| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| bookings | Bookings In Outlook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/bookings-in-outlook.md | Bookings in Outlook is a web-based personal scheduling page that integrates with Bookings in Outlook has two different views: -- **Organizer view** A personal booking page where you can create meeting types that others can book with you. Custom meeting types give you the ability to customize when you want to meet and how that meeting type is shared with others. You control whether each meeting type is public to your scheduling page or is private and can only be accessed by a select group of people. You can also choose to add a Teams meeting to all meetings booked through your Bookings in Outlook page. You can access your Bookings in Outlook page through Outlook on the web or by going to [https://outlook.office.com/bookwithme/](https://outlook.office.com/bookwithme/). After you set up your page and publish it, you can share it with others. For example, you can add it to your Outlook signature.+- **Organizer view** A personal booking page where you can create meeting types that others can book with you. Custom meeting types give you the ability to customize when you want to meet and how that meeting type is shared with others. You control whether each meeting type is public to your scheduling page or is private and can only be accessed by a select group of people. You can also choose to add a Teams meeting to all meetings booked through your Bookings in Outlook page. You can access your Bookings in Outlook page through Outlook on the web. After you set up your page and publish it, you can share it with others. For example, you can add it to your Outlook signature. - **Scheduling view** When you share your Bookings in Outlook page with others, they will see the scheduling view. Which meetings are shown in the scheduling view depends on if you shared the link to your Bookings in Outlook page with public meetings or you shared a private link for an individual meeting. - Public meetings can be viewed and scheduled by anyone that has your Bookings in Outlook page link. You are in control of who you share that link with. All public meeting types will be visible to anyone that has your Bookings in Outlook page link. Use the **Get-OrganizationConfig** and **Set-OrganizationConfig** commands to fi - To turn off Bookings in Outlook for your organization, remove **MicrosoftOWSPersonalBookings**, if present, from **EwsAllowList** by running the following command: ```PowerShell- Set-OrganizationConfig - EwsAllowList @{Remove="MicrosoftOWSPersonalBookings"} + Set-OrganizationConfig -EwsAllowList @{Remove="MicrosoftOWSPersonalBookings"} ``` - To turn on Bookings in Outlook for your organization, add **MicrosoftOWSPersonalBookings** to **EwsAllowList** by running the following command: ```PowerShell- Set-OrganizationConfig - EwsAllowList @{Add="MicrosoftOWSPersonalBookings"} + Set-OrganizationConfig -EwsAllowList @{Add="MicrosoftOWSPersonalBookings"} ``` **B**. If the value of **EwsApplicationAccessPolicy** is **EnforceBlockList**, all applications are allowed to access EWS and REST, except those specified in **EwsBlockList**. Use the **Get-CASMailbox** and **Set-CASMailbox** commands to check user status - To turn off Bookings in Outlook for this user, remove **MicrosoftOWSPersonalBookings**, if present from **EwsAllowList** by running the following command: ```PowerShell- Set-CASMailbox -Identity adam@contoso.com - EwsAllowList @{Remove="MicrosoftOWSPersonalBookings"} + Set-CASMailbox -Identity adam@contoso.com -EwsAllowList @{Remove="MicrosoftOWSPersonalBookings"} ``` - Turn on Bookings in Outlook for this user, add **MicrosoftOWSPersonalBookings** to **EwsAllowList** by running the following command: ```PowerShell- Set-CASMailbox -Identity adam@contoso.com - EwsAllowList @{Add="MicrosoftOWSPersonalBookings"} + Set-CASMailbox -Identity adam@contoso.com -EwsAllowList @{Add="MicrosoftOWSPersonalBookings"} ``` **B**. If the value of **EwsApplicationAccessPolicy** is **EnforceBlockList**, all applications are allowed to access EWS and REST, except those specified in **EwsBlockList**. |
| compliance | Customer Key Set Up | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-key-set-up.md | The temporary or permanent loss of root encryption keys can be disruptive or eve - For enabling Customer Key for assigning DEP to individual Exchange Online mailboxes, contact [exock@microsoft.com](mailto:exock@microsoft.com). - - For enabling Customer Key for assigning DEPs to encrypt content across multiple Microsoft 365 workloads (Exchange Online, Teams, Microsoft Purview Information Protection) for all tenant users, contact [m365-ck@service.microsoft.com](mailto:m365-ck@service.microsoft.com). +- For enabling Customer Key for assigning DEPs to encrypt SharePoint Online and OneDrive for Business content (including Teams files) for all tenant users, contact [spock@microsoft.com](mailto:spock@microsoft.com). - For enabling Customer Key for assigning DEPs to encrypt content across multiple Microsoft 365 workloads (Exchange Online, Teams, Microsoft Purview Information Protection) for all tenant users, contact [m365-ck@service.microsoft.com](mailto:m365-ck@service.microsoft.com). |
| compliance | Delete An Inactive Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/delete-an-inactive-mailbox.md | Set-Mailbox <identity of inactive mailbox> -ExcludeFromAllOrgHolds Run the following command in [Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) to remove an inactive mailbox from an explicit retention policy. ```powershell-Set-RetentionCompliancePolicy -Identity <retention policy GUID without prefix or suffix> -AddExchangeLocationException <identity of inactive mailbox> +Set-RetentionCompliancePolicy -Identity <retention policy GUID without prefix or suffix> -RemoveExchangeLocation <identity of inactive mailbox> ``` For more information identifying specific location retention policies applied to an inactive mailbox and obtaining the GUID for a retention policy, see the "Get-Mailbox" section in [How to identify the type of hold placed on a mailbox](identify-a-hold-on-an-exchange-online-mailbox.md#get-mailbox). |
| compliance | Information Barriers Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers-policies.md | -With Microsoft Purview Information Barriers, you can define policies that are designed to prevent certain segments of users from communicating with each other or allow specific segments to communicate only with certain other segments. Information barrier policies can help your organization maintain compliance with relevant industry standards and regulations, and avoid potential conflicts of interest. For more information, see [Learn about information barriers](information-barriers.md). +This article describes how to configure information barrier (IB) policies in your organization. Several steps are involved, so make sure you review the entire process before you begin configuring IB policies. -This article describes how to configure information barrier policies. Several steps are involved, so make sure you review entire process before you begin configuring information barrier policies. +You must be familiar with [PowerShell cmdlets](/powershell/exchange/scc-powershell) in order to define, validate, or edit IB policies. Although we provide several examples of PowerShell cmdlets in this article, you'll need to know other details (such as parameter values) for your organization. ++For more information about IB scenarios and features, see [Learn about information barriers](information-barriers.md). > [!TIP]-> This article includes an [example scenario](#example-scenario-contosos-departments-segments-and-policies) to help you plan and define your information barrier policies. +> To help you prepare your plan, an [example scenario](#example-scenario-contosos-departments-segments-and-policies) is included in this article. ++## Required subscriptions and permissions ++Before you get started with IB, you should confirm your Microsoft 365 subscription and any add-ons. To access and use IB, your organization must have one of the following subscriptions or add-ons: ++- Microsoft 365 E5/A5 subscription (paid or trial version) +- Office 365 E5/A5/A3/A1 subscription (paid or trial version) +- Office 365 Advanced Compliance add-on (no longer available for new subscriptions) +- Microsoft 365 E3/A3/A1 subscription + the Microsoft 365 E5/A5 Compliance add-on +- Microsoft 365 E3/A3/A1 subscription + the Microsoft 365 E5/A5 Insider Risk Management add-on ++For more information, see [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#information-protection). -## Concepts +To [manage IB policies](information-barriers-policies.md), you must be assigned one of the following roles: -When you define policies for information barriers, you'll work with user account attributes, segments, 'block' and/or 'allow' policies, and policy application. +- Microsoft 365 global administrator +- Office 365 global administrator +- Compliance administrator +- IB Compliance Management -- User account attributes are defined in Azure Active Directory (or Exchange Online). These attributes can include department, job title, location, team name, and other job profile details.-- Segments are sets of users that are defined in the Microsoft Purview compliance portal using a selected **user account attribute**. (See the [list of supported attributes](information-barriers-attributes.md).)