Microsoft Teams enables organizations to stay connected and access shared content any time to learn, plan, and innovate—together. Although these advantages improve internal and external collaboration, organization have serious concerns around being and staying compliant. Jasper Oosterveld, Microsoft MVP & Modern Workplace Consultant, is going to discuss the available Microsoft Information Protection and Governance toolset to ensure and maintain your organizational compliance while working with Microsoft Teams.

2. Ensure your compliance in
Microsoft Teams with Information
Protection and Governance
Jasper Oosterveld
Microsoft MVP & Consultant, InSpark @ Amsterdam

3. The power & business value of Microsoft
Teams

4. The power of Microsoft Teams
Chat Meet Call Collaborate Automate

5. Business value of Microsoft Teams
Integration Productivity Safe & secure

6. HOLD YOUR HORSES!

7. Our customer also worry about Teams
Explosion Managing Adoption &
change
management
External
access
Being
compliant

8. You are here to help!

9. Staying Compliant with Microsoft Teams

10. Trends
Hybrid Workplace Data explosion Legislation and
regulations

11. Challenges
Retain &
delete
Classify &
Protect
Hidden
data

12. Risks
Fines Reputational
damage
Bankruptcy

13. Real world examples
• OLVG receives a fine of 440,000 euros for unlawful access to sensitive
information.
• Personal data of 65,000 civil servants on the street due to data leak at
the ministry.
• Over 100,000 resumes were illegally downloaded at Employee Insurance
Agency.

14. Three crucial questions
1. Do you know where your business’s critical and sensitive data resides
and what is being done with it?
2. Do you have control of this data as it travels inside and outside of your
organization?
3. Do you know what lifecycle regulations are applicable to your
organization?

15. Microsoft 365 Purview
Information
Protection
Data Loss
Prevention
Data
Lifecycle
Management

16. Define your Information Classification Policy
• Company data
specifically
prepared and
approved for
public use.
• Company data
intended for
general use
within the
organization.
• Company data
specific to
internal
employees or
specific
individuals or
organizations.
Public Internal Confidential

17. Define your Information Protection Policy
Company data is specifically prepared and approved for public use.
• Accessible to all employees (internal) or authorized individuals (external).
• No security.
Company data is intended for general use within and outside the organization (business partners).
• Accessible to all employees.
• Data is protected.
Internal
Public
Company data is intended for internal employees or specific individuals or organizations.
• Accessible for all employees (internal) or authorized persons (external).
• Data is protected.
Confidential

18. Who defined these policies?

19. Working with sensitivity labels

20. Scope
Sensitive
information
M365
Groups
Purview
Data Map

21. Labels and sensitive information
Encryption
Location
independent

22. Labels and Microsoft Teams
Conditional
access
Privacy
setting
Guest
access
External
sharing

23. Applying labels
Manually Automatically

24. Automatically & Sensitive Information Types (SIT)
“Pattern-based classifiers for sensitive content.”

25. Who is using sensitivity labels?

26. Scenario #1
• Megan wants to implement
sensitivity labels within Hammond
Robotics.
• With these labels, employees can
manually label (sensitive) content.
• It is crucial to automatically label all
information, from the MRVN
project.
• She wants to get insights in the
application of sensitivity labels.
Megan Bowen – CISO

27. Solution
• Let’s look!

28. Important information about labels
• AIP unified labeling client is in maintenance mode.
• Microsoft advice moving towards the built-in labeling within Office.
• Review the current options & limitations (see resources slide).

29. Scenario #2
• Alex wants a private & secure
collaboration space with
Microsoft Teams.
• It’s not allowed to add guests.
• External sharing is only allowed
with approved accounts
Alex Wilber – PM

30. Solution summary
• Let’s look!

31. Working with Data Loss Prevention

32. Data Loss Prevention
Identify Monitor Protect

33. The importance of DLP
Conscious
sharing
Unconscious
sharing

34. High-level overview
• Create a policy based on existing regulations (GDPR) or customize your
own.
• Select the location (M365, OnPrem, Devices, OS & non-MS cloud apps).
• Define your policy settings (conditions & actions).
• Test & deploy.

35. Who is using DLP?

36. Scenario #3
• Megan wants to show a warning
when employees post an IBAN
number in a chat message.
• She wants to prevent the
external sharing of files with an
IBAN number.
Megan Bowen – CISO

37. Solution summary
• Let’s look!

38. Working with Data Lifecycle Management

39. Data lifecycle management
1. Retain the content for a specified period (days, months & years).
2. Retain & automatically delete content after a specified period (days,
months & years).
3. Automatically delete content after a specified period (days, months &
years).
4. Retain content forever.

40. Importance of Data Lifecycle Management
Govern
lifecycle
Regulatory
requirements

41. Applying Data lifecycle management
Policy Labels Record
Management

42. Who is using Data Lifecycle Management?

43. Scenario #4
• Alex wants to preserve all
content from Project Raven for
an indefinite amount of time.
Alex Wilber – PM

44. Solution summary
• Let’s look!

45. Conclusion

46. Final advise
Define
policies
Pilot Governance Adoption & change
management
Licensing

47. Contact details
@jappie1981 in/jasperoosterveld

49. Resources: Information Protection (1)
• Announcing AIP unified labeling client maintenance mode and sunset of
mobile viewer
• Choose Microsoft Purview Information Protection built-in labeling for
Office apps over the Azure Information Protection (AIP) add-in -
Microsoft Purview (compliance) | Microsoft Docs
• Microsoft Information Protection in Microsoft 365
• Learn about sensitivity labels

50. Resources: Information Protection (2)
• Apply a sensitivity label to content automatically
• Common scenarios for sensitivity labels
• Microsoft Information Protection SDK
• View label usage with label analytics
• Scoping Office 365 Sensitivity Labels
• Blog Joanne C Klein

51. Resources: Data Loss Prevention
• Overview of data loss prevention
• Create a custom sensitive information type in the Security &
Compliance Center
• Sensitive information type entity definitions
• Data loss prevention and Microsoft Teams

52. Resources: Data Lifecycle Management
• Learn about retention for Microsoft Teams
• Learn about retention policies and retention labels
• Learn about retention for SharePoint and OneDrive
• Learn about records management in Microsoft 365
• Using Trainable Classifiers to Assign Office 365 Retention Labels
• View label usage with label analytics