critical
that
it
needs
to
be
predictable,
and
that
means
a
given
user
can
become
part
of
only
one
compliance
segment
at
a
time
because,
from
a
compliance
point
of
view,
you
need
to
be
able
to
show
to
your
officers
that
satiable
ons
to
adjust
investment
bankers.
That's
his
role,
that's
what
it
does
in
my
organization.
The
second
thing.
B
A
Third
one
segmenting
users,
onedrive
is
also
is
coming
into
play
because
if
investment
banker
as
Asia
is
investment
banker
that
even
from
his
role
on
Drive
like
easy
allowed
to
share
with
rest
of
the
organization's
or
with
copied
advisers,
so
we
do
believe
we
are
bringing
the
IB
policy
enforcement
to
onedrive
as
well,
and
I
quickly
walked
you
through
the
FINRA
compliance
requirement
with
your
financial
sector.
So
with
that
I'm
gonna
doubt
turn
it
over
to
Nikita
to
walk
us
through
a
quick
demo
of
this
scenario.
C
You
Sasha,
let
me
quickly
share
my
screen:
Thank
You
Sasha.
Now,
let's
get
into
the
details
of
how
information
value
of
works
for
SharePoint
and
onedrive.
So,
like
Sasha
said
we
are
giving
you
the
capability
to
set
segments
on
a
particular
SharePoint
site.
The
whole
idea
is:
if,
in
your
organization,
you
have
certain
SharePoint
sites
that
need
to
be
protected
with
information
barrier
policies.
We
are
allowing
your
SharePoint
administrator
to
set
segments
on
those
sites.
The
sites
of
scope
are
modern
sites
as
well
as
classic
sites.
C
Today,
only
the
contents
of
the
site
are
segments
associated
all
other
group.
Resources
are
currently
not
segments
associated
access.
Like
Sasha
said
we
have
done
extensive
work
to
ensure
that
the
conditional
access
control
honors,
the
IB
policy,
which
is
associated
to
the
site,
as
well
as
the
sharing
control,
will
be
allowed
only
per
the
segments
that
are
stamped
on
the
site.
Now,
let's
see
how
all
this
takes
care
of
now
today,
with
SharePoint
information
barriers,
the
SharePoint
administrator
can
use
the
SharePoint
PowerShell
module
to
add
segments
to
a
site
on
the
screen.
C
You
can
see
that
we
have
extended
our
set
SPO
site
command,
let
and
added
two
new
F
and
have
added
tonio
parameters,
add
information
segment
and
remove
information
segment,
using
which
the
admins
can
now
add
all
the
compatible
segments
that
they
want
to
add
to
a
site
as
well
as
if
they
don't
want
to
have
a
segment,
they
can
remove
it
using
the
remove
information
segment
commandment,
they
can
also
check
what
are
the
segments
which
are
associated
on
the
site
using
PowerShell.
This
can
be
achieved
using
the
get
SPO
site
command
line.
C
Now
also,
we
understand
that
as
a
site
owner,
you
want
to
know
what
are
the
different
properties
which
are
stamped
on
the
site.
So,
as
you
can
see
here
in
the
site,
information
panel,
the
site
owner
would
be
able
to
view
the
segment's
which
are
associated
on
the
site.
The
example
that
I
have
here
is
this
is
an
advisory
team
site
and
we
have
displayed
the
new
property,
which
is
information
segment
and
it
clearly
says
its
corporate
advisory.
C
Now,
once
the
site
is
segment
associated,
the
site
is
protected
by
IB
policy,
so
access
for
the
site
is
only
allowed
to
users
whose
segments
belong
to
the
same
as
that
of
the
site
and
who
also
have
site
access
permission.
So,
in
short,
the
user
needs
to
meet
both
the
condition.
One,
the
basic
site
access
permission
as
well,
as
should
have
the
same
segment
as
that
of
the
site.
If
either
of
these
conditions
are
not
met,
the
user
will
not
be
able
to
access
the
segment
associated
site.
C
This
is
a
typical
access
denied
error,
page
that
the
user
will
see
if
he
isn't
either
not
belonging
to
the
same
segment
as
that
of
the
site
which
is
trying
to
access,
or
he
does
not
have
the
site
access
permission.
Some
of
you
might
think:
hey
what
happens
if
the
users
segment
changed
now
if
they
use
a
segment
change
every
time
the
user
is
trying
to
access
a
site,
we
will
check
at
access
time
if
the
user
belongs
to
the
same
segment
as
that
of
the
site.