-- Information barrier policies determine communication limits or restrictions. When you define information barrier policies, you choose from two kinds of policies:+To learn more about roles and permissions, see [Permissions in the Office 365 Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md). ++## Configuration concepts ++When you define policies for IB, you'll work with several objects and concepts. ++- **User account attributes** are defined in Azure Active Directory (or Exchange Online). These attributes can include department, job title, location, team name, and other job profile details. +- **Segments** are sets of users that are defined in the Microsoft Purview compliance portal using a selected **user account attribute**. See the list of [IB supported attributes](information-barriers-attributes.md) for details. +- **Visibility of non-IB users and groups**. Non-IB users and groups are users and groups excluded from IB segments and policies. Depending on the type of IB policies (block or allow), the behavior for these users and group will differ in Microsoft Teams, SharePoint, OneDrive, and in your global address list. For users defined in *allow* policies, non-IB groups and users won't be visible to users included in IB segments and policies. For users defined in *block* policies, non-IB groups and users will be visible to users included in IB segments and policies. +- **Group support**. Only Modern Groups are currently supported in IB and Distribution Lists/Security Groups are treated as non-IB groups. +- **Hidden/disabled user accounts**. For hidden/disabled accounts in your organization, the *HiddenFromAddressListEnabled* parameter is automatically set to *True* when the users accounts are hidden or disabled. In IB-enabled organizations, these accounts are prevented from communicating with all other user accounts. In Microsoft Teams, all chats including these accounts are locked or the users are automatically removed from conversations. +- **IB policies** determine communication limits or restrictions. When you define information barrier policies, you choose from two kinds of policies: - *Block* policies prevent one segment from communicating with another segment. - *Allow* policies allow one segment to communicate with only certain other segments.-- Policy application is done after all information barrier policies are defined, and you are ready to apply them in your organization.++ > [!NOTE] + > For **allow** policies, non-IB groups and users will not be visible to users included in IB segments and policies. If you need non-IB groups and users to be visible to users included in IB segments and policies, you must use **block** policies. ++- *Policy application* is done after all IB policies are defined, and you're ready to apply them in your organization. ## Configuration at a glance | **Steps** | **What's involved** | |:|:-|-| **Step 1**: [Make sure prerequisites are met](#step-1-make-sure-prerequisites-are-met) | - Verify that you have the [required licenses and permissions](information-barriers.md#required-licenses-and-permissions)<br/>- Verify that your directory includes data for segmenting users<br/>- Enable [search by name for Microsoft Teams](/microsoftteams/teams-scoped-directory-search)<br/>- Make sure audit logging is turned on<br/>- Make sure no Exchange address book policies are in place<br/>- Use PowerShell (examples are provided)<br/>- Provide admin consent for Microsoft Teams (steps are included) | +| **Step 1**: [Make sure prerequisites are met](#step-1-make-sure-prerequisites-are-met) | - Verify that you have the required subscriptions and permissions <br/>- Verify that your directory includes data for segmenting users<br/>- Enable [search by name for Microsoft Teams](/microsoftteams/teams-scoped-directory-search)<br/>- Make sure audit logging is turned on<br/>- Make sure no Exchange address book policies are in place<br/>- Use PowerShell (examples are provided)<br/>- Provide admin consent for Microsoft Teams (steps are included) | | **Step 2**: [Segment users in your organization](#step-2-segment-users-in-your-organization) | - Determine what policies are needed<br/>- Make a list of segments to define<br/>- Identify which attributes to use<br/>- Define segments in terms of policy filters |-| **Step 3**: [Define information barrier policies](#step-3-define-information-barrier-policies) | - Define your policies (do not apply yet)<br/>- Choose from two kinds (block or allow) | +| **Step 3**: [Define information barrier policies](#step-3-define-information-barrier-policies) | - Define your policies (don't apply yet)<br/>- Choose from two kinds (block or allow) | | **Step 4**: [Apply information barrier policies](#step-4-apply-information-barrier-policies) | - Set policies to active status<br/>- Run the policy application<br/>- View policy status |-| **Step 5**: [Configuration for information barriers on SharePoint and OneDrive (optional)](#step-5-configuration-for-information-barriers-on-sharepoint-and-onedrive) | - Configure information barriers for SharePoint and OneDrive | -| **Step 6**: [Information barriers modes (optional)](#step-6-information-barriers-modes) | - Update information barrier modes if applicable | +| **Step 5**: [Configuration for information barriers on SharePoint and OneDrive (optional)](#step-5-configuration-for-information-barriers-on-sharepoint-and-onedrive) | - Configure IB for SharePoint and OneDrive | +| **Step 6**: [Information barriers modes (optional)](#step-6-information-barriers-modes) | - Update IB modes if applicable | ## Step 1: Make sure prerequisites are met -In addition to the [required licenses and permissions](information-barriers.md#required-licenses-and-permissions), make sure that the following requirements are met before configuring information barriers: +In addition to the required subscriptions and permissions, make sure that the following requirements are met before configuring IB: -- **Directory data**: Make sure that your organization's structure is reflected in directory data. To take this action, make sure that user account attributes, such as group membership, department name, etc. are populated correctly in Azure Active Directory (or Exchange Online). To learn more, see the following resources:+- **Directory data**: Make sure that your organization's structure is reflected in directory data. To take this action, make sure that user account attributes (such as group membership, department name, etc.) are populated correctly in Azure Active Directory (or Exchange Online). To learn more, see the following resources: - [Attributes for information barrier policies](information-barriers-attributes.md) - [Add or update a user's profile information using Azure Active Directory](/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal) - [Configure user account properties with Office 365 PowerShell](../enterprise/configure-user-account-properties-with-microsoft-365-powershell.md) -- **Scoped directory search**: Before you define your organization's first information barrier policy, you must [enable scoped directory search in Microsoft Teams](/MicrosoftTeams/teams-scoped-directory-search). Wait at least 24 hours after enabling scoped directory search before you set up or define information barrier policies.+- **Scoped directory search**: Before you define your organization's first IB policy, you must [enable scoped directory search in Microsoft Teams](/MicrosoftTeams/teams-scoped-directory-search). Wait at least 24 hours after enabling scoped directory search before you set up or define IB policies. -- **Exchange Online licenses**: Information barriers policies work only if the target users have been assigned an Exchange Online license.+- **Verify audit logging is enabled**: In order to look up the status of an IB policy application, audit logging must be turned on. Auditing is enabled for Microsoft 365 organizations by default. Some organizations may have disabled auditing for specific reasons. If auditing is disabled for your organization, it might be because another administrator has turned it off. We recommend confirming that it's OK to turn auditing back on when completing this step. For more information, see [Turn the audit log search on or off](turn-audit-log-search-on-or-off.md). -- **Verify audit logging is enabled**: In order to look up the status of a policy application, audit logging must be turned on. Auditing is enabled for Microsoft 365 organizations by default. Some organizations may have disabled auditing for specific reasons. If auditing is disabled for your organization, it might be because another administrator has turned it off. We recommend confirming that it's OK to turn auditing back on when completing this step. For more information, see [Turn the audit log search on or off](turn-audit-log-search-on-or-off.md).+- **Remove existing Exchange Online address book policies**: Before you define and apply IB policies, you must remove all existing Exchange Online address book policies in your organization. IB policies are based on address book policies and existing ABPs policies aren't compatible with the ABPs created by IB. To remove your existing address book policies, see [Remove an address book policy in Exchange Online](/exchange/address-books/address-book-policies/remove-an-address-book-policy). For more information about IB policies and Exchange Online, see [Information barriers and Exchange Online](information-barriers.md#information-barriers-and-exchange-online). -- **No address book policies**: Before you define and apply information barrier policies, make sure no Exchange address book policies are in place. Information barriers are based on address book policies, but the two kinds of policies are not compatible. If you do have such policies, make sure to [remove your address book policies](/exchange/address-books/address-book-policies/remove-an-address-book-policy) first. Once information barrier policies are enabled and you have hierarchical address book enabled, all users ***who are not included*** in an information barrier segment will see the [hierarchical address book](/exchange/address-books/hierarchical-address-books/hierarchical-address-books) in Exchange online.