In this session you will learn about more complex Microsoft 365 (E5) compliance functionality - information barriers (Chinese Walls) and communications compliance.

1. #Teams10X
TEAMS 10X
VIRTUAL SUMMIT
UNLEASH THE POWER OF TEAMS
APRIL 6 & 7

2. #Teams10X
Working with Information Barriers and
Communication Compliance
Albert Hoitingh
Sr. Consultant Microsoft 365 Compliance and Risk

3. #Teams10X
Albert Hoitingh
albert.hoitingh@gmail.com
https://linkedin.com/in/appieh
@Alberthoitingh

4. #Teams10X
SPONSORS

5. Session Objectives
During this session we will:
 Look at Microsoft 365 Compliance portfolio
 Licensing & requirements
 Use cases for information barriers & communications compliance
 See how both options work
 See how to configure both options

6. #Teams10X
Microsoft 365 compliance
Insider Risk
Insider risk management
Communication compliance
Information barriers
Privileged access management
Customer Lockbox
Compliance management
Compliance Score
Compliance Manager
Build-in templates
Alerts and insights
Search
Core eDiscovery | Advanced
eDiscovery
Microsoft Defender for Cloud Apps
Auditing
Privacy Management Dashboard
Information Protection
Sensitivity labels & encryption (mails,
documents, sites, groups, PowerBI, data)
Double key encryption
Office 365 message encryption
Information Governance
Data classification | Machine Learning
Sensitive Information Types
Records management & disposition
Archive 3rd party information
Metadata
Data loss prevention
Office 365 Data loss prevention
Endpoint data loss prevention
On-premises data loss prevention
Non-Microsoft cloud apps

7. #Teams10X
Microsoft 365 Compliance
Communication Compliance
• Office 365 E5 | Microsoft 365 E5
• Microsoft 365 E3 + E5 Compliance
• Microsoft 365 E3 + E5 Insider Risk
Management
• Only users monitored
Information Barriers
• Office 365 E5 | Microsoft 365 E5
• Microsoft 365 E3 + E5 Compliance
• Microsoft 365 E3 + E5 Insider Risk
Management
• Only users in the relevant segments

8. Microsoft 365
Communications
Compliance &
Teams

9. #Teams10X
Corporate policies
• Acceptable use, ethical standards, other corporate policies
• Detect policy matches
• Examples: harassment, offensive language
Communication Compliance
Risk Management
• Conflict of interest
• Unauthorized communications
Regulatory compliance
• Supervisory or oversight processes
• Dutch Central Bank (DNB regulations), Financial Industry Regulatory
Authority (FINRA)

10. #Teams10X
Communication Compliance
Other
• All mailboxes hosted on Exchange Online (e-mails,
attachments)
• Yammer | Skype for Business Online
Microsoft Teams
• Chat communications in channels
• Individual chats
3rd party sources
• Requires connectors and licenses
• Whatsapp, Instant Bloomberg some examples

11. #Teams10X
Communication Compliance
https://docs.microsoft.com/en-us/microsoft-365/compliance/archiving-third-party-data

12. #Teams10X
Communication Compliance
Reviewers
• Mailboxes hosted on Exchange Online
• Communication Compliance Analyst or Investigator role groups
• Assigned in policy
Privacy
• Use settings to anonymize user
information
Find content - policies
• Sensitive information types
• Trainable classifiers
• Specific attributes and keywords

13. DEMONSTRATION
How does this work?

14. Microsoft 365
Information Barriers
& Teams

15. #Teams10X
Information Barriers | Introduction

16. #Teams10X
Information Barriers | Introduction
User access to team or channel content
Adding a user to a team or channel
Screensharing | telephone calls
User access to meetings
User access to 1:1 and group chats

17. #Teams10X
Information Barriers | Introduction
User access to team or channel content
Adding a user to a team or channel
Screensharing | telephone calls
User access to meetings
User access to 1:1 and group chats

