General availability of ‘know your data’

Announcing general availability of ‘know your data’ (discovery and review capabilities) in the Microsoft 365 compliance center

As employees shift to working remotely, it is more important than ever that organizations prioritize protecting their business-critical and sensitive data. Your employees are accessing, sharing, creating, and storing data in new ways, and you need to make sure this is being done in a protected and compliant manner. At Microsoft, our goal is to provide a built-in, intelligent, unified, and extensible solution to protect and govern your data across your digital estate – in Microsoft 365 cloud services, on-premises, third-party SaaS applications, and more. With our Information Protection & Governance solution, we are building a unified set of capabilities for discovery, classification, labeling, protection, and governance not only in Office apps, but also in other popular productivity services where information resides (e.g. SharePoint, Exchange, OneDrive).

Know your sensitive data

The first step in the journey to protect and govern your data is getting a holistic understanding of the sensitive data in your digital estate. The data classification capabilities in the Microsoft 365 compliance center enable you to discover, classify, review, and monitor your data and establish appropriate policies to better protect and govern critical data (e.g. by applying sensitivity and retention labels or data loss prevention policies).

Today, we are excited to announce the general availability of ‘Overview’, ‘Content explorer’, and ‘Activity explorer’ capabilities to give you a holistic view of your sensitive data.

The Overview tab shows you at-a-glance the most common sensitive information types and labels used in your organization and how they are being used. You do not need to set up any policy to understand these details.

Figure 1. Overview tab showing a quick snapshot of data classification and usage of sensitivity and retention labels

The Content explorer tab provides you with a richer understanding of data at risk by displaying the amount and types of sensitive data in a document. An integrated viewer displays the full content in documents or emails for those with appropriate permissions. You can also filter by label or sensitive type to get a detailed view of locations where sensitive data is stored. Based on your feedback, we have added the ability to ‘Search’ and find sensitive files in specific locations or by specific file types or file names.  You can also now ‘Export’ the meta data of content displayed into Excel, for further reporting and investigation, with a single click.

Figure 2. Integrated viewer showing contents of document in the ‘Content explorer’ tab

Note: OneDrive views in this experience will remain in ‘preview’ mode while we incorporate your feedback. We appreciate your continued support on this and thank you for your feedback.

The Activity explorer tab provides a better understanding of activities related to your sensitive data, sensitivity and retention labels , such as decreased protection due to label downgrades or changes. It helps you investigate events that could be leading towards data leak scenarios (e.g., removal of labels). Understanding these activities gives you the ability to identify the right policies for protection or data loss prevention (DLP) to ensure that your most sensitive data is secure.

Figure 3. Activity explorer tab displaying activity related to sensitive information

Customer feedback 

A large financial services customer, for example, used these new capabilities to discover vulnerable data on their 8000 SharePoint sites and then prevent its overexposure, thereby reducing their risk on vulnerable data.

Several other customers have shared that they were pleasantly surprised to see the quantity and quality of insights available in Content explorer and Activity explorer, and it prompted them to create protection policies they had previously not considered. Microsoft’s IT also relies on these capabilities to ensure that the data in over 150,000 mailboxes and 300,000 SharePoint /Teams sites is protected even as a huge amount of sensitive data continues to be created and shared.

“Content explorer is a welcome addition to my remediation and tuning efforts.  In the past, when I wanted to get a sense of the impact of a particular policy, we would run eDiscovery searches to know the amount of data out there that matches a particular sensitive type (built-in or custom). Now with Content Explorer, I can get a quick sense of the number of findings by simply selecting the sensitive type from the many filters available within Content Explorer. From there, I can explore those items to understand the signal to noise ratio and progress with my remediation efforts. The key is that I can quickly search for the site name and then the file name, which helps me to review content quickly without making copies of content. This used to take a lot of time but now with this tool I can do it in half the time.” John Cardarelli, Data Loss Prevention Architect in Microsoft’s IT Department

Get started

Overview, Content explorer and Activity explorer enable you to discover, classify, review, and monitor sensitive data in your Microsoft 365 services like SharePoint and Exchange ‘in place’ without having to move your data elsewhere. To learn more about how these capabilities enable you to know your sensitive information, watch this short video and see our online documentation. To experience this capability, click on ‘data classification’ in the Microsoft 365 compliance center. With a Microsoft 365 E3 license you can benefit from the Overview tab and get programmatic access to basic reporting and audit. Microsoft 365 E5 licensing SKUs (e.g. E5 Compliance and E5 Information Protection & Governance) get you access to advanced capabilities like Content explorer and Activity explorer. You can learn more about our licensing here.

