Managing Insider Risk Solutions in Microsoft 365

All too often, security and compliance administrators focus their attention on threats from outside their organization. Oftentimes, however, threats can emanate from within, from either malicious or unwitting insiders who have access to the data that you store within Microsoft 365 locations and services. It is equally important to protect your data against such insider threats.

In this chapter, we will explain the principles of managing the Insider Risk Management solutions included with Microsoft Purview. You will learn how to implement features including Customer Lockbox, which is a solution that ensures that Microsoft cannot access your content without your explicit approval. You will also learn how communication compliance policies can be used to protect employees from harassment and threatening behavior and how Insider Risk Management policies can be deployed to prevent data from being put at risk by malicious insiders, such...

Implementing Customer Lockbox

Customer Lockbox is a feature that provides an extra layer of control to organizations when they need to contact Microsoft for support and Microsoft needs to access the Microsoft 365 tenant to perform troubleshooting. It works by giving the organization the ability to provide explicit access authorization to Microsoft. Implementing Customer Lockbox ensures that the organization has full control and can be an indicator that they follow compliance regulations such as FedRAMP or HIPAA.

To benefit from and use Customer Lockbox, an organization must have some flavor of E5 licensing in place. The license options that provide the rights for a user to benefit from Customer Lockbox are the following:

• Office 365 E5
• Microsoft 365 E5
• Microsoft 365 E5 Compliance
• Microsoft 365 F5 Security & Compliance
• Microsoft 365 E5 Insider Risk Management

With Customer Lockbox, Microsoft support can request access to data in Exchange Online,...

Implementing and managing Communication Compliance policies

Communication Compliance is a Microsoft Purview feature that is part of the insider risk solution. It is designed to minimize communication risks in your organization and helps you to detect and manage inappropriate messages in your organization. Communication Compliance is straightforward to implement thanks to a set of pre-defined policies provided by Microsoft that enable you to check for internal and external communications and investigate policy matches against Exchange email, Microsoft Teams, Yammer, or third-party communications.

To manage Communication Compliance and configure initial permissions, you need to be either a Global Administrator, Compliance Administrator, or part of the Organization Management, Communication Compliance, or Communication Compliance Admins role group.

To use Communication Compliance in your Microsoft 365 tenant, you can use the following subscriptions:

• Microsoft 365 E5
...

Implementing and managing insider risk management policies

Insider Risk Management is a Microsoft Purview feature that enables administrators to create policies that detect and identify risky activities in your organization. To manage Insider Risk Management and configure the features, you need to be either a Global Administrator, Compliance Administrator, or part of the Organization Management, Insider Risk Management, or Insider Risk Management Admins role groups.

To use Insider Risk Management in your Microsoft 365 tenant, you can use the following subscriptions:

• Microsoft 365 E5
• Microsoft 365 E3 and the Microsoft 365 E5 Compliance add-on
• Microsoft 365 E3 and the Microsoft 365 E5 Insider Risk Management add-on
• Office 365 E3, Enterprise Mobility and Security E3, and the Microsoft 365 E5 Compliance add-on

First, we will look at how we can get started with Insider Risk Management.

Getting started with Insider Risk Management policies

Insider Risk...

Implementing and managing Information Barriers policies

With Microsoft Purview Information Barriers, organizations can restrict two-way communication between users and groups. This can be applied to Microsoft Teams, OneDrive, and SharePoint. Implementing Information Barriers is a process usually utilized in organizations that are strictly regulated. The aim is to avoid the possibility of a conflict of interest occurring.

Information Barriers is implemented in the form of segments and policies, which, when in place, will have the effect that one set of specified users, who should not be allowed to communicate with another set of specified users, will not be able to find, chat with, or call those users. Essentially, Information Barriers is there to prevent unauthorized communication. To use Information Barriers in your Microsoft 365 tenant, you can use the following subscriptions:

• Microsoft 365 E5
• Office 365 E5
• Office 365 Advanced Compliance add-on (no longer available...

Implementing and managing Privileged Access Management

With Microsoft Purview PAM, it is possible to configure access control to privileged Microsoft 365 admin tasks in a granular fashion. The purpose of this is to protect your organization from any possible breaches that use existing privileged admin accounts that have existing access to settings or data.

By implementing PAM, your organization can require that your users must explicitly request just-in-time access to complete any privileged or elevated tasks. This enforces the principle of providing users with just enough access to complete their tasks. Doing so significantly reduces the risk of data exposure.

To use PAM in your organization, one of the following subscriptions is required:

• Microsoft 365 E5
• Microsoft 365 E3 and the Microsoft 365 E5 Compliance add-on
• Office 365 E3, Enterprise Mobility and Security E3, and the Microsoft 365 E5 Compliance add-on
• Any Microsoft 365, Office 365, Exchange, SharePoint...

Summary

In this chapter, we introduced you to the principles of managing insider risk in your Microsoft 365 environment. We learned that by implementing Customer Lockbox, we can control and monitor the access that Microsoft has to our data during a support request. We also learned that with Communication Compliance policies, we can be alerted when inappropriate or abusive communications take place between users in our organizations. Additionally, we showed you how implementing and managing Insider Risk Management policies can help prevent data from being leaked outside our organization by unwitting or malicious insiders and how with Information Barriers policies, we can create segments of users who are blocked from communicating with each other for regulatory reasons. Finally, we saw that implementing and managing PAM provides granular levels of control to Exchange Online tasks, roles, and role groups and provides just enough access instead of vulnerable standing permissions.

We...

Questions

1. Which of the following are available policies in Microsoft Purview Communication Compliance? (Choose three)
   1. Detect inappropriate images
   2. Detect inappropriate video
   3. Detect inappropriate text
   4. Monitor for sensitive info
2. True or false: Using Information Barriers, you can create segments and policies to block communication and collaboration between groups of users?
   1. True
   2. False
3. In the Insider Risk Management built-in policy named Data theft by departing users, which of the following is not one of the available activities detected?
   1. Downloading files from SharePoint
   2. Copying data to a USB drive
   3. Printing files
   4. Copying data to personal cloud storage services
4. Which of the following PowerShell commands would you use to create a PAM policy based on the task of creating a new Exchange mail flow rule where the approval process must be granted by an approver group?
   1. New-ElevatedAccessRequest -Task 'Exchange\New-TransportRule' -Reason 'Needed to route outbound mail via a...

Further reading

Please refer to the following links for more information:

• Microsoft Purview Customer Lockbox: https://learn.microsoft.com/en-au/microsoft-365/compliance/customer-lockbox-requests?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Learn about communication compliance: https://learn.microsoft.com/en-us/microsoft-365/compliance/communication-compliance?WT.mc_id=EM-MVP-4039827&view=o365-worldwide
• Get started with communication compliance: https://learn.microsoft.com/en-us/microsoft-365/compliance/communication-compliance-configure?WT.mc_id=EM-MVP-4039827&view=o365-worldwide
• Create and manage communication compliance policies: https://learn.microsoft.com/en-us/microsoft-365/compliance/communication-compliance-policies?view=o365-worldwide
• Plan for Insider Risk Management: https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-plan?view=o365-worldwide
• Get started with Insider Risk Management: https://learn.microsoft...