Chapter 11: Understanding the Microsoft 365 Security & Compliance Center

This chapter focuses on the many different features and functions of the Microsoft 365 Security & Compliance Center as it relates to Office 365 apps and services. From audit log activities and working with Secure Score to configuring advanced threat protection features, we'll cover the essentials that every admin should know.

This chapter includes the following recipes:

• Viewing a report on all users who have accessed a specific SharePoint file
• Using Content Search to find content containing certain keywords
• Creating a retention policy based on the discovery of certain keywords
• Accessing the standard Microsoft BAA
• Accessing and reviewing an organization's secure score
• Complying with Secure Score security configuration recommendations
• Assigning permissions for non-IT users to the Security & Compliance admin center
• Using Communication Compliance to identify...

Technical requirements

In this chapter, it would be best to be registered as a Global Admin. If you are not, then many recipes in this chapter will still be accessible to you as a Security Admin. Check each recipe's Getting ready section for its specific requirements.

Viewing a report on all users who have accessed a specific SharePoint file

Sometimes, you will need to know who has accessed specific files and when, whether to verify receipt, investigate a potential data-loss risk, or for another reason. This can be accomplished via the Microsoft 365 Security & Compliance Center. In this recipe, we'll go through the steps of pulling the access report for a file named FirstDraft.docx.

Getting ready

You should be a global administrator to complete this recipe. You will also need audit logging turned on for your organization. You can do this from the Office 365 Security & Compliance Center (https://protection.office.com) by clicking Turn on auditing on the Audit log search page in the Security & Compliance Center. If you don't have that option, then auditing has already been turned on.

How to do it…

1. Go to the Office 365 Security & Compliance Center at https://protection.office.com.
2. Click Search ...

Using Content Search to find content containing certain keywords

It can be difficult to track where people copy and save content, or where they're discussing critically sensitive things, such as confidential projects. In this recipe, we'll perform a content search to look through our entire tenant for content containing DocID-7846. This would be helpful in ensuring the compliance and confidentiality of specific content.

Getting ready

You should be a global administrator to complete this recipe.

How to do it…

1. Go to the Office 365 Security & Compliance Center at https://protection.office.com.
2. Click Search | Content search from the left navigation menu:

   Figure 11.5 – Content search link on the left-hand navigation menu of the Office 365 Security & Compliance Center

3. Click New search.
4. Enter the keyword(s) to search for. In our example, we're entering DocID-7846:

   Figure 11.6 – Keyword search terms entry

5. Select All...

Creating a retention policy based on the discovery of certain keywords

Retention policies can be created that are automatically applied to items containing specific keywords when found in the search index. In this recipe, we'll create a retention policy that applies to items that are found containing the word Contoso.

Getting ready

You should be a global administrator to complete this recipe.

How to do it…

1. Go to the Office 365 Security & Compliance Center at https://protection.office.com.
2. Click Information governance | Retention from the left navigation menu:

   Figure 11.8 – Retention link in the left-hand navigation menu of the Office 365 Security & Compliance Center

3. Click Create.
4. Name and describe your retention policy:

   Figure 11.9 – Name and description fields for the new policy

5. Under Need more options?, select Use advanced retention settings and leave Detect content that contains specific words or phrases selected...

Accessing the standard Microsoft BAA

Your subscription agreement included Microsoft's HIPAA Business Associate Agreement (BAA), but finding it later for your compliance and audit needs can be tricky. In this recipe, you'll locate the BAA.

Getting ready

Most users can access the BAA. There are no prerequisites.

How to do it…

1. Go to https://portal.office.com/commerce/supplements.aspx.
2. Click Online Services Terms:

   Figure 11.13 – Online Service Terms in the blurb about supplements

3. You can find a lot of valuable documentation and information on this screen. Spend some time checking out all that's available. Then scroll down to Hot topics and select HIPAA-BAA:

   Figure 11.14 – HIPAA-BAA link under Hot topics at the bottom of the page

4. Scroll down to find the available BAA documents. Note the dates for each one:

Figure 11.15 – Available HIPAA documents listed in a table

Before you complete step...

Accessing and reviewing an organization's secure score

Your secure score gives you an idea of how well protected your organization is based on your administrative setting configurations, policies, and activities. In this recipe, you'll learn how to find and analyze your organization's secure score.

Getting ready

You should be a global, security, Exchange, SharePoint, or account administrator to access Secure Score.

How to do it…

1. Go directly to your secure score overview at https://securescore.microsoft.com/. You can also go to the Microsoft 365 Security Center (https://security.microsoft.com/) and click Secure Score from the left navigation menu.
2. Check your secure score breakdown in the leftmost column of the Overview tab. You'll notice the categories for each of the following making up your score:

   --Identity: Accounts and roles in Azure AD

   --Data: Microsoft Information Protection

   --Device: Microsoft Defender Advanced Threat Protection ...

Complying with Secure Score security configuration recommendations

In the previous recipe, you accessed and toured Secure Score. In this recipe, we'll dive deeper into improvement actions and resolve one, complying with a recommendation that will boost our secure score.

Getting ready

You should be a global, security, Exchange, SharePoint, or account administrator to access Secure Score.

How to do it…

1. Go directly to your Secure Score overview at https://securescore.microsoft.com/. You can also go to the Microsoft 365 Security Center (https://security.microsoft.com/) and click Secure Score in the left navigation menu.
2. Click Improvement actions:

   Figure 11.21 – Improvement actions link on the Microsoft Secure Score page

3. Choose an improvement action to complete. For this recipe, we'll click Enable self-service password reset:

   Figure 11.22 – An improvement action being selected

4. See the recipe titled Enabling self-service password...

Assigning permissions for non-IT users to the Security & Compliance admin center

Sometimes, you'll want additional eyes on the Security & Compliance admin center, but they won't usually belong to a global admin. In this recipe, we'll set a non-IT user's role to Security Reader so that they can access, but not administer, the Office 365 Security & Compliance admin center.

Getting ready

You should be a global administrator to complete this recipe (and whenever assigning admin roles).

How to do it…

1. Go to the Office 365 Security & Compliance Center at https://protection.office.com.
2. Select Permissions from the left navigation menu:

   Figure 11.25 – Permissions link in the left-hand navigation menu of the Office 365 Security & Compliance Center

3. Select the role that you're assigning, then click Edit in the Members section:

   Figure 11.26 – Edit button in the Members section for the selected security role

...

Using Communication Compliance to identify potential policy violations in messages

With so many different avenues for communication in Office 365, it can be difficult to monitor inappropriate messages or those that could potentially be in violation of organization policies. Communication Compliance allows you to monitor, capture, and alert assigned reviewers of messages in email, Teams, Yammer, and more for predefined or specified risky content.

In this recipe, we'll add the predefined policy from Microsoft that monitors messages for offensive language.

Getting ready

You should be assigned the Supervisory Review Administrator, Case Management, and Review roles from the Office 365 Security & Compliance admin center to access and utilize the Communication Compliance solution. You can do this by creating a new role group from the Permissions pane of the Office 365 Security & Compliance admin center with these three roles included.

How to do it…

...