We are excited to roll out general availability of these data discovery and review capabilities for SharePoint and Exchange today. We will continue to add more workloads like Office client apps, endpoints, Teams, on-premises. We are committed to expanding on these capabilities to enhance your ability to protect and govern data. We are working hard at other exciting innovations – stay tuned!

Microsoft 365 Virtual Marathon – free, online training event

Attendees, on your marks, get set, GO!

Lace up your training shoes. Load up on the v-carbs. And start pounding the water today. The Microsoft 365 Virtual Marathon is around the corner. World class speakers prepped to be your first-class training coaches. And the content, the content is what gets you across the finish line. So much good content.

Jeff Teper (CVP, Microsoft) will be giving a keynote that’s not to be missed, plus Microsoft speakers delivering breakout sessions among thought leaders and members of the community from around the world. Review all 200+ sessions and start your Marathon training plan today.

What: Microsoft 365 Virtual Marathon to learn more | Register today

When: May 27-28, 2020 (36 hours / 2 days)

Presenters: 300+ speakers (MVPs, RDs, Microsoft and community members) from 44 countries speaking in 7 different languages

Cost: Free

Primary Twitter hashtag: #M365VM (join in)

Microsoft 365 Virtual Marathon – May 27-28, 2020 (online training)

Set your pace and jump in. The Microsoft 365 Virtual Marathon has something for everyone running the “miles” of Microsoft 365, including Azure. You’ll find no hill or valley unmapped: AI, bots, sharing, intranet, BI, admin, Teams, SharePoint, OneDrive, Yammer, Power Platform, Microsoft Graph, SPFx, security & compliance, Project Cortex, custom development, migration, search and more.

Below is a list of the Microsoft sessions | presenters – including Jeff’s keynote:

• The latest innovations in SharePoint, OneDrive, and Office for content collaboration [Microsoft keynote] | with Jeff Teper
• Microsoft 365 Live Events and remote work | Lorena Huang Liu & Christina Torok
• Knowledge and Project Cortex – the Microsoft 365 Vision | Naomi Moneypenny and Chris McNulty
• Share and track your information with lists across Microsoft 365 | Lincoln DeMaris
• Design productivity apps with SharePoint lists and libraries, Power Apps, and Power Automate | Chaks Chandran
• Connect the workplace with engaging, dynamic experiences across your intranet | Debjani Mitra and Brad McCabe
• The New Yammer | Jason Mayans
• Architecting Your Intranet | Melissa Torres
• OneDrive powers intelligent file experiences across Microsoft 365 | Randy Wong
• Collaboration and external file sharing across Microsoft 365 | Ankita Kirti
• Migration to SharePoint, OneDrive, and Microsoft Teams in Microsoft 365, free and easy | Hani Loza and Eric Warnke
• Security and compliance in SharePoint and OneDrive | Sesha Mani
• SharePoint developer overview | Luca Bandinelli
• Jump start your projects with community projects from Patterns and Practices (PnP) | Vesa Juvonen

Shout out to community members  and  and the #M365VM team for putting together the online race, mapping the course and for supporting and promoting the knowledge and expertise that reaffirms this: Microsoft 365 has the best tech community in the world – with the endurance to prove it.

Cheers and see you at the race,

Mark 🏃🏻‍

Microsoft 365 & SharePoint PnP Weekly – Episode 82

In this weekly discussion of latest news and topics around Microsoft 365, hosts – Vesa Juvonen (Microsoft), Waldek Mastykarz (Rencore), are joined by Paul Schaeflein – MVP, Developer, Technical Architect and Microsoft 365 Podcaster in Chicago, Illinois, based Addin365. 