C
So,
for
example,
if
a
user
was
belonging
to
investment
banking
information
segment
and
was
accessing
a
site
if
few
months
later,
the
user
changes
job
and
moves
to
cooperate
advisory,
the
user
will
now
lose
access
to
all
the
previous
investment
banking
sites,
because
at
access
time,
when
we
match
the
segment,
the
user
no
longer
belongs
to
Investment
Banking.
He
has
actually
moved
to
corporate
advisory.
So
the
main
idea
here
is:
we
always
check
at
run
time
to
make
sure
that
the
right
user
is
accessing
a
sharepoint
site
which
is
protected
with
information
values.
C
Also,
sharing
is
another
way
of
allowing
users
access
to
your
site,
so
we
have
done
extensive
work
to
make
sure
that
the
site's
sharing
control
is
also
protected
with
information
by
Rhian
policy.
It's
a
few
things
that
we
have
done
here.
I'll
start
with
the
leftmost
one.
Most
of
you
might
be
aware
of
anyone
with
link
sharing
option.
This
is
a
powerful
tool
which
you
can
you
know
once
you
share
a
site
or
a
content
with
anyone
were
think,
then
the
user
does
not
need
to
sign
and
they
can
automatically
anonymously
access
the
content.
C
So
for
information
values,
we
have
made
sure
that
anyone
with
link
option
is
disabled
because
the
site
is
protected
with
IB.
The
second
thing
that
we
have
done
is
the
centermost
one,
which
is
the
site,
and
its
content
can
only
be
shared
with
the
same
segment
users
as
that
of
the
site.
So
in
the
example
you
can
see
that
this
site
is
being
shared
with
user
Jeff,
but
cannot
be
shared
with
user
Nikita,
because
Nikki
that
does
not
belong
to
the
same
segment
as
that
of
the
site.
C
Moving
from
sharepoint
to
onedrive,
as
you
have
understood
so
far,
that
with
information
barriers,
we
are
allowing
the
users
or
the
admins
to
segment
users,
which
means
you
are
classifying
your
user
as
an
investment
banker
user,
for
example,
or
a
corporate
advisor
user.
So
it's
basically,
the
user
also
has
an
information
segment.
Now,
if
the
user
has
an
information
segment,
what
we
are
doing
is
the
users
onedrive
will
automatically
get
associated
with
the
user
segment
for
their
policy.
C
So
if
a
user
belongs
to
Investment
Banking,
the
users
onedrive
site
will
automatically
get
associated
with
investment
banking,
as
well
as
other
segments
which
are
allowed
to
Investment
Banking
per
policy.
Also,
we
are
allowing
the
SPO
admin
to
manage
the
segment
association
on
a
onedrive
using
the
SPO
powershell.
So
similarly,
how
an
SPO
admin
can
add
segments
on
remove
segments
from
a
SharePoint
site.
We
are
also
allowing
them
to
manage
it
for
the
onedrive
sides.
C
Now,
once
the
I
once
the
onedrive
is
associated
with
segments,
the
access,
control
and
sharing
control
will
be
allowed
for
the
IB
segments
on
the
site.
So
it's
similar
to
how
the
access,
control
and
sharing
control
will
work
for
a
typical
SharePoint
site.
So
out
of
the
box
of
the
user,
has
a
segment
associated
the
users.
Onedrive
will
also
automatically
be
associated
with
the
segment.
C
C
For
that
particular
team
going
forward,
the
Microsoft
team's
files
experience
and
the
SharePoint
site
associated
to
it
will
also
be
honored
based
on
the
policies
of
the
members
of
that
team,
so
the
access
will
be
granted
based
on
the
segments
which
are
on
that
team,
as
well
as
the
sharing
control
will
be
based
on
the
segments
which
are
on
that
particular
team.
With
that,
let
me
quickly
give
you
a
demo
of
how
this
all
works.
C
So
here
is
M
365
security
and
compliance
center.
Like
we
mentioned
earlier,
information
values
is
a
unified
policy
across
and
365,
so
the
compliance
admin
will
have
to
go
to
your
m
365
security
and
compliance
Center
to
define
segments
and
the
Associated
policy.
Today
that
can
be
achieved
using
Sec
PowerShell
module.
Here
I
am
showing
you
a
mock-up
of
how
all
this
works
through.
So
this
is
an
example
where
the
compliance
admin
has
gone
ahead
and
created
two
segments
for
this
contoso
tenant.
The
segments
are
investment,
banking
and
advisory.
