Microsoft 365 E5 Compliance Changes

Microsoft has recently released a new compliance bundle for Microsoft 365. Read on to learn the changes and how it can benefit your organization!

____________________________________________________________

New Microsoft 365 E5 Compliance Suite

Microsoft has repackaged its Microsoft 365 E5 Compliance Suite to bring new value and convenience to organizations. New products with this suite include Advanced Auditing, Insider Risk Management, Communication Compliance, Microsoft Cloud App Security (MCAS), and Machine Learning-Based Classification. Additionally, Microsoft offers “mini-suite” add-ons for organizations to buy individually, making it easier for customers to customize and choose the bundles that best fit and serve their organizational needs.

Organizations purchasing the Compliance Suite receive all of these bundles for only $10 per user, per month. The three new bundles are:

• Information Protection and Governance ($7 per user, per month)
• Insider Risk Management ($6 per user, per month)
• eDiscovery and Audit ($6 per user, per month)

Microsoft’s focus on security and compliance enables organizations to more easily comply with legal or regulatory standards such as NIST, HIPAA, GDPR, CCPA, and more. Protecting organizational and customer data, fighting cybersecurity threats, and being compliant are all vital considerations addressed by this new Compliance Suite. This suite allows your organization to protect and govern your data in a simplified and automated way while providing visibility and insights to help meet compliance requirements. Mitigate risks and easily act with the relevant data available! Here is an overview of each bundle and the licensing prerequisites:

Microsoft 365 E5 Compliance Offers Effective April 1, 2020

Microsoft 365 E5 Information Protection and Governance

This bundle highlights the opportunity for customers to know their data better, protect, and govern data throughout its lifecycle in heterogeneous environments. Often, the key starting point for many organizations in their modern compliance journey is knowing what sensitive data they have, putting flexible, end-user friendly policies in place for both security and compliance outcomes, and using more automation and intelligence. This bundle includes:

• Communication Data Loss Prevention (Teams chat) - To comply with business standards and industry regulations, organizations must protect sensitive information and prevent its inadvertent disclosure. With a data loss prevention (DLP) policy in the Office 365 Security & Compliance Center, organizations can identify, monitor, and automatically protect sensitive information across Office 365. DLP capabilities were recently added to Teams chat and channel messages for users licensed for Office 365 Advanced Compliance, which is available as a standalone option and is included in Office 365 E5 and Microsoft 365 E5 Compliance.
• Records Management – Manage regulatory, legal, and business-critical records across your organization. This helps organizations manage their legal obligation, provides the ability to demonstrate compliance with regulations, and increases efficiency with the regular disposition of items that are no longer required to be retained, no longer of value, or no longer required for business purposes.
• Machine Learning-based automatic classification and retention - Identifying sensitive data and creating classifications can be labor-intensive, and Microsoft is leveraging their leadership in the machine learning space to analyze and identify potentially sensitive content to be flagged for your review. Their first out-of-the-box solution in this area is to identify offensive language, and additional classifiers are planned around attorney/client privilege, resumes, source code, and more!
• Rules-Based automation classification and retention – Azure Active Directory Identity Protection is a feature of the Azure Active Directory Premium P2 (AIP P2) plan that lets you detect potential vulnerabilities affecting your organization’s identities, configure automated responses to the detected suspicious actions that are related to your organization’s identities, and investigate suspicious incidents and take appropriate action to resolve them.
• Microsoft Cloud App Security (MCAS)– This multimode Cloud Access Security Broker (CASB) solution provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your Cloud services. This is powered by native integrations with security and identity solutions, including Azure Active Directory, Intune, and Azure Information Protection. Use the MCAS Compliance Assessment to assess if your Cloud apps meet your industry’s compliance requirements.
• Customer Key – Helps meet compliance requirements by exercising control over your organization’s encryption keys. Customer Key is built on service encryption and lets you provide and control encryption keys. Microsoft 365 then uses these keys to encrypt your data at rest, allowing organizations to provide and control the root encryption keys for their Microsoft 365 data at-rest at the application level.
• Advanced Message Encryption – Send and receive encrypted email messages to people inside and outside your organization. This works with Outlook.com, Yahoo!, Gmail, and other email services. This helps ensure that only the intended recipients can view message content – which helps protect large amounts of potentially sensitive information. This also allows users to go above and beyond the basic functionality abilities, such as retracting messages. View our blog on Advanced Message Encryption.