Paul is focused on helping peers and customers use the parts of Microsoft 365 that are relevant to their job.  What is the Microsoft 365 opportunity for developers? Of course, that depends. Microsoft 365 provides many options. First understand and bridge the gap between what your staff can do (their knowledge) and what the service can do for you/them. Key focus areas for newbies?

Learn how to write and secure an API, understand React and now React hooks, know your native coding tool – editor, know how to use search engines to find people and information efficiently, understand how to interact with a service you don’t own and finally, keep learning.

As always, if you need help on an issue, want to share a discovery, or just want to say: “Job well done”, please reach out to Vesa, to Waldek or to your PnP Community.

This episode was recorded on Monday, May 11, 2020.

• Microsoft 365 & SharePoint PnP Weekly – Episode 83

Did we miss your article? Please use #PnPWeekly hashtag in the Twitter for letting us know the content which you have created. 

Working remotely webinar

In this difficult time, remote work is becoming the new normal for many companies around the world. Part of this new normal is increased focus on implementing stricter security controls and data loss prevention policies within the solutions that already exist within your environment. We understand that you may be looking at our portfolio of solutions and trying to better understand how we can help provide the appropriate balance of security and productivity.

References:

• Microsoft Information Protection 
• Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and SharePoint site
• O365 Data Loss Prevention
• Insider Risk Management
• Communications Compliance
• Information Barriers
• Manage Information Governance

This webinar was presented on Mon Apr 27th, 2020, and the recording can be found here.

Attached to this post are:

1. The FAQ document that summarizes the questions and answers that came up over the course of both Webinars; and
2. A PDF copy of the presentation.

Thanks to those of you who participated during the two sessions and if you haven’t already, don’t forget to check out our resources available on the Tech Community.

Thanks!

@Adam Bell  on behalf of the MIP and Compliance CXE team

3 takeaways and on-demand webinar from Security Awareness Virtual Summit 2020

On Tuesday, May 5th, at 12:00 pm ET, I opened up my laptop, poured some coffee and joined hundreds of security awareness professionals at the Security Awareness Virtual Summit, 2020, hosted by Terranova Security and sponsored by Microsoft. The next 3 hours were chockfull of presentations, expert advice, a hands-on workshop and a deep dive into Terranova Security training.  

Speak the language of business by using data  

Brian Reed, Senior Director at Gartner kicked off the day with his keynote speech: “Three Ways to Gain Support for your Security Awareness Program.” Brian focused on a problem many security awareness professionals struggle with – how to secure executive buy-in for an organization’s security awareness program. Demonstrating ROI can be hard in the absence of standard metrics, and behavior change is difficult to measure. Brian advised professionals to  “speak the language of business” translating the outcomes of security awareness programs into business outcomes and drilling down into the financial implications of improved awareness.

Later in the day, Terranova Security CISO, Theo Zafirakos also highlighted the importance of measuring total cost of breach. Designing and deploying a security awareness training will incur some cost, but if done well, it will save far more in lost productivity, remediation expense and downtime.  

Storytelling is your secret superpower to boost engagement  

An important takeaway from Brian’s speech was the power of storytelling in improving engagement and participation in security awareness training. Brian urged security awareness professionals to harness the power of stories to build emotional connection. Humans are hardwired to respond to stories—with elements like character, obstacle or challenge and eventual triumph. Usually, Brian said, we use a traditional crime or spy story in the realm of risk and security, but for awareness programs, and he encouraged the audience to think outside the box and experiment with adventure or humorous narratives to increase engagement.  

Adopt an Attacker mindset through phish simulation to detect and quantify risk  

Microsoft PM Lead, @Brandon Koeller  discussed the importance of simulated phishing to your training program. As Brandon said, “Phishing is THE risk, capital T-H-E” when it comes to people. 