--- **Manage using PowerShell**: Currently, information barrier policies are defined and managed in Security & Compliance Center PowerShell. Although several examples are provided in this article, you'll need to be familiar with PowerShell cmdlets and parameters. You will also need the Azure Active Directory PowerShell module.+- **Manage using PowerShell**: Currently, IB policies are defined and managed in Security & Compliance Center PowerShell. Although several examples are provided in this article, you'll need to be familiar with PowerShell cmdlets and parameters. You'll also need the Azure Active Directory PowerShell module. - [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) - [Install Azure Active Directory PowerShell for Graph](/powershell/azure/active-directory/install-adv2) -- **Admin consent for information barriers in Microsoft Teams**: When your IB policies are in place, they can remove non-IB compliance users from Groups (i.e. Teams channels, which are based on groups). This configuration helps ensure your organization remains compliant with policies and regulations. Use the following procedure to enable information barrier policies to work as expected in Microsoft Teams.+- **Admin consent for IB in Microsoft Teams**: When your IB policies are in place, they can remove non-IB compliance users from Groups (for example, Teams channels, which are based on groups). This configuration helps ensure your organization remains compliant with policies and regulations. Use the following procedure to enable IB policies to work as expected in Microsoft Teams. 1. Prerequisite: [Install Azure Active Directory PowerShell for Graph](/powershell/azure/active-directory/install-adv2). In addition to the [required licenses and permissions](information-barriers.md#r When all the prerequisites are met, proceed to the next step. -> [!TIP] -> To help you prepare your plan, an example scenario is included in this article. [See Contoso's departments, segments, and policies](#example-scenario-contosos-departments-segments-and-policies). - ## Step 2: Segment users in your organization -During this step, you determine what information barrier policies are needed, make a list of segments to define, and then define your segments. +During this step, you determine what IB policies are needed, make a list of segments to define, and then define your segments. ### Determine what policies are needed -Considering legal and industry regulations, who are the groups within your organization who will need information barrier policies? Make a list. Are there any groups who should be prevented from communicating with another group? Are there any groups that should be allowed to communicate only with one or two other groups? Think about the policies you need as belonging to one of two groups: +Considering the needs of your organization, determine the groups within your organization who will need IB policies. Ask yourself the following questions: ++- Are there internal, legal, or industry regulations that require the restriction of communication and collaboration between groups and users in your organization? +- Are there any groups or users who should be prevented from communicating with another group of users? +- Are there any groups or users that should be allowed to communicate only with one or two other groups of users? ++Think about the policies you need as belonging to one of two types: -- "Block" policies prevent one group from communicating with another group.-- "Allow" policies allow a group to communicate with only certain other, specific groups.+- *Block* policies prevent one group from communicating with another group. +- *Allow* policies allow a group to communicate with only specific groups. -When you have your initial list of groups and policies, proceed to identify the segments you'll need. +When you have your initial list of needed groups and policies, proceed to identify the segments you'll need for the IB policies. ### Identify segments -In addition to your initial list of policies, make a list of segments for your organization. Users who will be included in information barrier policies should belong to a segment. Plan your segments carefully as a user can only be in one segment. Each segment can have only one information barrier policy applied. +In addition to your initial list of policies, make a list of segments for your organization. Users who will be included in IB policies should belong to a segment. Plan your segments carefully as a user can only be in one segment. Each segment can have only one IB policy applied. > [!IMPORTANT] > A user can only be in one segment. -Determine which attributes in your organization's directory data you'll use to define segments. You can use *Department*, *MemberOf*, or any of the supported attributes. Make sure that you have values in the attribute you select for users. [See the list of supported attributes for information barriers](information-barriers-attributes.md). +Determine which attributes in your organization's directory data you'll use to define segments. You can use *Department*, *MemberOf*, or any of the supported IB attributes. Make sure that you have values in the attribute you select for users. For more information, see the [supported attributes for IB](information-barriers-attributes.md). > [!IMPORTANT]-> **Before you proceed to the next section, make sure your directory data has values for attributes that you can use to define segments**. If your directory data does not have values for the attributes you want to use, then the user accounts must be updated to include that information before you proceed with information barriers. To get help with this, see the following resources:<br/>- [Configure user account properties with Office 365 PowerShell](../enterprise/configure-user-account-properties-with-microsoft-365-powershell.md)<br/>- [Add or update a user's profile information using Azure Active Directory](/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal) +> **Before you proceed to the next section, make sure your directory data has values for attributes that you can use to define segments**. If your directory data does not have values for the attributes you want to use, then the user accounts must be updated to include that information before you proceed with configuring IB. To get help with this, see the following resources:<br/>- [Configure user account properties with Office 365 PowerShell](../enterprise/configure-user-account-properties-with-microsoft-365-powershell.md)<br/>- [Add or update a user's profile information using Azure Active Directory](/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal) ### Define segments using PowerShell -Defining segments does not affect users; it just sets the stage for information barrier policies to be defined and then applied. +The next task is to define segments for your organization. Defining segments doesn't affect users, it just sets the stage for IB policies to be defined and then applied. 1. Use the **New-OrganizationSegment** cmdlet with the **UserGroupFilter** parameter that corresponds to the [attribute](information-barriers-attributes.md) you want to use. Defining segments does not affect users; it just sets the stage for information 2. Repeat this process for each segment you want to define. > [!IMPORTANT]- > **Make sure that your segments do not overlap**. Each user who will be affected by information barriers should belong to one (and only one) segment. No user should belong to two or more segments. (See [Example: Contoso's defined segments](#contosos-defined-segments) in this article.) + > **Make sure that your segments do not overlap**. Each user who will be affected by IB policies should belong to one (and only one) segment. No user should belong to two or more segments. See [Example: Contoso's defined segments](#contosos-defined-segments) in this article for an example scenario. -After you have defined your segments, proceed to [define information barrier policies](#step-3-define-information-barrier-policies). +After you've defined your segments, proceed to [Step 3: Define information barrier policies](#step-3-define-information-barrier-policies). ### Using "equals" and "not equals" in segment definitions -In the following example, we are defining a segment such that "Department equals HR." +In the following example, we're defining a segment such that "Department equals HR." | Example | Note | |:-|:-| You can also define segments using a "not equals" parameter, denoted as **-ne**, | Syntax | Example | |:|:-|-| `New-OrganizationSegment -Name "NotSales" -UserGroupFilter "Department -ne 'Sales'"` | In this example, we defined a segment called *NotSales* that includes everyone who is not in *Sales*. The **-ne** portion of the cmdlet refers to "not equals". | +| `New-OrganizationSegment -Name "NotSales" -UserGroupFilter "Department -ne 'Sales'"` | In this example, we defined a segment called *NotSales* that includes everyone who isn't in *Sales*. The **-ne** portion of the cmdlet refers to "not equals". | In addition to defining segments using "equals" or "not equals", you can define a segment using both "equals" and "not equals" parameters. You can also define complex group filters using logical *AND* and *OR* operators. | Syntax | Example | |:|:-|-| `New-OrganizationSegment -Name "LocalFTE" -UserGroupFilter "Location -eq 'Local'" -and "Position -ne 'Temporary'"` | In