Microsoft 365 E5 Insider Risk Management

This bundle focuses on insider risks, which often can keep business leaders up at night. Regardless of negligent or malicious intentions, identifying and being able to take action on insider risks is vital. The ability to quickly identify and manage risks from insiders (employees and contractors with corporate access) and minimize the negative impact on corporate compliance, competitive business position and brand reputation is a priority for organizations worldwide. This bundle includes:

• Insider Risk Management – Detect, investigate, and act on risky activities in your organization. Custom policies allow you to detect and take action on malicious and inadvertent risk activities, including escalating cases to Microsoft Advanced eDiscovery if needed. Such activities may include confidentiality violations, fraud, insider trading, intellectual property theft, regulatory compliance violations, and leaks of sensitive data and data spillage.
• Communication Compliance – Minimize communication risks by detecting, capturing, and taking remediation actions on inappropriate messages in your organization. Pre-defined and custom policies allow you to scan internal and external communications for policy matches so they can be examined by designated reviewers. These policies help organizations overcome challenges such as the increasing volume of message data, scanning increased types of communication channels, regulatory enforcement, and the risk of fines.
• Information Barriers – Restrict communications between specific groups of users inside your organization to safeguard internal information and avoid conflicts of interest. This is supported in Microsoft Teams, SharePoint Online, and OneDrive for Business. These barriers can be used to prevent a variety of situations, such as:
  • A day trader user communicating or sharing files with the marketing team
  • Finance personnel working on confidential company information sharing it with certain groups in the organization
  • Research teams calling or chatting online with a product development team before data has been quality checked
• Customer Lockbox – Maintain control over your Microsoft Cloud content with explicit access authorization for service operations. Customer Lockbox supports requests to access data in Exchange Online, SharePoint Online, and OneDrive for Business. This ensures that Microsoft cannot access your content to perform a service operation without your explicit approval.
• Privileged Access Management – Help protect your organization from breaches through granular access control over privileged admin tasks. Privileged Access Management requires users to request just-in-time access to complete elevated and privileged tasks through a highly scoped and time-bound approval workflow. This allows users enough access to perform the tasks they need to do, without risking exposure of sensitive data or critical configuration settings. It also allows for the use of access reviews, which requires the recipient and granter of permissions to reverify those permissions are needed on a regular or as-needed basis.

Microsoft 365 E5 eDiscovery and Audit

This bundle’s focus is to discover relevant data for internal investigations, litigation, or regulatory requests and respond to them efficiently. Doing so without having to use multiple solutions and moving data in and out of systems to increase risk is critical. This bundle includes:

• Advanced Audit –Gain extra visibility with new auditing capabilities that help with forensic and compliance investigations across many different services in Microsoft 365. Use Advanced Audit to retain all Exchange, SharePoint, and Azure Active Directory audit records for one year, instead of the default 90 days. Customize audit log retention policies for other services as well.   
• Advanced eDiscovery – Manage the end-to-end workflow of internal and external investigations. This solution builds on the existing eDiscovery and analytics capabilities in Office 365. Advanced eDiscovery preserves, collects, reviews, analyzes, and exports content that is responsive to your organization’s internal and external investigations.

Licensing

The Microsoft 365 E5 Compliance suite is available only to customers currently licensed for Microsoft 365 E3/A3 or for both Office 365 E3 and Enterprise Mobility + Security E3. If your organization would like to add on one of the bundles, the following licensing is required:

• Microsoft 365 E5 Information Protection & Governance
  • Requires: Any Microsoft 365 plan or [Office 365, Exchange, SharePoint, or OneDrive for Business plan AND Azure Info Protection Plan 1/EMS*]
• Microsoft 365 E5 Insider Risk Management
  • Requires: Any Microsoft 365 plan, Office 365, Exchange, SharePoint, or OneDrive for Business plan
• Microsoft 365 E5 eDiscovery and Audit
  • Requires: Any Microsoft 365 plan, Office 365, Exchange, SharePoint, or OneDrive for Business plan

*Azure Info Protection P1 (included in EMS K/F3/E3/A3) required.

How Interlink Can Help

Understanding which licensing option is best for your organization’s environment can be tricky. We know what compliance and security standards are needed and the best practices to get there. Contact Interlink today to st­­art a conversation on what security and compliance steps your organization should be taking!

Interested in learning more? View our similar blog: Important! Microsoft’s SMB Offerings Renaming & Changes Guide.