Using phish simulations that accurately simulate your threat environment will help you establish a baseline of awareness, detect vulnerable users, quantify behavior change, and demonstrate the effectiveness of training. Koeller reminded us that as security professionals we tend to inhabit a defender mindset but to truly prepare and protect your employees, you need to inhabit an attacker mindset. Phish simulation that mimics real threats in your environment – using context-specific lures and the types of emails most likely to land in your employees’ inboxes. 

The expert panel, featuring Lise Lapointe, CEO of Terranova Security, Erin Csonaki and Blythe Price, Program Managers for CyberSecurity Awareness and Education at Microsoft and Bill Dunnion, Director of the Cyber Resilience Office at Calian highlighted the organizational behavior axis of security awareness – they reminded listeners that their security awareness programs are not merely compliance checklists but a key component of security culture. They urged the audience to frame security awareness training as a key tool in elevating the importance of security and cyber hygiene in the minds of their employees.  

If you missed out on signing up for the virtual summit and want to catch up on the learning, best practices, tips and advice, you’re in luck. The recorded Virtual Summit is available to watch here 

Let us know what you think in the comments!  

Exact Data Match (EDM) Webinar

Custom sensitive information types are used to help prevent inadvertent or inappropriate sharing of sensitive information. As an administrator, you can use the Security & Compliance Center or PowerShell to define a custom sensitive information type based on patterns, evidence (keywords such as employee, badge, ID, and so on), character proximity (how close evidence is to characters in a particular pattern), and confidence levels. Such custom sensitive information types meet business needs for many organizations

References:

• Blog: New Exact Data Match (EDM) classification helps you better detect and protect sensitive information.
• Create custom sensitive information types with Exact Data Match based classification.

This webinar was presented on Wed Apr 22nd, 2020, and the recording can be found here.

Attached to this post are:

1. The FAQ document that summarizes the questions and answers that came up over the course of both Webinars; and
2. A PDF copy of the presentation.

Thanks to those of you who participated during the two sessions and if you haven’t already, don’t forget to check out our resources available on the Tech Community.

Thanks!

@Adam Bell  on behalf of the MIP and Compliance CXE team

Upgrading a content DB from Sharepoint 2016 to Sharepoint 2019 Fails.

When upgrading a Content DB from Sharepoint 2016 to Sharepoint 2019 fails with following error message

Microsoft.SharePoint.Upgrade.SPUpgradeException: An extension defined in the database is not registered with the farm.   

at Microsoft.SharePoint.Administration.SPContentDatabaseExtensionValidator.LogAndThrowIfNotSubset(IEnumerable`1 farmExtensionTypes, SPContentDatabaseExtensionCollection databaseExtensions)   

at Microsoft.SharePoint.Administration.SPContentDatabaseExtensionValidator.VerifyDatabaseCompatibility(SPContentDatabase database)   

at Microsoft.SharePoint.Administration.SPContentDatabaseCollection.Add(SPContentDatabase database, Boolean provision, Guid webApplicationLockId, Int32 addFlags)   

at Microsoft.SharePoint.Administration.SPContentDatabaseCollection.Add(Guid newDatabaseId, String strDatabaseServer, String strDatabaseName, String strDatabaseUsername, String strDatabasePassword, String strDatabaseFailOverServer, Int32 warningSiteCount, Int32 maximumSiteCount, Int32 status, Boolean provision, Guid lockId, Int32 addFlags)   

at Microsoft.SharePoint.Administration.SPWebApplication.AddContentDatabase(SPWebApplication application, String strDatabaseServer, String strDatabase, String strDatabaseUser, String strDatabasePassword, String strDatabaseFailOverServer, Int32 cSiteWarning, Int32 cSiteLimit, Boolean bAssignDatabaseId, Int32 iAddFlags)   

at Microsoft.SharePoint.PowerShell.SPCmdletNewContentDatabase.InternalProcessRecord()   

at Microsoft.SharePoint.PowerShell.SPCmdlet.ProcessRecord()

The ULS Log clearly shows 

Compare the extensions registered and we can see project extension is missing.  here is how you can compare. 