C
Today
we
allow
you
to
use
about
20
Azure,
Active,
Directory
properties
using
which
you
can
define
information
segments
here
is
an
example.
The
compliance
admin
has
defined
Investment
Banking
segments
using
the
fields,
location,
user,
principal
name.
You
can
use
other
fields
like
city
department,
so
on
and
so
forth.
So
here
is
the
definition
of
Investment
Banking.
C
Also,
there
is
another
segment
defined
which
is
advisory.
They
locate
the
attributes
that
have
been
picked,
our
location
and
user
principal
name
once
the
segment's
are
defined.
The
next
step
is
defining
the
policy.
Typically,
the
customers
define
a
blog
policy.
The
whole
idea
is,
you
do
not
want
your
investment
bankers
to
communicate
and
collaborate
with
advisory.
So
here
you
can
see
that
I
have
set
up
a
policy
which
says
Investment.
C
C
Now,
once
the
policies
have
been
defined
like
I
said,
if
the
user
is
associated
with
their
segment,
then
their
onedrive
will
automatically
get
associated
with
the
user
segment
and
any
other
point
in
any
other
segment
that
is
allowed
to
the
user
segment
per
policy.
So
here
is
an
example
of
users.
If
you
remember
from
the
mock-up
user,
satiable
Ong
Investment,
Banking
segment,
so
here's
a
Stacia
as
onedrive
for
business.
This
has
automatically
not
associated
with
Investment
Banking
segment
same
as
Asia
segment.
C
Now,
access
to
this
particular
onedrive
will
be
granted
only
to
users
whose
segment
matches
that
of
the
investment
banking
segment,
which
is
on
the
onedrive
as
well
as
the
sharing
control,
will
honor
Investment
Banking
segment.
So
what
does
that
mean
is?
If
you
say
she
wants
to
share
a
particular
file
with,
say
user
Jeff,
you
remember,
user
Jeff
is
an
investment
banker.
He
will
be
able
to
do
so
user
using
the
people
picker.
C
But
if
users
Asia
tries
to
look
up
or
even
share
the
site
or
its
content
with
user
Nikita,
he
would
not
be
able
to
do
so
because
Nikita
belong
to
corporate
advisory
and
/
investment.
Banking
policy
invest
and
/
IP
policy.
Investment
Banking
is
not
allowed
to
communicate
and
collaborate
with
advisory
and
because
Nikita
is
an
advisory
say.
Shah
would
not
be
even
able
to
discover
her,
let
alone
be
able
to
share
the
content
with
her
through
people
picker.
C
So
this
is
how
we
make
sure
that
the
access
is
governed
by
the
segments
which
are
on
the
site,
as
well
as
the
sharing
is
purely
governed
by
the
segments
which
are
stamped
on
the
site.
Now,
switching
gears
to
a
SharePoint
site
here
is
a
SharePoint
site
which
is
Australian
banking
site
that
was
created.
The
SharePoint
administrator
has
gone
ahead
and
set
segment
investment
banking
on
this
particular
site,
using
PowerShell
module
as
the
site
owner
now.
I
can
go
to
the
site
information
panel
and
see
that
the
information
segment
of
the
site
is
Investment
Banking.
C
So
this
is
how
the
site
owner
would
know
that.
Ok,
my
site
is
now
protected
with
Investment
Banking
site
or
Investment
Banking
segment,
and
once
the
site
is
protected
by
segment,
the
access,
control
and
sharing
control
would
be
governed
by
the
segment's
on
the
site.
Again,
if
user
is
trying
to
share
a
content
from
this
site
with
user
lakita,
he
would
not
be
able
to
do
so
because
Nikita
does
not
belong
to
investment-banking
segments.
C
Now
you
might
think
okay,
this
is
all
good.
What
does
this
mean
in
terms
of
licensing?
Can
we
get
the
M
365
information
barrier
policy
for
any
license
or
not?
So
this
is
a
comprehensive
compliance
feature
and
it
would
be
available
with
all
re
5
licenses.
So
if
you
have
M
365,
P,
5
or
office
365
a
5
or
a
5
compliance,
then
you
would
be
able
to
have
information
segment
information
barrier
feature
in
your
tenant.
C
A
And
thanks
Nikita,
as
well
so
I'm,
going
to
go
ahead
and
share
my
screen
where
you
can
take
the
next
step
or
the
link
where
you
can
learn
more
about
this
feature,
AKMs
slash
as
fewer
info
barriers.