this example, we defined a segment called *LocalFTE* that includes people who are located locally and whose positions are not listed as *Temporary*. | -| `New-OrganizationSegment -Name "Segment1" -UserGroupFilter "MemberOf -eq 'group1@contoso.com'' -and MemberOf -ne 'group3@contoso.com'"`| In this example, we defined a segment called *Segment1* that includes people who are members of group1@contoso.com and not members of group3@contoso.com. | -| `New-OrganizationSegment -Name "Segment2" -UserGroupFilter "MemberOf -eq 'group2@contoso.com' -or MemberOf -ne 'group3@contoso.com'"` | In this example, we defined a segment called *Segment2* that includes people who are members of group2@contoso.com and not members of group3@contoso.com. | -| `New-OrganizationSegment -Name "Segment1and2" -UserGroupFilter "(MemberOf -eq 'group1@contoso.com' -or MemberOf -eq 'group2@contoso.com') -and MemberOf -ne 'group3@contoso.com'"`| In this example, we defined a segment called *Segment1and2* that includes people members of group1@contoso.com and group2@contoso.com and not members of group3@contoso.com. | +| `New-OrganizationSegment -Name "LocalFTE" -UserGroupFilter "Location -eq 'Local'" -and "Position -ne 'Temporary'"` | In this example, we defined a segment called *LocalFTE* that includes users who are located locally and whose positions aren't listed as *Temporary*. | +| `New-OrganizationSegment -Name "Segment1" -UserGroupFilter "MemberOf -eq 'group1@contoso.com'' -and MemberOf -ne 'group3@contoso.com'"`| In this example, we defined a segment called *Segment1* that includes users who are members of group1@contoso.com and not members of group3@contoso.com. | +| `New-OrganizationSegment -Name "Segment2" -UserGroupFilter "MemberOf -eq 'group2@contoso.com' -or MemberOf -ne 'group3@contoso.com'"` | In this example, we defined a segment called *Segment2* that includes users who are members of group2@contoso.com and not members of group3@contoso.com. | +| `New-OrganizationSegment -Name "Segment1and2" -UserGroupFilter "(MemberOf -eq 'group1@contoso.com' -or MemberOf -eq 'group2@contoso.com') -and MemberOf -ne 'group3@contoso.com'"`| In this example, we defined a segment called *Segment1and2* that includes users in group1@contoso.com and group2@contoso.com and not members of group3@contoso.com. | > [!TIP] > If possible, use segment definitions that include "-eq" or "-ne". Try not to define complex segment definitions. ## Step 3: Define information barrier policies -Determine whether you need to prevent communications between certain segments, or limit communications to certain segments. Ideally, you'll use the minimum number of policies to ensure your organization is compliant with legal and industry requirements. +Determine whether you need to prevent communications between certain segments or limit communications to certain segments. Ideally, you'll use the minimum number of IB policies to ensure your organization is compliant with internal, legal, and industry requirements. -With your list of user segments and the information barrier policies you want to define, select a scenario, and then follow the steps. +> [!TIP] +> For user experience consistency, we recommend using Block policies for most scenarios if possible. ++With your list of user segments and the IB policies you want to define, select a scenario, and then follow the steps. - [Scenario 1: Block communications between segments](#scenario-1-block-communications-between-segments) - [Scenario 2: Allow a segment to communicate only with one other segment](#scenario-2-allow-a-segment-to-communicate-only-with-one-other-segment) > [!IMPORTANT]-> **Make sure that as you define policies, you do not assign more than one policy to a segment**. For example, if you define one policy for a segment called *Sales*, do not define an additional policy for *Sales*.<p> In addition, as you define information barrier policies, make sure to set those policies to inactive status until you are ready to apply them. Defining (or editing) policies does not affect users until those policies are set to active status and then applied. --(See [Example: Contoso's information barrier policies](#contosos-information-barrier-policies) in this article.) +> **Make sure that as you define policies, you do not assign more than one policy to a segment**. For example, if you define one policy for a segment called *Sales*, do not define an additional policy for *Sales*.<p> In addition, as you define IB policies, make sure to set those policies to inactive status until you are ready to apply them. Defining (or editing) policies does not affect users until those policies are set to active status and then applied. ### Scenario 1: Block communications between segments -When you want to block segments from communicating with each other, you define two policies: one for each direction. Each policy blocks communication one way only. +When you want to block segments from communicating with each other, you define two policies: one for each direction. Each policy blocks communication in one direction only. For example, suppose you want to block communications between Segment A and Segment B. In this case, you define one policy preventing Segment A from communicating with Segment B, and then define a second policy to prevent Segment B from communicating with Segment A. For example, suppose you want to block communications between Segment A and Segm | Syntax | Example | |:--|:-|- | `New-InformationBarrierPolicy -Name "policyname" -AssignedSegment "segment1name" -SegmentsBlocked "segment2name"` | `New-InformationBarrierPolicy -Name "Sales-Research" -AssignedSegment "Sales" -SegmentsBlocked "Research" -State Inactive` <p> In this example, we defined a policy called *Sales-Research* for a segment called *Sales*. When active and applied, this policy prevents people in *Sales* from communicating with people in a segment called *Research*. | + | `New-InformationBarrierPolicy -Name "policyname" -AssignedSegment "segment1name" -SegmentsBlocked "segment2name"` | `New-InformationBarrierPolicy -Name "Sales-Research" -AssignedSegment "Sales" -SegmentsBlocked "Research" -State Inactive` <p> In this example, we defined a policy called *Sales-Research* for a segment called *Sales*. When active and applied, this policy prevents users in *Sales* from communicating with users in a segment called *Research*. | 2. To define your second blocking segment, use the **New-InformationBarrierPolicy** cmdlet with the **SegmentsBlocked** parameter again, this time with the segments reversed. For example, suppose you want to block communications between Segment A and Segm ### Scenario 2: Allow a segment to communicate only with one other segment +When you want to allow a segment to communicate with only one other segment, you define only one policy for that segment. The segment that is being communicated with doesn't require a similar directional policy (because they can communicate and collaborate with everyone by default). + 1. To allow one segment to communicate with only one other segment, use the **New-InformationBarrierPolicy** cmdlet with the **SegmentsAllowed** parameter. | Syntax | Example | |:-|:-|- | `New-InformationBarrierPolicy -Name "policyname" -AssignedSegment "segment1name" -SegmentsAllowed "segment2name","segment1name"` | `New-InformationBarrierPolicy -Name "Manufacturing-HR" -AssignedSegment "Manufacturing" -SegmentsAllowed "HR","Manufacturing" -State Inactive` <p> In this example, we defined a policy called *Manufacturing-HR* for a segment called *Manufacturing*. When active and applied, this policy allows people in *Manufacturing* to communicate only with people in a segment called *HR*. (In this case, *Manufacturing* cannot communicate with users who are not part of *HR*.) | + | `New-InformationBarrierPolicy -Name "policyname" -AssignedSegment "segment1name" -SegmentsAllowed "segment2name","segment1name"` | `New-InformationBarrierPolicy -Name "Manufacturing-HR" -AssignedSegment "Manufacturing" -SegmentsAllowed "HR","Manufacturing" -State Inactive` <p> In this example, we defined a policy called *Manufacturing-HR* for a segment called *Manufacturing*. When active and applied, this policy allows users in *Manufacturing* to communicate only with users in a segment called *HR*. In this case, *Manufacturing* can't communicate with users who aren't part of *HR*. | **If needed, you can specify multiple segments with this cmdlet, as shown in the following example.** For example, suppose you want to block communications between Segment A and Segm ## Step 4: Apply information barrier policies -Information barrier policies are not in effect until you set them to active status, and then apply the policies. +IB policies aren't in effect until you set them to active status and apply the policies. 1. Use the **Get-InformationBarrierPolicy** cmdlet to see a list of policies that have been defined. Note the status and identity (GUID) of each policy. Information barrier policies are not in effect until you set them to active stat | Syntax | Example | |:|:-|- | `Set-InformationBarrierPolicy -Identity GUID -State Active` | `Set-InformationBarrierPolicy -Identity 43c37853-ea10-4b90-a23d-ab8c93772471 -State Active` <p> In this example, we set an information barrier policy that has the GUID *43c37853-ea10-4b90-a23d-ab8c93772471* to active status. | + | `Set-InformationBarrierPolicy -Identity GUID -State Active` | `Set-InformationBarrierPolicy -Identity 43c37853-ea10-4b90-a23d-ab8c93772471 -State Active` <p> In this example, we set an IB policy that has the GUID *43c37853-ea10-4b90-a23d-ab8c93772471* to active status. | Repeat this step as appropriate for each policy. -3. When you have finished setting your information barrier policies to active status, use the **Start-InformationBarrierPoliciesApplication** cmdlet in the Security & Compliance Center. +3. When you have finished setting your IB policies to active status, use the **Start-InformationBarrierPoliciesApplication** cmdlet in Security & Compliance Center PowerShell. Syntax: `Start-InformationBarrierPoliciesApplication` With PowerShell, you can view status of user accounts, segments, policies, and p ### What if I need to remove or change policies? -Resources are available to help you manage your information barrier policies. +Resources are available to help you manage your IB policies. -- If something goes wrong with information barriers, see [Troubleshooting information barriers](/office365/troubleshoot/information-barriers/information-barriers-troubleshooting).