$contentservice=[Microsoft.sharepoint.Administration.SPwebservice]::ContentService

$contentservice.RegisteredDatabaseExtensionTypes >>SP2016Farm_registered_Extn.txt

$contentservice=[Microsoft.sharepoint.Administration.SPwebservice]::ContentService

$contentservice.RegisteredDatabaseExtensionTypes >>SP2019Farm_registered_Extn.txt

Resolution:

Execute the following to register the missing extension

$svc = [Microsoft.SharePoint.Administration.SPWebService]::ContentService

[System.Reflection.Assembly]::LoadWithPartialName(“Microsoft.Office.Project.Server.Database.Extension”) | FL

$svc.RegisteredDatabaseExtensionTypes.EnsureAdded([Microsoft.Office.Project.Server.Database.Extension.ProjectDatabaseExtension])

$svc.Update($true)

Upcoming Webinar – eDiscovery for Teams – May 14th

While eDiscovery provides a range of search, hold, and export functionality, advanced eDiscovery gives compliance administrators more tools to identify data sources and analyze their contents.

Need to conduct an internal investigation of Teams content? We’ve got you covered. Join us to learn how to complete common eDiscovery processes on Teams content.

May 14, 2020: 16:00 GMT

Download Outlook Calendar Invite  https://aka.ms/GetInvite-eDiscoveryForTeamsWebinarEMEA

May 14, 2020: 12:00 PST

Download Outlook Calendar Invite https://aka.ms/GetInvite-eDiscoveryForTeamsWebinarUS

Join live

May 14, 2020: 16:00 GMT

Attendee URL: https://aka.ms/Join-eDiscoveryForTeamsWebinarEMEA

May 14, 2020: 12:00 PST

Attendee URL: https://aka.ms/Join-eDiscoveryForTeamsWebinarUS

Announcing general availability of sensitivity labels with protection in SharePoint and OneDrive

Microsoft runs on trust. With the growing digital data in your organizations and sophistication of online threats, it’s increasingly important to have intelligent security and simplified governance tools to safeguard your corporate data.

At Microsoft, our goal is to provide a built-in, intelligent, unified, and extensible solution to protect sensitive data across your digital estate – in Microsoft 365 cloud services, on-premises, third-party SaaS applications, and more. With Microsoft Information Protection (MIP), we are building a unified set of capabilities for classification, labeling, and protection not only in Office apps, but also in Microsoft 365 productivity services like OneDrive, SharePoint, Teams, and Exchange Online.

Sensitivity labels are central to how your business-critical data is protected using Microsoft Information Protection (MIP). You create a sensitivity label and associate protection policies like encryption and visual marking, then your end users simply label their important documents and emails. You can also be assured that the protection will persist with the file throughout its life cycle.

Today, we are excited to announce general availability of sensitivity labels with protection for Office files in SharePoint and OneDrive. This is one more step to providing you comprehensive protection across documents and emails in Microsoft 365 services.

Now your users can apply sensitivity labels, with protection policies, not just in Office apps on Windows, Mac, iOS and Android but also in Office on the web. Users will see sensitivity as an option on the ribbon of the Office on the web, and as the applied label name on the status bar.

Figure 1. Manual classification using sensitivity labels shown in PowerPoint web app when used in a browser

In addition, for files labeled and protected with encryption and stored in SharePoint and OneDrive, the following capabilities will empower your end users:

• Coauthoring using Office web apps
• Searching for content within these documents
• Protection using encryption will persist even after the file is downloaded

For security and compliance administrators, Office 365 Data Loss Prevention (DLP) and eDiscovery will also work. Office 365 eDiscovery now supports full-text search for these label encrypted files. Office 365 Data Loss Prevention (DLP) policies cover content in these label encrypted files.

Getting Started

Figure 2. The compliance center has new option to turn on this feature

As a Microsoft 365 customer, you can turn on this feature in the Microsoft 365 compliance center as shown above. To learn more about this feature, please read our feature documentation.

