Welcome everyone. And thanks for joining today's webinar on leveraging Microsoft Purview to reveal hidden compliance and privacy risks in your data. I'm Shana Muridofo, Chief Revenue Officer here at AIT, and I'm excited to introduce our speaker, Rob Sandling, AIT's Senior Solution Architect. Rob brings in deep expertise in Microsoft security solutions, and today he'll walk you through how Purview can help you uncover and mitigate compliance and privacy risks within your data. And please make sure that you stick around because we have an exclusive offer for the attendees at this webinar. We really have something very special for you. So let's get started. Rob, over to you. Thank you, Shannon, and good morning, everyone. Very excited to go through this material and work through some of the amazing capabilities that we have available in Microsoft Purview. To start with, let's begin with what is Purview? Well, that is a very big question. Purview is Microsoft's data security, data governance, and risk compliance platform. It began as two separate products, Azure Purview and M365 compliance. It is now one holistic solution that fills all of the services that these two separate products once filled individually. This product has a wide reach into your M365 estate and any other mapped data sources. It's capable of reviewing emails, Teams communications, monitoring files within your estate, both within SharePoint and without, and specifically it looks for the kinds of things that we need to keep an eye on that often get overlooked as data moves through your data sphere. To help with the understanding of what Purview brings to the table, I find with Microsoft products in particular, it's helpful to look at the literal name, what the definition of the word is, Purview, the scope of the influence or concerns of something. Purview is exactly that for all things Microsoft, but more so as well. It is a set of tools designed to answer five key questions: What is the data? Where is the data? Who has access to the data? Where is the data going? And how long is the data required? These are essential questions for any organization to answer because incomplete understanding of these questions creates security risks in the environment. This becomes a problem in the age of AI that we all currently face ourselves with today. AI has the capability of automating the search for and surfacing of information in our estates. Employees are right now using tools, sanctioned and otherwise, to manipulate their information in new and creative ways. There's a lot of opportunity in this space, a lot of values being brought. We're modernizing processes. We're improving margins. It's great and wonderful things to make everything we do easier, more efficient, more accurate. But it also comes with it some risks. If employees don't have Copilot available, for example, maybe they're defaulting to the free version of ChatGPT. ChatGPT is trained based on the information that is fed into it. So now we have a piece of private information that the employee is trying to understand in a new way, and they're acting in good faith, trying to execute their duties and responsibilities, but they've taken that data and fed it to OpenAI, and now once OpenAI updates their model, that information is available to everyone. We need a way to categorize, quantify, and understand data that allows us to control this behavior to prevent those leaks. In addition, overshare in general is a huge risk. As an example, and I'm gonna call out our CEO here who's watching us this morning, I can ask Copilot about his schedule, and I can receive details that he's probably certain that he doesn't want me to have. This is real. Now I understand why in internal leadership here at AIT. We we we understand this situation, and we're working on it internally, but do your organizations have that lens? Are you capable of finding these interactions? Zero trust is the core of all of this thought. We can't trust anything. Purview operates in all five pillars in various ways. It has an ability to view this estate in a unique way that helps us categorize and organize ourselves and control this situation that is unfolding before us. So why now? AI is the new tool. Everyone understand, however, the risks associated with oversharing of data have already existed in your estate for some time. Now, why? Well, again, going back to the example I gave earlier, what private information do you have in your environment? What controls do you have to view that information? Who has access to it? Who in your environment needs access to it that you're not aware of, but they're currently working around the system instead of through it? All of these things are real today, but when we layer Copilot or any other AI tool on top, we give users a power to accelerate the interactions with their information, and as those interactions accelerate, we've increased our effective risk over a period of time. This risk was the same as it was before, but I don't know what I don't have access to. But now I can ask Copilot and get information I didn't know I had. What am I going to do with it as an employee, as I service this need that I am trying to surface? To address this, Microsoft has introduced a new tool to Microsoft Purview. It's called data security posture management. It integrates heavily with other Microsoft three sixty five secondurity services, in particular, insider risk management, which is another purview tool. This tool surfaces to us a collection of scores. It's very similar to the Defender scoring system. For those of you that have used the Defender admin panel and looked at your security score, where we can break things apart by identity, endpoint, various categories, it gives us a list of things that we can do to improve the environment. Suggestions. They're scored based upon their impact to the estate, their value to the estate. Data security posture management does exactly that for our data access concerns. We have a file cabinet. It's got an unknown volume of items in it. Most of it hasn't been properly categorized. We don't have enough man hours to categorize them. This tool