Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

In this session I delve into the encryption technology used in Microsoft 365 and Microsoft Purview. Including the concepts of Customer Key and Double Key Encryption.

1. Albert Hoitingh Encryption in Microsoft 365 Start 7:45

2. Encryption in Microsoft 365

3. Principal consultant Microsoft Security MVP Albert Hoitingh

4. Today’s agenda

5. Encryption in Microsoft 365 and Purview

6. Different scopes

7. Short side note…

8. Short side note…

9. Licensing considerations

10. Data at rest Per-file encryption (SPO) BitLocker – on many levels Data Encryption Policies ( DEPs ) SharePoint Online and OneDrive Exchange Online All other Microsoft 365 services, incl. Microsoft Purview Information Protection

11. Data in transit Secure Real-Time Transport Protocol (SRTP) (Mutual) Transport Layer Security (MTLS/TLS) Exchange IRM – s/MIME – OME https://www.adaptivedigital.com/secure-rtp/

12. Key management

13. Key management

14. Microsoft managed SharePoint Online, OneDrive Exchange Online

15. Customer key Access by Microsoft Organization in control Different DEPs , including multi-geo Azure Key Vault Hardware Security Modules

16. Customer Key SharePoint Online, OneDrive Exchange Online

17. Customer Key per DEP https://learn.microsoft.com/en-us/purview/customer-key-set-up

18. Customer Key per DEP https://learn.microsoft.com/en-us/purview/customer-key-set-up

19. Customer Key status

20. Double Key Encryption Tenant key and organizational key Office Apps | Sensitivity labels Impairs specific functions

21. Double Key Encryption

22. Sensitivity labels

23. Items and labels Encryption | Visual markings | Offline availability Label stays with item Hierarchy is important

24. Encryption standards

25. How it works

26. Filetypes are important Microsoft Purview Information Protection Viewer client Native clients | Microsoft Edge Watch out for the file extension | some types only support classification

27. Identities are important Microsoft Live | Guest | RMS Entra ID accounts Set- SPOTenant -EnableAzureADB2BIntegration

28. Identities are important Microsoft Live | Guest | RMS Entra ID accounts Set- SPOTenant -EnableAzureADB2BIntegration

29. Consequences eDiscovery | content search Co-authoring | auto-save Microsoft 365 Copilot

30. Consequences eDiscovery | content search Co-authoring | auto-save Microsoft 365 Copilot

31. Consequences eDiscovery | content search Co-authoring | auto-save Microsoft 365 Copilot

32. Microsoft Purview Message Encryption

33. Secure e-mail in Microsoft 365

34. Microsoft Purview Message Encryption

35. Advanced message encryption Mail rules using sensitive information types Revocation and expiration Information Protection and Governance Compliance E5 Microsoft 365

36. Encapsulated e-mail message Outlook: opens natively . pmsg file MPIP viewer does not work Secure web-portal

37. E-mail attachments Do not forward | Encrypt only Non-protected Office document Protected Office document Mind the Entra ID account Set- IRMConfiguration - DecryptAttachmentForEncryptOnly <$true|$false>

38. Run-through Message Encryption

39. Things to think about

40. Tips and tricks Sharing encrypted files Older metadata model (MPIP_) Decrypt documents from SPO: Unlock- SensitivityLabelEncryptedFile Super User role eDiscovery (Premium) Encrypted/Signed PDFs Guaranteed SharePoint Permissions

41. What about migrating? https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-tenant-to-tenant-migrations?view=o365-worldwide

42. THANK YOU Are there any questions? Please evaluate this session in the App.

43. Next session 10:10 – 11:00 The Graph API StarterKit for AVD and W365 automation