Joanne and I have recently been discusing now people view classification of content.  Not just the process, but even the definition of classification.  We find that a lot of confusion occurs because many people define the classification of data different than Microsoft does and when reviewing Microsoft information problems can occur due to that mismatch of understanding.  So we decided to discuss that in the next episode of Compliance Unplugged.

I had a really quick trip to Boston this week to speak at CollabDays New England.  It's been a few years since my last trip here and I'm happy to have been part of it.  Boston and area is gorgeous and the fall is even more so. Like New York, I am only here for a very short time.  Less than 24 hours. 

In a first for me, I have made the trip to New York, NY.  I have been in New York before, but only passing through in a flight layover.  This time, I am getting to stay for a whopping 24 hours.  I get a double honour of speaking at the Experts Live conference and to speak with two fantastic data security specialists: …

Learn how to protect sensitive data with advanced data loss prevention (DLP) strategies in Microsoft Purview.

Completing our Insider Risk Management discussion, Joanne and I are discussing how Insider Risk Management integrates with Data Lifecycle Management.  In this series, Joanne and I discuss how other tools in Microsoft environment integrate together to provide a great security experience.  In this episode we cover IRM and Data Lifecycle Management. I invite you to take a look at the video on our YouTube channel: …

Continuing our Insider Risk Management journey, Joanne and I are discussing how Insider Risk Management integrates with Conditional Access.  In this series, Joanne and I are discussing how other tools in Microsoft environment integrate together to provide a great security experience.  In this episode we cover IRM and Conditional Access. I invite you to take a look at the video on our YouTube channel: …

Continuing our Insider Risk Management journey, Joanne and I are discussing how Insider Risk Management integrates with Conditional Access.  In this series, Joanne and I are discussing how other tools in Microsoft environment integrate together to provide a great security experience.  In this episode we cover IRM and Conditional Access. I invite you to take a look at the video on our YouTube channel: …

Recently, I released a post concerning protecting data against third-party cloud storage.  This post is similar but focuses on applications installed on the workstation.  A common use case is blocking sensitive data from being accessible for applications like Dropbox.  The argument could be said that the organization could just block the application from being installed, or they could have a corporate version of the application and monitor through Defender for Cloud Apps (a post for another day). 

A common method for data to exit an organization's control is through third-party applications.  These applications can be cloud storage like Dropbox or Google Drive.  They can also be applications such as Grammarly with access to a cloud infrastructure.  To support the control of this, it is possible to create Data Loss Prevention (DLP) policies that monitor when data is accessed by these applications. 

A common method for data to exit an organization's control is through third-party cloud storage locations such as Dropbox or Google Drive.  To support the control of this, it is possible to create Data Loss Prevention (DLP) policies that monitor when data is moved to these locations.  The DLP policies can even block the content uploaded to these locations should the organization determine this is necessary to protect their environment. 

A common gap in data security is caused when users store content belonging to the organization in cloud storage not controlled by the company's IT infrastructure.  When this occurs, the content is potentially no longer under the control of the business and is at risk for misuse.  Whether this is a malicious act or an innocent one, the outcome is the same. 

In Episode #6, Joanne and I introduced Insider Risk Management.  This was to coincide with the blog posts I wrote on the subject, and it worked out well because Joanne had just completed a webinar and conference session about it as well.  In this episode, we start our drive down into the various Purview features that work with Insider Risk Management. 

Some time ago, Microsoft released a feature into Purview that provided a new "after retention" action to a retention label.  Microsoft called it "Automatically apply another retention label".  The Record Management community of Microsoft Purview immediately changed that and now fondly calls it "Daisy Chaining Retention Labels".  Microsoft still uses its boring explanation for it 😉 . Daisy-chaining is exactly as it sounds. 

I have previously discussed that the wording of your query is very important in Security Copilot.  But another key item to be aware of is also which Copilot to use when.  You really want to use the correct Copilot for the task at hand.  Or, as I like to call it... Don't burn your SCUs (Security Compute Units) on wasteful queries.

Recently, I provided an overview of Security Copilot.  In that post, I discussed the 50,000-foot view of Security for Copilot, its origins, and some of its use cases.  Security for Copilot encompasses a pretty large area of focus in the Microsoft environment.  And to be honest, it isn't limited to just Microsoft products.  Already, there are dozens of integrations with other tools, such as CrowdSec, Darktrace, CheckPhish, and more. 

We all have seen it, and some of us are living through it, but every organization and many users are making use of AI systems in their day-to-day work.  Within Microsoft's security realm, we have Copilot for Security.  I previously provided some insights into how you can deploy and set up Copilot for testing (however, the same steps can be used for production as well). 

Previously, I provided the steps for monitoring the usage of Copilot for Security within your tenant.  This is important to ensure you are not over-deploying SCUs unnecessarily or under-deploying the SCUs based on the needs of your organization.  Now that we have established how to review the cost let's move on to controlling the cost.  In this post I'll demonstrate some methods for managing Copilot for Security costs with provisioning.

A very important feature of Microsoft Purview and something that should be strongly considered for your Data Protection Program is Insider Risk Management.  Joanne Klein and I feel it's such an important part that we have made an entire series around it in Compliance Unplugged.  In episode six, Joanne and I introduce Insider Risk Management and give a highlight of the different features of Purview that integrate directly with IRM.