-- To stop policies from being applied, see [Stop a policy application](information-barriers-edit-segments-policies.md#stop-a-policy-application).-- To remove an information barrier policy, see [Remove a policy](information-barriers-edit-segments-policies.md#remove-a-policy).-- To make changes to segments or policies, see [Edit (or remove) information barrier policies](information-barriers-edit-segments-policies.md).+- To edit, stop, or remove IB policies, see [Manage information barriers policies](information-barriers-edit-segments-policies.md). +- If something goes wrong with IB, see [Troubleshooting information barriers](/office365/troubleshoot/information-barriers/information-barriers-troubleshooting). ## Step 5: Configuration for information barriers on SharePoint and OneDrive -If you're configuring information barriers for SharePoint and OneDrive, you'll need to enable information barriers on these services. You'll also need to enable information barriers on these services if you're configuring information barriers for Microsoft Teams. When a Microsoft Teams team is created, a SharePoint site is automatically created and associated with Microsoft Teams for the files experience. Information barrier policies aren't honored on this SharePoint site and files by default. +If you're configuring IB for SharePoint and OneDrive, you'll need to enable IB on these services. You'll also need to enable IB on these services if you're configuring IB for Microsoft Teams. When a team is created in Microsoft Teams team, a SharePoint site is automatically created and associated with Microsoft Teams for the files experience. IB policies aren't honored on this new SharePoint site and files by default. -To enable information barriers in SharePoint and OneDrive, follow the guidance and steps in the [Use information barriers with SharePoint](/sharepoint/information-barriers) article. +To enable IB in SharePoint and OneDrive, follow the guidance and steps in the [Use information barriers with SharePoint](/sharepoint/information-barriers) article. ## Step 6: Information barriers modes The following IB modes are supported on Microsoft 365 resources: | **Mode** | **Description** | **Example** | |:--|:|:--| | **Open** | There aren't any IB policies or segments associated with the Microsoft 365 resource. Anyone can be invited to be a member of the resource. | A team site created for picnic event for your organization. |-| **Owner Moderated (preview)** | The IB policy of the Microsoft 365 resource is determined from the resource owner's IB policy. The resource owners can invite any user to the resource based on their IB policies. This mode is useful when your company wants to allow collaboration among incompatible segment users that are moderated by the owner. Only the resource owner can add new members per their IB policy. | The VP of HR wants to collaborate with the VPs of Sales and Research. A new SharePoint site that is set with IB mode *Owner Moderated* to add both Sales and Research segment users to the same site. It is the responsibility of the owner to ensure appropriate members are added to the resource. | -| **Implicit** | The IB policy or segments of the Microsoft 365 resource is inherited from the resource members IB policy. The owner can add members as long as they are compatible with the existing members of the resource. This is the default IB mode for Microsoft Teams. | The Sales segment user creates a Microsoft Teams team to collaborate with other compatible segments in the organization. | +| **Owner Moderated (preview)** | The IB policy of the Microsoft 365 resource is determined from the resource owner's IB policy. The resource owners can invite any user to the resource based on their IB policies. This mode is useful when your company wants to allow collaboration among incompatible segment users that are moderated by the owner. Only the resource owner can add new members per their IB policy. | The VP of HR wants to collaborate with the VPs of Sales and Research. A new SharePoint site that is set with IB mode *Owner Moderated* to add both Sales and Research segment users to the same site. It's the responsibility of the owner to ensure appropriate members are added to the resource. | +| **Implicit** | The IB policy or segments of the Microsoft 365 resource is inherited from the resource members IB policy. The owner can add members as long as they're compatible with the existing members of the resource. This is the default IB mode for Microsoft Teams. | The Sales segment user creates a Microsoft Teams team to collaborate with other compatible segments in the organization. | | **Explicit** | The IB policy of the Microsoft 365 resource is per the segments associated with the resource. The resource owner or SharePoint administrator has the ability to manage the segments on the resource. | A site created only for Sales segment members to collaborate by associating the Sales segment with the site. | -For more information about information barrier modes and how they are configured across services, see the following articles: +For more information about IB modes and how they're configured across services, see the following articles: - [Information barriers modes and Microsoft Teams](/microsoftteams/information-barriers-in-teams) - [Information barriers modes and OneDrive](/onedrive/information-barriers) To see how an organization might approach defining segments and policies, consid ### Contoso's departments and plan -Contoso has five departments: HR, Sales, Marketing, Research, and Manufacturing. In order to remain compliant with industry regulations, people in some departments are not supposed to communicate with other departments, as listed in the following table: +Contoso has five departments: *HR*, *Sales*, *Marketing*, *Research*, and *Manufacturing*. In order to remain compliant with industry regulations, users in some departments aren't supposed to communicate with other departments, as listed in the following table: -| Segment | Can talk to | Cannot talk to | +| Segment | Can communicate with | Can't communicate with | |:-|:--|:--| | HR | Everyone | (no restrictions) | | Sales | HR, Marketing, Manufacturing | Research | Contoso has five departments: HR, Sales, Marketing, Research, and Manufacturing. | Research | HR, Marketing, Manufacturing | Sales | | Manufacturing | HR, Marketing | Anyone other than HR or Marketing | -For this structure, Contoso's plan includes three information barrier policies: --1. A policy designed to prevent Sales from communicating with Research (and another policy to prevent Research from communicating with Sales). +For this structure, Contoso's plan includes three IB policies: -2. A policy designed to allow Manufacturing to communicate with HR and Marketing only. +1. An IB policy designed to prevent Sales from communicating with Research +2. Another IB policy to prevent Research from communicating with Sales. +3. An IB policy designed to allow Manufacturing to communicate with HR and Marketing only. -For this scenario, it's not necessary to define policies for HR or Marketing. +For this scenario, it's not necessary to define IB policies for *HR* or *Marketing*. ### Contoso's defined segments Contoso will use the Department attribute in Azure Active Directory to define se | Research | `New-OrganizationSegment -Name "Research" -UserGroupFilter "Department -eq 'Research'"` | | Manufacturing | `New-OrganizationSegment -Name "Manufacturing" -UserGroupFilter "Department -eq 'Manufacturing'"` | -With the segments defined, Contoso proceeds to define policies. +With the segments defined, Contoso proceeds to define the IB policies. ### Contoso's information barrier policies -Contoso defines three policies, as described in the following table: +Contoso defines three IB policies, as described in the following table: | Policy | Policy Definition | |:|:--| | **Policy 1: Prevent Sales from communicating with Research** | `New-InformationBarrierPolicy -Name "Sales-Research" -AssignedSegment "Sales" -SegmentsBlocked "Research" -State Inactive` <p> In this example, the information barrier policy is called *Sales-Research*. When this policy is active and applied, it will help prevent users who are in the Sales segment from communicating with users in the Research segment. This policy is a one-way policy; it won't prevent Research from communicating with Sales. For that, Policy 2 is needed. | | **Policy 2: Prevent Research from communicating with Sales** | `New-InformationBarrierPolicy -Name "Research-Sales" -AssignedSegment "Research" -SegmentsBlocked "Sales" -State Inactive` <p> In this example, the information barrier policy is called *Research-Sales*. When this policy is active and applied, it will help prevent users who are in the Research segment from communicating with users in the Sales segment. |-| **Policy 3: Allow Manufacturing to communicate with HR and Marketing