GDPR

Azure Conditional Access policies can be used with Azure Information Protection (AIP) to secure protected documents against unauthorized access. If you have already decided to use AIP as part of your Office 365 data protection strategy, adding a conditional access policy is a quick way to frustrate people who try to access documents when they shouldn’t.

It’s hard to find and fix every legacy on-premises setting. In the case of OneDrive for Business, it allows users to stop their site appearing in search results. That doesn’t sound too bad, but blocking search affects many other Office 365 features and it’s a good example of how a legacy setting can have a big influence in the cloud. Fortunately Microsoft agrees and they’re going to fix the problem. We don’t know when or how the fix will come, but when it does, users won’t be able to disable eDiscovery for their OneDrive for Business site.

According to Office 365 notification MC187538, Microsoft plans to start asking users to give feedback about Teams in pop-up surveys within the app to help Microsoft improve functionality. That all sounds OK until you consider that Microsoft will control the data it obtains from users and tenants will have no insight into what their users have told Microsoft. That’s not right.

Office ProPlus Version 1904 boasts new privacy controls and Microsoft has documented how it thinks about required and optional data collected from users. Office 365 still lacks privacy controls for the server apps. It remains to be seen if customers will be happy and consider that Microsoft has solved the GDPR issues identified in the Dutch DPIA report in November 2018.

Microsoft has announced that version 1904 of Office ProPlus (click to run) for Windows includes new privacy controls to allow organizations limit the data sent back by the Office apps. There’s no word about when they will deliver similar controls for Office for Mac, Office mobile, and the Office 365 server apps. Privacy is a real challenge in a world where cloud apps gather so much telemetry to measure performance, reliability, and other aspects, but it’s good that organizations will now be able to control how much they share with Microsoft.

Delve is a great way to learn about important documents other Office 365 users are working on, but it can sometimes reveal something that it shouldn’t. Mostly this is the fault of the owners of SharePoint sites where documents are stored, but there are situations when people just don’t want Delve or other Graph-based applications revealing anything about their communications.

A report prepared for the Dutch Government slams Microsoft for GDPR personal data violations discovered in Office 2016 and Office 365. The best intentions lie behind the amount of telemetry sent back to Microsoft for user actions and the audit data gathered by Office 365, but GDPR makes it clear that personal data must be protected, and Microsoft might be failing.

When someone leaves your company, you might need to preserve their Office 365 data. Email, OneDrive, and SharePoint are straightforward, but what about Teams? As it turns out, a content search or an Office 365 DSR is a good way to retrieve information about Teams messages and information about their activities can be found in the audit log.

Microsoft has done a good job of helping Office 365 tenants prepare for GDPR, but the best intentions sometimes run into difficulties. Such as what you might find with the new GDPR Data Loss Prevention policy template, which does an excellent job of finding things like European tax numbers… but sometimes too good a job.