18. #Teams10X
Information Barriers | Introduction
User access to team or channel content
Adding a user to a team or channel
Screensharing | telephone calls
User access to meetings
User access to 1:1 and group chats

19. #Teams10X
Information Barriers | Introduction
User access to team or channel content
Adding a user to a team or channel
Screensharing | telephone calls
User access to meetings
User access to 1:1 and group chats

20. #Teams10X
Information Barriers | Introduction
Licenses & permissions
• Every user needs an Exchange Online license
• Information Barriers Administrator role
Directory
• Azure AD is up te date with relevant attributes
• Scoped directory search is enabled
• No Exchange Online address book policies

21. #Teams10X
Information Barriers | Introduction
And also
• Verify that audit logging is enabled
• Use PowerShell to enforce barriers on
existing groups and teams
• 250 segments per organization
• A user can only be part of one segment
• Guest users are affected – federated users
are not

22. DEMONSTRATION
How does this work?

23. #Teams10X
Information Barriers
Segment Segment
Policy

24. #Teams10X
Information Barriers
Segment
• Collection of users based on a limited set
of Azure AD attributes or group
membership
Information Barriers mode (Implicit standard)
• Open
• Owner Moderated
• Implicit | Explicit (SPO only)
Policy
• Used to set the permissions (Allow/Block) for
communications between two segments
Segment Segment
Policy

25. #Teams10X
Information Barriers
Connected to Teams
• Only Implicit mode
• Share with Anyone | Company-wide link disabled
• Only sharing with existing members
• New users can't be added directly
• Segments cannot be changed, even by SP Admin or Global Admin
• Also works for private channels
• Can take up to 24 hours for the IB mode to take effect
Information Barriers mode
• Open
• Owner Moderated
• Implicit (based on Teams)
• Explicit (only for SPO!)

26. #Teams10X
Information Barriers
Management

27. #Teams10X
Information Barriers
Compliance Center
PowerShell

28. DEMONSTRATION
How to configure this?

29. #Teams10X
Information Barriers | Other thoughts
User removed
• 1 on 1 chat: read only and blocked;
• Group chat: user removed from participating,
can read old conversations
• Team: user removed from team, cannot access
content *)
• Other users will see an error when hoovering
over the people card
*) Probably based on the segment the Teams owner is in.
But what if the owner isn’t in a segment? Or both owners
are part of different segments? Still testing this….

30. #Teams10X
Information Barriers | Other thoughts
Contacts
• Activity tab removed
• A blocked user will not appear on the org chart
• A blocked user will not appear as suggested
contact
• A blocked chat/call contact can be seen in the
chats contact list and will be identified. But there
is no interaction option

31. #Teams10X
• Share with user - blocked
• Share with team you own: blocked if any users part of the IB
• Share with team you don’t own: blocked if other owner or any users part of the IB
• Add user to a team that has shared channels: blocked if user is part of the IB. But….
When the team has 6 or more shared channels – the user can be added initially. When
the IB policy detects a problem – sharing is stopped (?!).
• An IB does not effect sharing the team with an external party
Information Barriers | Other thoughts

32. #Teams10X
Information Barriers | Other thoughts
Check on user-status
• Get-InformationBarrierRecipientStatus -Identity <userid>
Check on segment-status
• Get-OrganizationSegment –Identity <GUID>
Check on policy-status
• Get-InformationBarrierPoliciesApplicationStatus
• Not Started | Failed | In progress

33. Wrapping up

34. #Teams10X
These are complex functions
• A user can only be added to one
segment!
• Policies are symmetric – always
requires two to function!
• Information Barriers do not work
across tenants
• Information Barriers do not block bots,
Azure AD apps or API’s
• More is on the way, probably
announced during Ignite.
Information Barriers

35. #Teams10X
Your feedback is valued!
Event Feedback Speaker/Session Feedback
https://forms.office.com/r/Z7SFCGXHTA https://forms.office.com/r/hT22EjE6Rc

36. #Teams10X
Thank You