only** | `New-InformationBarrierPolicy -Name "Manufacturing-HRMarketing" -AssignedSegment "Manufacturing" -SegmentsAllowed "HR","Marketing","Manufacturing" -State Inactive` <p> In this case, the information barrier policy is called *Manufacturing-HRMarketing*. When this policy is active and applied, Manufacturing can communicate only with HR and Marketing. HR and Marketing are not restricted from communicating with other segments. | +| **Policy 3: Allow Manufacturing to communicate with HR and Marketing only** | `New-InformationBarrierPolicy -Name "Manufacturing-HRMarketing" -AssignedSegment "Manufacturing" -SegmentsAllowed "HR","Marketing","Manufacturing" -State Inactive` <p> In this case, the IB policy is called *Manufacturing-HRMarketing*. When this policy is active and applied, Manufacturing can communicate only with HR and Marketing. HR and Marketing aren't restricted from communicating with other segments. | With segments and policies defined, Contoso applies the policies by running the **Start-InformationBarrierPoliciesApplication** cmdlet. -When the cmdlet finishes, Contoso is compliant with legal and industry requirements. +When the cmdlet finishes, Contoso is compliant with industry requirements. ## Resources -- [Get an overview of information barriers](information-barriers.md)+- [Learn about information barriers](information-barriers.md) - [Learn more about information barriers in Microsoft Teams](/MicrosoftTeams/information-barriers-in-teams) - [Learn more about information barriers in SharePoint Online](/sharepoint/information-barriers) - [Learn more about information barriers in OneDrive](/onedrive/information-barriers) |
| compliance | Information Barriers | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers.md | -Microsoft cloud services include powerful communication and collaboration capabilities. But suppose that you want to restrict communication and collaboration between two groups to avoid a conflict of interest from occurring in your organization. Or, perhaps you want to restrict communication and collaboration between certain people inside your organization in order to safeguard internal information. Microsoft 365 enables communication and collaboration across groups and organizations, so is there a way to restrict communication and collaboration among specific groups of users when necessary? With Microsoft Purview Information Barriers (IB), you can! +Microsoft Purview Information Barriers (IB) is a compliance solution that allows you to restrict two-way communication and collaboration between groups and users in Microsoft Teams, SharePoint Online, and OneDrive for Business. Often used in highly regulated industries, IB can help to avoid conflicts of interest and safeguard internal information between users and organizational areas. -Microsoft Teams, SharePoint Online, and OneDrive for Business support information barriers. Assuming your [subscription](#required-licenses-and-permissions) includes information barriers, a compliance administrator, or information barriers administrator can define policies to allow or prevent communications between groups of users in Microsoft Teams. Information barrier policies can be used for situations like these: +When IB policies are in place, users who shouldn't communicate or share files with other specific users won't be able to find, select, chat, or call those users. IB policies automatically put checks in place to detect and prevent unauthorized communication and collaboration among defined groups and users. IB policies are independent from [compliance boundaries](/microsoft-365/compliance/set-up-compliance-boundaries) for eDiscovery investigations that control user content locations that eDiscovery managers can search. -- User in the day trader group should not communicate or share files with the marketing team-- Finance personnel working on confidential company information should not communicate or share files with certain groups within their organization-- An internal team with trade secret material should not call or chat online with people in certain groups within their organization-- A research team should only call or chat online with a product development team-- A site for day trader group should not be shared or accessed by anyone outside the day trader group--> [!IMPORTANT] -> Information barriers ***only supports*** two way restrictions. One way restrictions, such as marketing can communicate and collaborate with day traders, but day traders cannot communicate and collaborate with marketing ***is not supported***. +IB policies can allow or prevent communication and collaboration between groups and users for the following example scenarios: -For all of these example scenarios (and more), information barrier policies can be defined to prevent or allow communications and collaboration in Microsoft Teams, SharePoint Online and OneDrive. Such policies can prevent people from calling or chatting with those they shouldn't, or enable people to communicate only with specific groups in Microsoft Teams. With information barrier policies in effect, whenever users who are covered by those policies attempt to communicate and collaborate with others in Microsoft Teams, SharePoint Online or OneDrive checks are done to prevent (or allow) communication and collaboration (as defined by information barrier policies). --To learn more about the user experience with information barriers, see: --- [Information barriers in Microsoft Teams](/MicrosoftTeams/information-barriers-in-teams)-- [Information barriers in SharePoint Online](/sharepoint/information-barriers)-- [Information barriers in OneDrive](/onedrive/information-barriers)+- Users in the *Day Trader* group shouldn't communicate or share files with the *Marketing Team* +- Finance personnel working on confidential company information shouldn't communicate or share files with certain groups within their organization +- An internal team with trade secret material shouldn't call or chat online with people in certain groups within their organization +- A research team should only call or chat online with a product development team +- A SharePoint site for *Day Trader* group shouldn't be shared or accessed by anyone outside of the *Day Trader* group > [!IMPORTANT]-> Currently, information barriers do not apply to email communications. In addition, information barriers are independent from [compliance boundaries](set-up-compliance-boundaries.md).<p> Before you define and apply information barrier policies, make sure your organization does not have [Exchange address book policies](/exchange/address-books/address-book-policies/address-book-policies) in effect. (Information barriers are based on address book policies.) +> Information barriers **only supports** two-way communication and collaboration restrictions. For example, a scenario where Marketing can communicate and collaborate with Day Traders, but Day Traders cannot communicate and collaborate with Marketing **isn't supported**. -## What happens with information barriers +## Information barriers and Microsoft Teams -When information barrier policies are in place, people who should not communicate or share files with other specific users won't be able to find, select, chat, or call those users. With information barriers, checks are in place to prevent unauthorized communication and collaboration. --Information barriers applies to Microsoft Teams (chats and channels), SharePoint Online and OneDrive. -In Microsoft Teams, information barrier policies determine and prevent the following kinds of unauthorized communications: +In Microsoft Teams, IB policies determine and prevent the following kinds of unauthorized communication and collaboration: - Searching for a user - Adding a member to a team In Microsoft Teams, information barrier policies determine and prevent the follo - Sharing a screen - Placing a call - Sharing a file with another user-- Access to file through sharing link+- Access to a file through sharing a link ++If the users conducting these activities in Microsoft Teams are included in an IB policy to prevent the activity, they won't be able to proceed. In addition, everyone included in an IB policy can be potentially blocked from communicating with other users in Microsoft Teams. When people affected by IB policies are part of the same team or group chat, they may be removed from those chat sessions and further communication with the group may not be allowed. -If the people involved are included in an information barrier policy to prevent the activity, they will not be able to proceed. In addition, potentially, everyone included in an information barrier policy can be blocked from communicating with others in Microsoft Teams. When people affected by information barrier policies are part of the same team or group chat, they might be removed from those chat sessions and further communication with the group might not be allowed. +For more information, see [information barriers in Microsoft Teams](/MicrosoftTeams/information-barriers-in-teams). -To learn more about the user experience with information barriers, see [information barriers in Microsoft Teams](/MicrosoftTeams/information-barriers-in-teams). +## Information barriers and SharePoint and OneDrive -In SharePoint Online and OneDrive, information barrier policies determine and prevent the following kinds of unauthorized collaborations: +In SharePoint Online and OneDrive, IB policies detect and prevent the following kinds of unauthorized collaboration: - Adding a member to a site - Accessing site or content by a user - Sharing site or content with another user - Searching a site -To learn more about the user experience with information barriers, see [information barriers in SharePoint Online](/sharepoint/information-barriers) --## Required licenses and permissions --Before you get started with IB, you should confirm your [Microsoft 365 subscription](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans) and any add-ons. To access and use IB, your organization must have one of the following subscriptions or add-ons: --- Microsoft 365 E5/A5 subscription (paid or trial version)-- Office 365 E5/A5/A3/A1 subscription (paid or trial version)-- Office 365 Advanced Compliance add-on (no longer available for new subscriptions)-- Microsoft 365 E3/A3/A1 subscription + the Microsoft 365 E5/A5 Compliance add-on-- Microsoft 365 E3/A3/A1 subscription + the Microsoft 365 E5/A5 Insider Risk Management add-on--For more information, see [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#information-protection). +For more information, see [Information barriers in SharePoint](/sharepoint/information-barriers) and [Information barriers in OneDrive](/onedrive/information-barriers). -To [define or edit information barrier policies](information-barriers-policies.md), you must be assigned one of the following roles: +## Information barriers and Exchange Online -- Microsoft 365 global administrator-- Office 365 global administrator-- Compliance administrator-- IB Compliance Management+IB policies aren't available to restrict communication and collaboration between groups and users in email messages. IB policies are based on [Exchange Online Address Book Policies (ABPs)](/exchange/address-books/address-book-policies/address-book-policies). ABPs allow organizations to virtually assign users into specific groups in order to provide customized views of the organization's global address book (GAL). When IB policies are created, ABPs for the policies are automatically created. As IB policies are added in your organization, the structure and behavior of your GAL will change to comply with IB policies. -(To learn more about roles and permissions, see [Permissions in the Office 365 Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md).) +Before you define and apply IB policies, you must remove all existing Exchange address book policies in your organization. IB policies are based on address book policies and existing ABPs policies aren't compatible with the ABPs created by IB. To remove your existing address book policies, see [Remove an address book policy in Exchange Online](/exchange/address-books/address-book-policies/remove-an-address-book-policy). Once IB policies are enabled and if you have hierarchical address book enabled, all users not included in an IB segment will see the [hierarchical address book](/exchange/address-books/hierarchical-address-books/hierarchical-address-books) in Exchange online. -You must be familiar with PowerShell cmdlets in order to define, validate, or edit information barrier policies. Although we provide several examples of PowerShell cmdlets in the [how-to article](information-barriers-policies.md), you'll need to know other details, such as parameters, for your organization. +Only Exchange Online deployments are currently supported for IB policies. If your organization needs to define and control email communications, consider using [Exchange mail flow rules](/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules). -## Next steps +## Ready to get started? -- [Learn more about information barriers in Microsoft Teams](/MicrosoftTeams/information-barriers-in-teams)-- [Learn more about information barriers in SharePoint Online](/sharepoint/information-barriers)-- [Learn more about information barriers in OneDrive](/onedrive/information-barriers)+- [Get started with information barriers](information-barriers-policies.md) +- [Manage information barrier policies](information-barriers-edit-segments-policies.md) - [See the attributes that can be used for information barrier policies](information-barriers-attributes.md)-- [Define policies for information barriers](information-barriers-policies.md)-- [Edit (or remove) information barrier policies](information-barriers-edit-segments-policies.md) |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | Whether it be adding new solutions to the [Microsoft Purview compliance portal]( ### Data lifecycle management and records management -- [Govern your data with Microsoft Purview](manage-data-governance.md) - data connectors are removed from this page and the records management solution is presented as a peer product.-- [Common settings for retention policies and retention labels](retention-settings.md) - reflects new navigational and UI references for the newly designed retention label wizard.-- [Declare records by using retention labels](declare-records.md) and [Use record versioning to update records stored in SharePoint or OneDrive](record-versioning.md) - new information about the new "Unlock this record by default" label setting that's currently rolling out in preview.-- [Use file plan to create and manage retention labels](file-plan-manager.md#information-about-the-label-properties-for-import) - the import section now discloses the label settings that aren't currently supported for import (multi-stage disposition review and unlock this record by default).+- With the [product name change](#changes-to-product-names), **Information governance** is renamed **Data lifecycle management** in the compliance portal. +- Currently rolling out: new design for the retention label settings configuration. +- Currently rolling out: new label option in preview, "Unlock this record by default". For more information, see [Configuring retention labels to declare records](declare-records.md#configuring-retention-labels-to-declare-records) and [Use record versioning to update records stored in SharePoint or OneDrive](record-versioning.md). ### Data Loss Prevention Whether it be adding new solutions to the [Microsoft Purview compliance portal]( ### Sensitivity labels -- [Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and SharePoint sites](sensitivity-labels-teams-groups-sites.md#configure-site-sharing-permissions-by-using-powershell-advanced-settings) - new configuration now in preview for site sharing permissions by using PowerShell advanced settings.-- [Restrict access to content by using sensitivity labels to apply encryption](encryption-sensitivity-labels.md) - added the known issue for specifying a group that contains mail contacts, with a link to the published KB for details and workarounds.-- [Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) - removed the known issue with deleted OneDrive sites incorrectly displayed in the simulation results for auto-labeling policies)-- [Enable co-authoring for files encrypted with sensitivity labels](sensitivity-labels-coauthoring.md) - as a result of customer feedback, removed the callout in the Prerequisites section that this feature isn't yet supported by the Semi-Annual Enterprise Channel, and instead added Semi-Annual Enterprise Channel (Preview) with the minimum version 2202.-- [Manage sensitivity labels in Office apps](sensitivity-labels-office-apps.md) - support details for applying a default label to existing documents are updated to correct that on Windows, this release is still rolling out in the Beta channel, and is now fully rolled out for the web.+- Newly supported scenario for SharePoint sites, now in preview: [Configure site sharing permissions by using PowerShell advanced settings](sensitivity-labels-teams-groups-sites.md#configure-site-sharing-permissions-by-using-powershell-advanced-settings) +- [Co-authoring for files encrypted with sensitivity labels](sensitivity-labels-coauthoring.md) is now available for testing with the Semi-Annual Enterprise Channel (Preview) channel. +- Deleted OneDrive accounts are now correctly displayed in the simulation results for auto-labeling policies. +- Known issue if you [assign permissions to mail contacts in groups](/office365/troubleshoot/sensitivity-labels/mail-contacts-lose-access-encrypted-content) when you configure a sensitivity label for encryption. ### Changes to product names |
| contentunderstanding | Apply A Retention Label To A Model | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/apply-a-retention-label-to-a-model.md | description: Learn how to apply a retention label to a model in SharePoint Synte </br> - You can easily apply a [retention label](../compliance/retention.md) to a model in Microsoft SharePoint Syntex. You can do this for both document understanding and form processing models. Retention labels let you apply retention settings to the documents that your models identify. For example, you want your model to not only identify any *Insurance notice* documents that are uploaded to your document library, but to also apply a *Business* retention tag to them so that these documents cannot be deleted from the document library for the specified time period (the next five months, for example). |
| contentunderstanding | Create A Form Processing Model | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/create-a-form-processing-model.md | Creating a form processing model involves the following steps: You can only create a form processing model in SharePoint document libraries for which it's enabled. If form processing is enabled, you're able to see the **Automate** > **AI Builder** > **Create a model to process forms** menu in your document library. If you need processing enabled on your document library, you must contact your SharePoint administrator. -  + ## Step 1: Create a form processing model You need to tag the documents to teach the model to understand the fields and ta 2. After the model is published, select **Use model**, and then select **Create flow**. This creates a Power Automate flow that can run in your SharePoint document library and that extracts the fields that have been identified in the model. -  +  3. When completed, you'll see the message: *Your flow was successfully created*. -  - 4. Select the **Go to SharePoint** button to see the document library updated with your model. ## Step 5: Use your model |
