EzCloudInfo

A year ago Microsoft released the information barrier policies as another security enhancement feature in Microsoft Teams. With this new component it helps the organization to enforce policies which prevents the communication between specific group of people. This is primarily helpful and beneficial for the organizations who are into manufacturing and production units where they would need to adhere certain industry standards and guidelines usually to avoid conflicts of interest.

Before we actually move into deploying the information barrier policies segmentation of the users needs to be done.Ideally the business requirement which falls into compliance category to prevent communications between groups of users in Microsoft Teams. For example a person from Marketing Team cannot make a call,send instant messages or share his desktop to Research department. It can be vice versa or its is only one direction. All the sets of users needs to be identified because this contributes to the number of the segments that we are going to create for this policy to prevent the communication between them.

There are three key elements involved in creating the information barrier policy:

1) Segment the users in your organization.
2) Define Information barrier policies.
3) Apply the information barrier policies.

Below prerequisite needs to be met for creating the information barrier policies:

1) Users must have any one of the following license assigned – Microsoft 365 E5,Office 365 E5,Office 365 Advanced Compliance or Microsoft 365 E5 Information Protection and Compliance.

2) Enable scoped directory search for Microsoft Teams

Scoped directory search can be easily enabled from the teams admin center with the below toggle switch.

3) Turn on the Auditing on the audit log search page in Security and Compliance center. This is required for troubleshooting Information barriers policies. If we do not see them turned on then it is already enabled.

4) No address book policy should be enabled if we need this feature. Because Information barriers are based on address book policies and if we have them it might create a conflict and start working based on the configured address book policy.

5) Grant Admin consent for information barriers in Microsoft Teams.

Login-AzureRmAccount 
$appId="bcf62038-e005-436d-b970-2a472f8c1982" 
$sp=Get-AzureRmADServicePrincipal -ServicePrincipalName $appId
if ($sp -eq $null) { New-AzureRmADServicePrincipal -ApplicationId $appId }
Start-Process  "https://login.microsoftonline.com/common/adminconsent?client_id=$appId"

Once we run the above command global admin with the required privilege needs to grant admin consent to the information barrier processor app. This helps information barriers from removing persons from chat sessions where they are not supposed to be in them.

6) Ensure that the required data user attributes are populated in the user attribute fields which is required to identify and apply the information barrier policy.

In our example we’ve chosen 2 ideal candidates and populated the department attribute value which will be used for segmentation.

Now we need to segment users which means “Block” policies prevent sales group from communicating with research group.

In order to accomplish this task we need to connect to office365 security and compliance powershell module

In our example we can take two groups marketing and research where they both shouldn’t communicate with each other.

New-OrganizationSegment -Name "Marketing" -UserGroupFilter "Department -eq 'marketing'"

The above example creates a segment of users who are only from marketing department.

In our case we need to create one more segment of users where they belong to research team

New-OrganizationSegment -Name "research" -UserGroupFilter "Department -eq 'research'"

Now we have created the segment the information barrier policies needs to be created. Now we have to keep few things very clear in mind while applying the information barrier policies. For instance two policies cannot be applied to one segment of users. It is always advisable to make this information barrier policy to inactive status once they are created. Later we can edit this and apply for all users.

When we block communication between two segments in our case marketing and research we need to define two policies. A very important point to note is that each policy blocks communication one way only.

New-InformationBarrierPolicy -Name "Marketing-Research" -AssignedSegment "Research" -SegmentsBlocked "Marketing" -State Inactive

Now we need to create another policy to block the marketing department to communicate with research.

Activate the information barrier policy

Set-InformationBarrierPolicy -Identity GUID -State Active

We can verify the information barrier policies that we have created to ensure they have the correct values as per our requirement.

Now we need to start the information barrier policies with the below command

Start-InformationBarrierPoliciesApplication

As per the information we’ve received in the above command we need to wait for a while until the deployment gets completed in our tenant and will be successful once the status becomes completed.

Testing the information barrier policy to applied recipient.

Now logged in as Vijay Raghavan user from Marketing Team while attempting to search for Clen Richard from Research he gets an empty result.

However he is able to lookup for other users.

The users who are applied in this policy will not be able to add the blocked users in any of their teams as well.

The same thing happens for the other user Clen Richard on attempting to talk to the user from Marketing Team.

Subsequently the information barriers adds a great value to any organization to uphold the communication compliance with few easy steps from the office 365 security ad compliance center and consistently utilize Microsoft Teams.As of now information barriers apply to Microsoft Teams chats and channels only.

With the Azure active directory powershell commandlets, we could control the lifecycle of office365 groups.Ideally when any office365 group is created for an action of creating a team in the backend it creates the azure ad group.With the Azure commandlets we have options to control the lifecycle of the office365 groups automatically.

Let’s say we ‘ve created Team for a partner project which completes in 1 year time period, we have got an option to expire this team in 1 year time during the team creation.This keeps the access reviews of the Microsoft Teams intact and ensures that only required persons have access to the company corporate data.

The default setting is unlimited days as it should be for most of the scenarios.

Firstly we need to connect to azuread module from the powershell. Since we do not have any group life cycle policy the value remains empty.

Below example creates a a new groupLifecyclePolicy. This policy can be applied to targeted set of office 365 groups.

New-AzureADMSGroupLifecyclePolicy -GroupLifetimeInDays 99 -ManagedGroupTypes "groupid" -AlternateNotificationEmails "sathish@ezcloudinfo.com"

The managed group type parameter provides us the option to choose how we can manage the groups in our environment. Keeping the value “None” will create the policy but will not be applied to any groups. Specifying them “All” will apply this policy to all Office 365 groups. “Selected” will provide us the option to choose specific Office 365 groups.