gives us those. We now have, instead of this impossible mass of unmanageable things that we need to properly label so we can understand them and impose policy on, we now have instead a collection of steps that make suggestions on how we can review that environment. There is further a special feature that will become available as part of this functionality later this year. This tool gives us the unique capability to disable Copilot's ability to access a SharePoint data repository while the user retains their current access. Let that sink in for a moment. We can keep the same situation we have now, at least in regards to Copilot, while we buy time for additional processes to unfold to categorize this information and get control of the risks. So how do we get it? Purview is licensed as part of your M365 licensing journey and strategy. M365 Business Premium users, you get the DLP functionality. That's what you start with. M365 Business Premium users also have available upgrades. Though the options there are more limited than the larger subscriptions, we do have Purview available for the Business Premium community. For the enterprise customers that are using the AG or E series licenses, your basic license is m three sixty five e three. Beware that m o three sixty five is the wrong place. Those do not work. Those don't contain security or compliance functions. If you need further assistance with this, I encourage you to reach out to our sales team. We're very good at licensing, and we would love to assist you with any concerns that you have in that space, and help you develop a licensing strategy to deliver the functionality you need without, you know, blowing the budget. So what's next? We have the offer that Shannon mentioned earlier. Our partnership with Microsoft has enabled us to perform security assessments of varying types and kinds for our customers. These are available to you at no charge if you meet the qualifications. There's a QR code there. It will take you to a website that can get you more information. Do we have any questions? I would love to know if you have anything else to add to this. I know that there's so many other things that we went over in prep for this meeting that we left out. And I thought, this is a great opportunity for us to go back and really kind of highlight some of the things that we wanted to do in the interest of time. And while you're reviewing that, I'd love to encourage everyone on this call to be able to take just a moment and think through your questions. You have access to our senior solution architect at this moment, who's talking about something that is coming your way quick and fast. So take a moment, think about what you need in your environment and really think through what kind of data you have and if you know what you have in your environment And just ask us what you need because we're here for you. Purview is huge. It is every bit as large as the M365 estate. And if we consider all that Microsoft offers, Purview is there for every component of that journey. Yes, William Karl, he's asking if we can use Purview outside of M365. Yes, we very much can. That is available as part of Microsoft's data map feature. It allows us to hook third party functionality into the Purview environment. That includes AWS S3 buckets. That is the Azure storage spaces. Those are your local file servers. Those are websites. It has connectors and plug ins for just about everything. It's a whole marketplace unto itself that allows us to bolt in these different data sources, and once they're bolted into the map of Purview's estate, there are various scans we can execute that will review the data inside of those spaces, looking for defined patterns and signatures. We can find, for example, social security numbers, phone numbers, addresses. We can build custom filters as well to look for special types of information. This is a very powerful tool to understand and use for any organization that has compliance requirements, or if they have proprietary information, for example, engineering firms, this tool can help you identify leaking blueprints. Medical firms, this can identify pharmaceutical information, chemical breakdowns, molecular maps, other scientific data sets that should not be leaving the organization. These tools can highlight those, and we can identify the workflow that is exposing them, which allows us to address those concerns. So yes, we very much can and should be integrating information from outside the Microsoft estate. James, Martin, your question, If only you knew what you needed to know. Yes. That is why I wanted to highlight the specific functionality of data security posture management. That tool breaks down the unknown into a series of tasks, and as those tasks are performed in concert with, you know, technical assistance if necessary, the understanding that you need grows, because ultimately, as I mentioned at beginning of this webinar, the risks associated with our data being unmanaged, they're already there. We're dealing with that today. We've been dealing with that forever. That's been true since we did business writing things in books. It's no less true today with, you know, cloud enabled data structures. But today, we have the AI itself reviewing our information for us and breaking it down into bite sized pieces. So the drive of this of today, the need of today, the AI surfacing our information in new and creative ways, it's not just being surfaced for your employees to use or misuse the information. It's also being surfaced within the tools themselves, and that is how the data security posture management tool does its job, and its purpose is to educate you on what's there. In fact, the greater purpose of Purview in general is to is to fuel that conversation, because governance is hard, and we don't know what we don't know, and these tools are designed to be that flashlight into that unknown. Please feel free to continue to drop your questions. Know, one of the things that we really love about these kinds of webinars is that they really are an open opportunity for conversation. We love to hear what your real live use cases are and what you