That
will
give
you
a
link
to
information
about
all
sharepoint,
related
information
and
then
slash
onedrive
info
barriers
is
also
available,
and
then
there
was
a
question
about
is
g8.
Where
is
it
it's
a
preview
and
so
on?
A
So
this
information
barrier,
as
we
discussed
as
we
showed,
you
is
actually
available
as
a
general
availability
for
June
20th
and
there's
a
process
you
need
in
this
documentation.
We
explain
to
you:
how
do
you
nominate
yourself
if
you
wanted
to
get
added
in
your
talent,
okay,
so
I'm
going
to
go
through
the
questions
that
got
asked
in
the
chat
window
as
much
as
I
can
just.
B
A
quick
note
before
she
shuts
not
that
I
can
say
a
few
hands
on
the
on
the
session,
but
let's
use
to
chat,
win
chat
in
this
time
because
there's
more
than
240
people
in
this
call,
so
we
can't
really
go
to
audio
it.
Doesn't
it
doesn't
work
like
that?
That's
well
within
this
amount
of
people.
So
let's
use
the
chat
for
questions
if
you
don't
mind
so
session,
so
free,
yes,.
A
Thanks
Teresa,
so
user
should
be
added
on
SharePoint
group
and
ad
group.
In
order
to
get
this
working
though
the
lead
here
is,
the
user
needs
to
be
in
your
Azure
Active
Directory
and
either
you
can
use
a
property
on
the
user
object,
such
as
department,
property
or
location
property,
and
so
on,
to
create
these
segments
that
Nikita
was
showing
or
you
can
use
a
security
group
that
you
have
defined
in
as
your
Active
Directory
to
use
that
to
define
a
segment.
A
So
it
has
to
be
some
security
principles
in
Azure,
Active,
Directory
and
just
to
double
click
on
that
there
was
a
question
about:
can
a
dynamic
security
group
in
Azure
Active
Directory
be
used
in
order
to
define
your
segment,
and
the
answer
is
yes,
as
long
as
it's
a
Azure
Active
Directory
security
group
doesn't
matter
whether
it
is
a
static
or
dynamic
one,
then
you
can
use
that
for
segment
creation.
Now
I
do
want
to
emphasize
that
these
segments
Association
are
very
strictly
compliance
and
regulatory
driven.
A
Go
up
is
email,
communication
blocked
by
exchange,
so
the
info
barrier,
information
barrier
policy
that
you
are
creating
as
the
Nikita
showed
is
actually
you
are
creating
it
in
the
Microsoft
365
security
and
compliance
compliance
center
and
that,
once
it's
created
for
communication
in
teams,
as
well
as
in
email
communication,
those
will
get
honored
and
then,
in
the
context
of
collaboration
in
SharePoint
and
onedrive.
These
will
get
honored
in
that
aspect
as
well,
and
there
is
more
work.
A
We
are
planning
to
do
for
exchange
specific
information
barriers
and
stay
tuned
for
more
updates
on
that
later,
this
country.
Yet
so,
ok,
this
be
available
for
guest
user
accounts
in
your
tenancy.
As
long
as
there
is
an
user
account
in
your
Azure
Active
Directory
and
you
have
the
appropriate
licenses
assigned
to
them
in
this
case.
This
feature
does
require
a
5
to
be
assigned.
A
When
will
this
be
made
available?
Will
it
be
for
office,
T,
5
or
just
M,
365
I,
think
this
is
for
office.
365
services
like
SharePoint
onedrive
teams
and
exchange
itself.
It's
the
I
would
say
the
branding
wise
we
are
all
using
now.
Microsoft
explained.
That's
reason
why
it
is
called
as
Microsoft
least,
five
information
barriers.
A
C
Is
a
question
the
limit?
What's
the
limit
on
how
many
segments
can
we
create?
So
today
you
can
create
up
to
hundred
segments
in
your
tenant,
but
on
a
SharePoint
site
you
can
set
only
up
to
10
compatible
segments
on
a
site,
so
in
a
tenant
they
can
be
up
to
hundred
segments
but
on
a
site
collection.
Today
you
can
set
up
to
ten
segments
only.
A
I
think
the
search
results,
I
already
confirmed
it,
which
is
search
results,
will
be
security,
trimmed
based
on
this
information
barrier
policy.
And
yes,
if
you
changing
your
segment
and
it
will
have
impacts
across
your
segmented
sites
and
the
corresponding,
such
as
well
so
changing
a
segment
of
a
user
is
a
very
big
deal
like
as
I
said.