To test this we can try to apply this policy to single group Teams-Partners. This group was created as an action of creating a team in Microsoft Teams.

In order to apply to a group we have to run the below command by specifying the group ID.

Get-AzureADMSGroupLifecyclePolicy -Id "admsgroupid" | Add-AzureADMSLifecyclePolicyGroup -GroupId "ID"

If we need to apply this to a group of ID’s which were reviewed and require to set expiry we can apply them from a input csv.

$policy = "mentionthepolicyID"
#keep the groupid as the input value in the csv
$365group = import-csv ".\365group.csv" 
Foreach ($group in $groups) {
Add-AzureADMSLifecyclePolicyGroup -Id $policy -groupId $group.objectId}

We can run this on a periodic interval after performing access review on the Office 365 groups.There is also an option to notify the group owner on a particular period of time to review if they still require this group to be in the system. Keeping this option will remind the owner of the group who created the team to decide if they require to provide access to the users and external parties if the guest users are added to them.

We can then verify if it is applied for a group by using the commandlet Get-AzureADMSLifeCyclePolicyGroup by specifying the group id. This will return the output of to which AzureADMSgroup it have been assigned. We do have an option to extend the grouplifetime to our desired interval.

There are few organizations where the Office 365 group and teams group creation is provided as self service to users to increase the Office 365 adoption rate.In those cases the admin can review the groups created once in a month and apply the expiration policy for them.

This option will be better for the admins to create the expiry of the groups as per the company security policy.If we are doing a periodic review we can also use a input CSV for the selected groups and can apply the policy to these selected groups.

Microsoft Teams is being used as a most preferred method of communication platform by many organizations. By default in office 365 the group creation is enabled for end users which will allow them to create public and private groups. Few organizations are having the group creation disabled on the organization level for larger scale companies and have users request for creating the teams using a request form which will run through a automation process in the background with help of azure automation accounts ,Microsoft flow or few other mechanisms.

But few organizations are really interested in allowing the users to create the Office 365 groups once their workloads are migrated to office 365. This is primarily to increase the adoption rate of Office 365 workloads Microsoft Teams and SharePoint online.

We have more options available in Office 365 cloud app security. By leveraging these options we can better secure the Office 365 suite of products which in turn controls the Data loss prevention, security compliance, information governance and threat management for the entire organization.

Through Cloud App Security –

Navigate to Cloud App Security – https://portal.cloudappsecurity.com

Select and create Activity Policy

Do not choose any policy templates – select policy severity – category as per classification – Have selected compliance in below example.

Choose the acton single activity – activity type – equals – Team Created.

There is another alternative to create the policy as below by choosing the teams app. Going with this approach provide us more options like to get notified when teamsettingchanged,cut/copy item. adding a channel, changing a channel settings and when a team is deleted. There are lot of other actions which can be added based on our requirement.

Choose the severity and specify the email notification alert with no action.

The security administrators responsible for viewing this new group creation alerts can be added over here.

Further governance actions can be specified. We have an option to notify user and cc additional user with custom message.

The custom message can be added over here. There is an option to add a hyperlink as well.

When a new team is created by the end user the specified email address is notified.

We get more information on the cloud app security alerts.

We can use cloud app security for other activities in office 365 applications as well to notify the security administrators or the SOC team, so that they will be able to monitor the events which are categorized as non-compliance in Office 365 organization according to their security guidelines.

Thanks & Regards

Sathish Veerapandian

When an office 365 group is created, we have options to collaborate with public partner accounts .As a result of this People outside organization can see and have access to office365 public groups contents when they are been invited as guests.

When we have allowed the end users to create the office 365 groups and invite the external partners to collaborate,over a period of time the groups left unattended without the access reviews. There is a high possibility of an user having access to the sensitive documents which they don’t need them anymore.

In order to alleviate these security issues , we can influence the Microsoft Azure Identity Governance – Access reviews

With the access reviews created for office365 groups , we can let the group owners review their office 365 public group guests present on them and take necessary action based on the requirement.

In order to create access review navigate to azure portal – Identity Governance – Access reviews – Click on access review – Select New access review.

Now we can create them with name ,description , start date and frequency of how often the access reviews needs to take place for the office365 groups.

We can set the number of times, end date and the scope to guest users only. And target the external groups which have the guest users added. Probably this part needs to be reviewed periodically and add the new groups in this list.

Furthermore we have the options to customize the reviewers who will be the reviewers of this access review task.

Upon completion we have the action to choose – Remove,Approve or take recommendations.

Finally we have few options which is present in the advanced settings. Once the customization is done as per the requirement we can start the review.

Once the schedule is triggered as per the configuration the reviewers get an email with the timeline.

Once clicked on review the user gets the guest user details and the options to take action based on the business requirement.

The reviewer gets an option to type the comment and take the necessarily action.

We have the review results section where we have an option to download the access review tasks and save them for ISO audit compliance which will help during the ISO Audit Evaluation cycles.

This is usual in most of the organizations when the guest accounts are provided access to the business sensitive content. Ultimately its the group owner’s responsibility to periodically review them and take necessary actions.

There is lot more to get benefited with Identity Governance access reviews. The above method will help us in evaluating and having right access only to the required individuals in Office 365 Groups.

Regards

Sathish Veerapandian