don't know, and we're happy to answer those questions. So please make use of the time well. We do have this open opportunity to speak with Rob and really pick his brain on what is going on, especially in light of all things that are coming with Copilot being able to access SharePoint in this next quarter. So maybe I should talk about that some more. That's a good one. Copilot. Copilot is a big topic on its own. To be clear, my comments are going to be focused on M365 Copilot, which is the per user version of Copilot that we can deliver to users within M365. Today, I can open my Teams. I can chat with Copilot as if it's a coworker, and I can direct it to review information of specified data. I can target anything in any of the SharePoint repositories that I have available. I can't target files on my computer itself. That's one of its limitations. The Copilot feature set needs to be cloud data, because Copilot doesn't live in my computer. It lives in the cloud. So I can have it review emails, tasks. I can have it review files. I can have it review images, and I can create a query to direct Copilot to grab specific selected information and perform an action. This can be multiple spreadsheets being combined into a new type of report we've never done before. It could be surfacing something as a PDF that is currently a combination of other formats. It could be any number of things. And when I when I perform that task, there is that extra work. I have to go find what I'm looking for. I need to tell Copilot explicitly this item, this item, this item, this item, combine that item, make it look like this item over here, and reorganize the information with this objective. Then if I'm aware of my time, I need to save that prompt because it's going to immediately forget it, which is one of Copilot's greatest security features, actually, is it does not remember anything. You need to learn how to use it. It will never use you. But that result is still limited. This year, as time progresses, this is gonna be rolling out to tenants as, you know, shortly after this conversation. It's it's already begun. Microsoft will be enhancing Copilot's capabilities specifically such that users no longer have to reference specific files. They can reference an entire SharePoint repository, which is going to kick start its use as a general search engine of everything you have in SharePoint. It boggles my mind thinking about the value that we're gonna be able to bring up quickly. Rob, Mark Sullivan asked, is DPSM available with compliance E5 add on? That's where you get it. That is one of the core features. M365 compliance E5 is where you get this feature. It is a part of M365 E5 in general, but you can combine M365 E5 compliance with M365 E3 to gain this functionality. Business premium users, there's a different subscription that has it. It's a longer name. I can get that information to you later. It's not coming up in my brain right now, but we have this functionality available for both sides of that fence from a licensing perspective. Azure files are joined via the data map. So James, if you're wanting to get into Azure files, we can do that. It's handled just like a Windows file server is. We link it into the data map and run the scans within that particular tool. And once once again, once it's in the data map, the data security posture management tool will start receiving the telemetry from that link and start making suggestions on how we can secure that information. Are there places that it can and can't access in Azure and o three sixty five? I'm not sure if you answered that completely, but maybe. I'm unaware of any data that is stored within the Microsoft sphere that ultimately cannot make its way into Purview. Purview has heavy hooks into Microsoft Fabric, all of the Azure SQL components. I'm trying to think if there's any holes in there that I'm aware of. It's a very complete offering. We run into some challenges from time to time. Planner and tasks, those are in a M365 mailbox or within a Teams message store. Those are cloud resources and all included by default. Your desktop items are outside of that space to some extent. Continuing answering James' question here about planners, tasks, and desktop stuff, this is where the greater integration with M365 secondurity components start to come to bear. When we have Defender for Endpoint P2 on a endpoint, we have some very detailed and powerful telemetry coming from the endpoint itself, and the DLP functionality of Purview now has the ability to map and control a piece of information all the way through the endpoint. At that level, yes, we can see a volume of information of files that are on the endpoint itself. Excuse me. It's not as detailed as the cloud information, but it is sufficient to map information coming in and out. So typically, what we'll see is we'll see alerting when we have a particular type of information being flagged, like, say, a social security number is a common example. If the platform sees a social security number enter the system, if it came from a desktop file, we will get some information about where that came from, which includes its source. And if that endpoint has Defender for Endpoint on it, then we will see the specific file it came from, its name, and some other and the user that owns it and and other related information. If the information is in our estate and it has is is so marked and it moves out of the estate into the desktop, say a user is intentionally trying to exfiltrate information, that behavior is flagged as part of Purview's insider risk management product, which is a separate license eyed item. The M365 Compliance Bundle does not contain that, but there is an M365 Insider Risk Management license that does add that. This is an additional set of tools, and again, all of these integrate. So I'm grateful for the questions because I can get very easily lost in all of M365, and Purview is all of M365 from a government's lens. It's very broad spectrum of tools, and they all integrate. So understanding where one stops and where one starts is one of my largest challenges. Rob, Mark Sullivan has some follow-up questions. So