Typically,
when
you
change
the
role
from
investment
bankers
to
corporate
advisors,
it's
not
a
you
know.
A
Everyday
kind
of
activity
you
do
is
maybe,
once
in
multiple
years,
that
you
change
the
role
in
your
organization,
so
that's
a
very
typically
seldom
running
activity
and
what
scope
this
IB
policy
is
enforced.
You,
as
I
explained
this
is
at
the
site,
collection,
scope,
that's
the
level
that
you
associate
a
given
information
barrier
and
that's
where
the
information
barrier
policy
is
also
enforced.
A
Okay,
I
think
I
covered
most
of
the
questions.
Let
me
build
segments
be
defaulted
for
site
memberships
that
get
auto
created
from
project
online
site
creation
using
PW
a
permissions
not
necessarily
like
segment
Association
to
a
given
site
collection.
Be
it
whether
it
is
created
from
project
online
or
you
are
creating
using
a
custom
site
provisioning
script.
You
would
have
to
take
an
explicit
step
to
associate
a
segment
to
a
site
collection.
Again,
it's
a
compliance
regulatory
feature.
A
So
you
need
to
be
aware
and
be
very
thoughtful
and
mindful,
then,
you
are
actually
associating
to
a
site
collection.
It's
also
hitting
an
IP
segment
to
a
site
collections.
That's
why
it's
an
explicit
step!
There's
no
automatic
association
happens
whatsoever
in
the
SharePoint
sites,
so
you
do
have
to
take
explicit
step
to
associate
an
IB
segment
to
a
SharePoint
site
collection.
A
Okay,
there
was
a
question
about
the
difference
between
sensitivity,
labels
and
the
information
barrier
policy.
That's
a
really
good
question.
Let
me
give
a
meta
clarification
there.
So
sensitivity.
Labels,
as
you
know,
is
meant
for
securing
all
your
policies
into
a
single
label,
let's
say
creating
a
top-secret
label
and
if
you
have
associate
different
policies
to
it,
like
your
privacy
policy
or
unmanaged
device
policy,
and
so
on.
A
Typically,
that
is
meant
for
allistic
security
control
of
your
organization
and
of
your
site
collection,
whereas
this
info
barrier
that
we
just
shared
with
you
is
primarily
compliance
and
regulation.
Oriented
control-
and
this
is
also
meant
just
it
by
itself-
is
a
policy
and
you
can
associate
it
to
a
site
and
to
a
given
user.
So
it's
a
very
predictable
access
mechanism
that
you
can
conform
to
your
compliance,
auditors
and
so
on.
A
So
that's
how
you
should
that's
all
internalize
these
two
models
now
in
the
future,
as
we
think
further
ahead
in
the
future,
would
we
look
at
bringing
them
together
in
some
fashion
or
so
that's
definitely,
you
know
we're
thinking
about
it
and
we
will
see
if
there
is
a
natural
fit,
then
we
will
definitely
try
to
look
into
it
further,
but
for
now
you
should
think
of
them
as
a
independent
concept.
One
is
sensitive.
A
Labels
meant
for
orchestrating
many
policies
and
is
meant
for
protecting
your
content,
whereas
info
barrier
is
all
about
compliance
and
regulatory
needs.
That's
why
the
segment's
associating
into
a
site
and
a
user
is
super
critical.
Okay,
I'm
going
to
take
one
last
question:
we
see
whether
any
new
message
is
soon
so
the
question
was
any
plans
to
mirror
this
functionality
in
M
Cass.
A
B
A
Yes,
yes,
definitely
it's
the
Microsoft
cloud,
app
security.
It's
a
one
of
the
security
broker
product
Casspi
product.
We
call
it
cloud
access
security
broker,
product
that
Microsoft
sales.
Typically,
it's
used
for
all
the
applications
in
your
enterprise,
not
only
just
office
65,
but
all
the
applications.
If
you
want
to
secure
them,
then
MCAS
is
our
product
suite
that
helps
you
to
achieve
that
excellent.
B
B
What
I
thought
cute
cute,
but
thank
you
Thank
You
session
Thank
You
Nikita
for
this
one,
a
really
great
stuff
and
great
capability,
a
summation
already
numerous
times
on
discussions.
It
is
an
e5
capabilities,
so
it's
an
advanced
capability
but
I
think
there
will
be
a
lot
of
customers
who
are
interested
on
this
kind
of
a
security
and
compliance
e
features.
So
it's
really
great
to
see
and
these
kind
of
things
being
available
in
the
most
of
365
level.