Let us know what you think, we are always open to feedback via UserVoice and continued dialog in the Security & Compliance community and SharePoint community in the Microsoft Tech Community.

If you are new to Microsoft 365, learn how to try or buy a Microsoft 365 subscription.

Lastly, as you navigate this challenging time, we have additional resources to help. For more information about securing your organization in this time of crisis, visit our Remote Work site. We’re here to help in any way we can.

FAQs

1. What is the license requirement for using this feature?

Refer to the Information Protection section in Microsoft 365 security & compliance licensing guidance.

2. I use AIP/RMS today, how can I take advantage of this new feature in SharePoint and OneDrive services?

Migrate to unified labeling solution using instructions here, then you can advantage of this feature. Learn more in our feature documentation.

3. Is this feature supported in Files tab experience in Teams?

Yes, it is. Learn more in our feature documentation.

Thank you!

Sesha Mani, Principal Group Product Manager, Microsoft

Get the most out of Office 365 ATP in the shift to remote work

It’s never been more critical that employees and the partners they collaborate with can work remotely and stay more secure. In the months leading up to this monumental shift, phishing and malware attacks were at the top of the list of cybersecurity threats. Now, attackers are capitalizing on fear, leveraging this time of uncertainty and change as an opportunity. Phishing and malware attacks are on the rise, many of which now include COVID-19 related lures. In the circumstances we are living through, these threats continue to be some of the most considerable risks to organizations. 

What’s available to you today

Office 365 Advanced Threat Protection provides industry-leading protection for all of Office 365. This includes protection against phishing and malware for Exchange, SharePoint, Teams, OneDrive, and Office applications.  O365 ATP is built-in to Office 365, so you won’t need multiple solutions to maintain a threat protection solution for email and collaboration.

If you’ve got our P2 license, you have access to our post-breach capabilities, which include hunting, automated investigation, and response capabilities, as well as Attack Simulator which provides end-user training simulations.

Guidance for rapid onboarding

Office 365 ATP provides a variety of threat protection features for your organization. Many of these can be enabled quickly with little impact to your users. Remember that you can extend phishing and malware protection beyond the mailbox, to SharePoint, OneDrive, Teams, and Office, with a single click. For guidance on configuring these policies, such as Safe Links and Safe Attachments, visit our Protect against threats documentation.  If you need additional help, our FastTrack service is free for all Office 365 ATP customers, and is extending coverage in support of COVID-19 response efforts. Visit the FastTrack site to request assistance.

Our recommendations

Across the Office 365 service we see that misconfigurations cause 20% of phishing emails to be delivered to users’ inboxes. In this critical time, review your configurations to ensure that your organization is protected. If a portion of your users have transitioned to remote work, ensure that your existing configurations support this change safely, and that you haven’t broadened your attack surface more than is necessary. The O365 ATP Recommended Configuration Analyzer (ORCA) can help you review your configurations and ensure that you are maintaining a secure posture.

We’ve also published recommended settings in both a standard and strict variant. Each customer’s environment and needs are different, but we believe that these levels of mail filtering configurations will help prevent unwanted mail from reaching your employees’ inbox in most situations.

Visualize the threats to your organization with Campaign Views and view the full story of how attackers targeted your users and how your defenses handled the threats. Armed with this information, security teams can more rapidly remediate compromised users, improve security posture, and hunt and track threats. Learn more about Campaign Views here.

Microsoft is here to help

In case of a security incident, Microsoft incident response (IR) services are available through the Microsoft Detection and Response Team (DART). DART provides both reactive incident response and pro-active cyber-resilient services, some delivered remotely and some on-site. The team responds to security incidents and helps customers and partners around the world. You can reach out to your Microsoft Account Manager, Technical Account Manager, or Premier Support contact if you need help from DART.

To learn more about what Microsoft is doing to address the current threat landscape, view our recent blog post on threat intelligence here.

At Microsoft, we understand that securing a remote workforce poses unique challenges. We’re committed to helping customers protect their users and resources, empower their security teams, and focus on what’s most important during this unprecedented time.