Copilot is supposed to only surface data people have rights to. Correct? That is correct. Copilot is limited to let me back up. M three six five paid Copilot is limited to operating within specific contexts. The parent context is the user's context, so whatever the user can do is what Copilot is limited to to start with. We have some additional controls, as I mentioned earlier, within data secure data security posture management where we can manipulate Copilot's access separate from the user. But I have to specifically call out the paid version of Copilot, because the free version of Copilot that's available on the Internet has all of the same security issues associated with it that ChatGPT does. It is a publicly trained model, and like anything else, when you are when you're not paying for it, you're the product. So, you know, Copilot being Copilot in both places, things can get confusing. But that is correct. Copilot internally can only do what the user can already do. Copilot in and of itself does not add any additional risk. Copilot is just surfacing the fact that we have individuals within our organizations that have access to way too much stuff. But we don't know what we don't know. And now we're back to Data Security Posture Management's capability to review access, look at the user's behavior, and make suggestions on where things might need to be broken down. So, Mark, I think that answers the second part of your question, which is, are you saying that CoPilot helps uncover misconfigured security? He had one more follow-up question, Rob, and that is, is there built in classifiers for identifying CUI and ITAR data? Yes. So the ITAR data needs to be identified much more stringently, because ITAR data is probably going to boil back to blueprints and other critical items involving the designs that are moved around with military contractors. Those data sets are they need to be specially handled. Just like the government requires different labels being attached to things, we need to make sure those labels are being applied to those files as they move through the ecosystem and they're created in an automated way creation. That is a core function of Purview, and we have built in label types to deal with those information types. What's not so automatic on the ITAR side is exactly which types of information need to have what label. To get the answer to that, you will need to work with our data governance specialist, Josh. That's his wheelhouse, is helping organizations figure out where those labels go, and that's a whole world unto itself. But as far as CUI goes, most common CUI items names, addresses, phone numbers, social security numbers there are built in signatures to look for those things, and we just basically enable them and aim them at a dataset. Those are fairly straightforward to implement, though the enforcement of what you should do once a piece of data is appropriately labeled, that's where we need to be careful. And again, you're gonna wanna talk to Josh, because if we label something and act on that label without understanding that action very clearly, we can find ourselves in a very, very ugly situation. And we have had customers come to us where nobody in their organization can email anything anymore because they labeled everything, and the policy said, You can't email it, but now they can't email it anywhere, ever. So again, plan, understand, then execute. Copilot's just surfacing this more quickly. Other AI tools are very similar. Tangentially related, I do not believe I pointed this out, but when we're dealing with endpoint controls, Purview has a browser plug in available that we can deliver, and now we're getting back into some of the security spaces because the Intune controls will or how we manage the endpoint or maybe group policy. Whatever we're using to manage the endpoint has to enforce this installation. But that plug in looks for, specifically, use of third party AI tools so we can get alarms going off when we have employees that are using AI beyond Copilot, because it's very important, I think, that we focus our AI investment into the Copilot space because of Microsoft's active defense of our personal property. The other AI vendors have not demonstrated such integrity in this space, and we need to be very aware of that. That isn't to say that those tools are not powerful and useful. It's just to say that they're more difficult to manage because we don't have the control we do with the Microsoft solution. These are some great questions. Please keep them coming. This is really helpful and I love the trajectory of this conversation. It's been really great. Raven, would you be so kind in the interim to drop that link to the security assessment? Data security is so important knowing what you have in your environment. And this is something that is offered out free to you. So obviously you do have to qualify for it. We have all those details when you and the link to, right? So I'm not looking at the chat, but these are this is such a a cool opportunity because Microsoft, you know, is basically saying we wanna help our customers be more successful and have a more hardened security position. So if this is something of interest to you, want us to take a deeper dive into your environment and see what happens, it's free to you. And really, we get paid on our time too because Microsoft said this is something we really need to do. And so they pay us for it, which is which is fantastic. So it's a win win for everyone. But there's nothing, no obligation for you outside of just making sure that you have the time and the resources available to be able to follow-up on what we give you. What do you think about this free data security assessment, Rob? Oh, it's any any investment that can be made in understanding an environment is something that we need to undertake. That is a core function of security. Security comes from visibility and understanding. We can't invest in that enough, because I can promise you the threat actors, they will understand your environment for you in terrifying ways, and that is what we've been seeing. That's what our security and remediation