Site icon Joanne C Klein

Protecting your Teamwork in Microsoft 365

Joanne Klein
Reading Time: 9 minutes

If Microsoft Teams and SharePoint sites are being created en masse across your tenant and your end-users are incorporating them into their daily work lives, reality is starting to sink in. As an IT Administrator, you likely have some concerns:

 

These are all valid concerns, however don’t let this stop progress! 2 key things to keep in mind:

Thing 1… Allowing end-users to create an abundance of Teams for collaboration means content is being stored in Microsoft 365. If you’re throttling the creation of Teams, where are end-users storing their content? You can be sure they’re storing it somewhere and it may not be in Microsoft 365! Conversely, if it’s stored in Microsoft 365, you have an opportunity to control it and ultimately protect it – a good thing.

Thing 2… IT teams need to challenge legacy ways of thinking about control. A mind-shift is required to move from “preventing Teams and Sites being created in the first place” to “allowing it, but with intelligent controls”. I believe this is the most secure course of action over the long term. The sooner controls can be understood, configured, and implemented to protect, secure, and retain your content, the more compliant position your organization will be in.

The required mind-shift is a move from “tight control” to “enlightened control”… moving to a secure and compliant Microsoft 365 environment with fit-for-purpose compliance.

Move from tight-control to enlightened-control to gain fit-for-purpose compliance across Microsoft 365 Share on X

The remainder of this post will talk about a sampling of Microsoft 365 controls and configurations you could put in place to help address each concern above. In all cases, it’s a combination of controls addressing the concern to demonstrate the point that no one tool or feature will fix the problem.

Controls covered in this post.

Concern: How to prevent proliferation of Teams/Sites

Although the technical limit for the number of sites across any tenant is currently 2 million (as of January 2020), most organizations will still want to control the number of them being provisioned for compliance and support reasons. Here is a sample of features (controls) you could implement to help:

Concern: How to prevent IP from being lost

Our tenants are full of content, however not all content has the same business IP value and therefore shouldn’t be painted with the same broad brush when it comes to security and protection. This is a departure from the legacy way of protecting all corporate digital assets where protection was once done at a broader, container level. A more intelligent, enlightened way to protect content is at a granular, data level. This is due, in large part, to organizations no longer having the luxury of data being contained within their network perimeter – we routinely need to collaborate with external partners, vendors,  and customers and therefore need the protection to remain with the data wherever it travels.

Many of the new controls being introduced across Microsoft 365 are reliant on your data classification scheme to take action based on the sensitivity of the data. This is why it’s the critical foundation for protecting your content in an enlightened and intelligent way.

For example, you may not care if someone shares a project document with an external user on a project team, however you likely care a great deal if someone shares a sensitive, highly confidential contract with an external party.

There are numerous features across Microsoft 365 to help prevent the loss of IP.  Both security and protection controls play a part in the overall solution. I’m focusing on protection controls below, however know that there are other security features to be aware of that would also help with this concern (Microsoft Cloud App Security, Conditional Access to name a few).

Concern: How to prevent external users from accessing things they shouldn’t

There are numerous ways to do this spanning from blocking external access entirely to allowing it, but in a controlled way. One important thing to remember about your approach is to acknowledge the fact that if you disable external access, it is likely going to happen anyway without your consent. I believe the risk is significantly minimized by implementing reasonable, mitigating controls, allowing external access, and auditing what/who users are sharing content with across your environment.

First and foremost, this assumes you have site permissions set up correctly and your own information workers are storing content in the right place. E.g. Have they accidentally stored a confidential document on a site shared with external users? If the document has a “Confidential” sensitivity label applied to it preventing the external user from gaining access, then your bases are covered, but what happens if you don’t? This is why information worker training is so important when collaborating with external users!

Let’s first define the difference between external access and guest access…

External Access (Federation): this gives access to entire domains or excludes entire domains (For example, contoso.com). In Microsoft Teams, external access users can call, chat, and set up meetings with you.

Guest Access: this gives access to an individual. In Microsoft Teams, guest access users can call, chat, meet, and collaborate on files stored in your SharePoint and OneDrive for Business sites. When you share a file with someone in a SharePoint site, they become a guest user in your tenant. You can also limit external sharing by domain if required. Guest users are added to your organization’s Active Directory.

I’m focusing on guest users. There are several authorization levels for authorizing guest access going from broad (Azure AD level) to targeted (File level):

Because you can configure authorization at all of these levels, it provides a lot of flexibility in setting up guest access across your tenant, however it does require ongoing governance to ensure external access is limited and expired when no longer required.

Tip: Include “How to Share” training to information workers in your organization. Include things like expiring the sharing link, adjusting the view/edit setting, and how to block download. These are all features required at times.

Site Owners can gain insight into what’s being shared with external users across their site from their Site usage page (Report on file and folder sharing in a SharePoint site). This is an important governance task to communicate to all site owners so they can periodically review and adjust if the share is no longer required.

If you’re lucky enough to have an Azure AD Premium P2 license, leverage Azure AD Access Reviews (Link) to set up recurring access reviews of users at set frequencies (weekly, monthly, quarterly or annually). The reviewers will be notified at the start of each review. Reviewers can approve or deny access with a friendly interface and with the help of smart recommendations.

Closing thoughts

How are YOU protecting your Teamwork in Office 365? Are you satisfied with the controls your organization has in place? Are you impeding the collaboration experience for your end-users or have you found a good balance? I’d love to hear from you!

Thanks for reading!

-JCK

Exit mobile version