teams deal with when an environment gets hit with, say, a crypto attack. These attacks go off after the threat actors performed reconnaissance. They've dedicated resources to understand the environment, where the data lives, and where they can make the most impact and maximize their capability or likelihood of being paid that ransom. Of course, data that's sitting in SharePoint's largely protected just by virtue of SharePoint being SharePoint. We have tools there. But we still have a heavy business impact. And because we don't know what we don't know, we can't act. And all of Microsoft security and compliance tools, if you really look at them from a high level, you will understand them as a flashlight. Rob, William Karl has a question for you. It says, can Copilot for m three sixty five be blocked from accessing all Outlook email but allowed to access other data? And this is a two parter, so I'm gonna go on after that. You answer that one. It's something like a toggle in an admin portal. I do not know. I'm gonna have to get back to you on the answer to that one. I know that data security posture management is going to give us that capability for SharePoint data, but I don't know if they're doing that for Outlook. Exchange as a whole is a much bigger product. I'm gonna have to look into that Does he have to apply the sensitivity data labels for all of the data that he doesn't want CoPilot to access? I think Purview does some of that, but you have to do some of it manually. True? Is that true? Yes. There's a fair bit of manual work in that space, and Purview acts based upon label assignment. So we have to assign a label. We have various tools that do automate that process, and that automation can be applied against anything in the estate, which includes emails. So if we wanted to keep Copilot away from an email, my assumption would be that we would be telling Copilot to stay away from information so labeled. You mind if I pull on that thread just a little bit? You said we have some tools for automation. Can you explain that a little bit more? That is data security posture management. That is Purview's insider risk management. These both provide information and telemetry as a feature. But the tools that the admin uses, all of these tools are located in the Purview admin panel. William, we'll follow-up with you via email to make sure that we answer your question in full, but thank you so much for asking. Anyone else have any other questions? Rob, did you have any other slides that you wanted to share? I think there was just one left. For the compliance people in the room. Yep. Purview has a collection of functionality to assist us in automating the process of creating compliance documentation. We've also got e discovery and advanced audit functionality, which is essential for attorneys and discovery processes during legal proceedings. This tool deals with all of those wonderful things that I don't ever enjoy being in this space. It's usually not a comfortable place to be. But we do have tools to assist with that, and they do also improve and enrich the telemetry that feeds into the greater Microsoft ecosystem. So if we have Purview deployed and configured and we're leveraging Microsoft Sentinel for our security purposes, if Microsoft Sentinel is preparing documentation for, say, an ISO compliance review, it can ingest that information from Purview and enrich the quality of that report that comes out. We also get some reporting tools here as well. Highly integrated solution. That sounds like it. Sounds like something that businesses are gonna need, especially those in highly regulated industries. Yes. At any time we can claw out of paperwork preparation is usually a direct return on investment. Next month, we are doing a deeper dive into Purview and the capabilities, but we're looking at it from the ShadowAI perspective. And so we're very excited to have that next month. I know we'll have an email that goes out to you about that. So just stay tuned for that. And I have one last question from William Karl. For the Purview browser extensions, where does Microsoft store that data? Can I audit everything that someone does in their browser? That's a great question. Yes, you can. But you could already do that. If you have Defender for Endpoint deployed on the Endpoint, you already have that telemetry. And that information is all in the M365 portal. It's part of the core Defender functionality. The browser plug in is capable of reading more specific things because its purpose is to review web activity of the user looking for compliance violations as opposed to a security violation, but it does have the ability to review all of the activity that a user performs while within that browser. And, yes, we have to be very careful about its deployment because there are some privacy concerns to contend with in that space in some environments. So what did you all think? Was this helpful for you? If you could rank us one through ten, ten being absolutely spectacular and one being, we could have done better. What would you rank us? And if you drop that in the chat, that would be most helpful. We really and if you have follow-up questions, feel free. Raven dropped her her email address and she'll make sure that those get routed to you. So if you have a question, I know we've got William Carl's question down, making sure that we've got that answered and we'll follow-up via email after this. And again, the deck will be available with the transcription shortly after. We just have to upload it once it comes down and we're finishing up this. But if you have anything else, we're really very excited to have you. And then next month, again, just as a reminder, we're gonna be digging into ShadowAI and how that impacts your business. So deeper dive into that, and then let us know if there's anything else that you need. We always love your feedback. So thank you so much for attending today. Rob, thank you for the excellent job of doing a review of Purview HighLevel and then digging into these fabulous questions. It's been an honor. Happy to be here. Thank everyone. We really do appreciate your time. Stay safe.