| enterprise | Modern Desktop Deployment And Management Lab | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab.md | Title: Windows and Office 365 deployment lab kit f1.keywords: - NOCSH--++ Previously updated : 11/18/2021+ Last updated : 05/11/2022 ms.audience: ITPro description: Learn about where to access the Windows and Office Deployment Lab K The Windows and Office 365 deployment lab kit is designed to help you plan, test, and validate your deployment and management of desktops running Windows 10 Enterprise or Windows 11 Enterprise and Microsoft 365 Apps for enterprise. The labs in the kit cover using Microsoft Endpoint Configuration Manager, OneDrive, Windows Autopilot, and more. This kit is highly recommended for organizations preparing for desktop upgrades. As an isolated environment, the lab is also ideal for exploring deployment tool updates and testing your deployment-related automation. -**Windows 10 and Windows 11 versions of the deployment lab kit are now available for free download in the Microsoft Evaluation Center.** +There are two versions of the lab available for free download: -[Download Windows 11 with Office 365 deployment lab kit](https://www.microsoft.com/evalcenter/evaluate-windows-11-office-365-lab-kit)<br> -[Download Windows 10 with Office 365 deployment lab kit](https://www.microsoft.com/evalcenter/evaluate-lab-kit) +|Windows 10 Lab|Windows 11 Lab| +||| +|[Win 10 lab environment](https://download.microsoft.com/download/3/3/a/33a3c7d7-b393-4f78-9b90-2d5eb7fd98e8/Win10_21H1_lab.zip)|[Win 11 lab environment](https://download.microsoft.com/download/9/d/9/9d9e278e-a1ea-4704-85e1-cb24f3806f45/Win11_Lab_05.09.zip)| +|[Win 10 lab guides](https://download.microsoft.com/download/3/3/a/33a3c7d7-b393-4f78-9b90-2d5eb7fd98e8/Win10_21H1_lab_guides.zip)|[Win 11 lab guides](https://download.microsoft.com/download/9/d/9/9d9e278e-a1ea-4704-85e1-cb24f3806f45/Win11_Lab_Guides_05.09.zip)| ## A complete lab environment The lab provides you with an automatically provisioned virtual lab environment, |Windows 10 Lab|Windows 11 Lab| ||| |Windows 10 Enterprise, Version 21H1|Windows 11 Enterprise|-|Microsoft Endpoint Configuration Manager, Version 2103|Microsoft Endpoint Configuration Manager, Version 2111| +|Microsoft Endpoint Configuration Manager, Version 2203|Microsoft Endpoint Configuration Manager, Version 2203| |Windows Assessment and Deployment Kit for Windows 10|Windows Assessment and Deployment Kit for Windows 11| |Windows Server 2019|Windows Server 2022| Detailed lab guides take you through multiple deployment and management scenario - Windows Hello for Business > [!NOTE]-> Please use a broadband internet connection to download this content and allow approximately 30 minutes for automatic provisioning. The lab environment requires a minimum of 16 GB of available memory and 150 GB of free disk space. For optimal performance, 32 GB of available memory and 300 GB of free space is recommended. The Windows 10 lab expires May 16, 2022. The Windows 11 lab expires May 6, 2022. New versions will be published prior to expiration. +> Please use a broadband internet connection to download this content and allow approximately 30 minutes for automatic provisioning. The lab environment requires a minimum of 16 GB of available memory and 150 GB of free disk space. For optimal performance, 32 GB of available memory and 300 GB of free space is recommended. The Windows 10 lab expires May 16, 2022. The Windows 11 lab expires August 7, 2022. New versions will be published prior to expiration. ## Additional guidance |
| security | Microsoft 365 Zero Trust | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/Microsoft-365-zero-trust.md | +Use this article together with this poster. ++| Item | Description | +|:--|:--| +|[</li></ul> + ## Zero Trust security architecture A Zero Trust approach extends throughout the entire digital estate and serves as an integrated security philosophy and end-to-end strategy. |
| security | Attack Surface Reduction Rules Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference.md | The following table lists the supported operating systems for rules that are cur > > Attack surface reduction rules in Windows Server 2012 R2 and Windows Server 2016 are available for devices onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016 Preview](/microsoft-365/security/defender-endpoint/configure-server-endpoints#new-functionality-in-the-modern-unified-solution-for-windows-server-2012-r2-and-2016-preview). -| Rule name| Windows 11 <br>and<br> Windows 10 | Windows Server <br> 2022 <br>and<br> Windows Server <br> 2019 | Windows Server | Windows Server <br> 2016 <br> <sup>[[1, 2](#fn1)]<sup></sup> | Windows Server <br> 2012 R2 <br> <sup>[[1, 2](#fn1)]<sup></sup> | +| Rule name| Windows 11 <br>and<br> Windows 10 | Windows Server <br> 2022 <br>and<br> Windows Server <br> 2019 | Windows Server | Windows Server <br> 2016 <sup>[[1, 2](#fn1)]<sup></sup> | Windows Server <br> 2012 R2 <sup>[[1, 2](#fn1)]<sup></sup> | |:|::|::|::|::|::| | [Block abuse of exploited vulnerable signed drivers](#block-abuse-of-exploited-vulnerable-signed-drivers) | Y | Y | Y <br> version 1803 (Semi-Annual Channel) or later | Y | Y |-| [Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | Y version 1809 or later | Y | Y | Y | Y | +| [Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | Y <br> version 1809 or later <sup>[[3](#fn1)]<sup></sup> | Y | Y | Y | Y | | [Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | Y | Y | Y | Y | Y |-| [Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | Y <br> version 1803 or later | Y | Y | Y | Y | +| [Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | Y <br> version 1803 or later <sup>[[3](#fn1)]<sup></sup> | Y | Y | Y | Y | | [Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | Y | Y | Y | Y | Y |-| [Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | Y <br> version 1803 or later | Y | Y | Y | Y | +| [Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | Y <br> version 1803 or later <sup>[[3](#fn1)]<sup></sup> | Y | Y | Y | Y | | [Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | Y | Y | Y | Y | Y | | [Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | Y | Y | Y | N | N | | [Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | Y | Y | Y | Y | Y | | [Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | Y | Y | Y | Y | Y | | [Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | Y | Y | Y | Y | Y |-| [Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) <br> \* _File and folder exclusions not supported._ | Y <br> version 1903 (build 18362) or later | Y | Y <br> version 1903 (build 18362) or later | N | N | -| [Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | Y <br> version 1803 or later | Y | Y | Y | Y | +| [Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) <br> \* _File and folder exclusions not supported._ | Y <br> version 1903 (build 18362) or later <sup>[[3](#fn1)]<sup></sup> | Y | Y <br> version 1903 (build 18362) or later | N | N | +| [Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | Y <br> version 1803 or later <sup>[[3](#fn1)]<sup></sup> | Y | Y | Y | Y | | [Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | Y | Y | Y | Y | Y | | [Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | Y | Y | Y | N | N |-| [Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | Y <br> version 1803 or later | Y | Y | Y | Y | +| [Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | Y <br> version 1803 or later <sup>[[3](#fn1)]<sup></sup> | Y | Y | Y | Y | (<a id="fn1">1</a>) Refers to the modern unified solution for Windows Server 2012 and 2016. For more information, see [Onboard Windows Servers to the Defender for Endpoint service](configure-server-endpoints.md). (<a id="fn1">2</a>) For Windows Server 2016 and Windows Server 2012 R2, the minimum required version of Microsoft Endpoint Configuration Manager is version 2111. +(<a id="fn1">3</a>) Version and build number apply only to Windows 10. + ## Supported configuration management systems Links to information about configuration management system versions referenced in this table are listed below this table. |
| security | Enable Network Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-network-protection.md | Last updated > [!TIP] > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-assignaccess-abovefoldlink) -[Network protection](network-protection.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the internet. You can [audit network protection](evaluate-network-protection.md) in a test environment to view which apps would be blocked before you enable it. +[Network protection](network-protection.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the internet. You can [audit network protection](evaluate-network-protection.md) in a test environment to view which apps would be blocked before enabling network protection. [Learn more about network filtering configuration options.](/mem/intune/protect/endpoint-protection-windows-10#network-filtering) Use the following procedure to enable network protection on domain-joined comput > [!IMPORTANT] > To fully enable network protection, you must set the Group Policy option to **Enabled** and also select **Block** in the options drop-down menu. -Confirm network protection is enabled on a local computer by using Registry editor: --1. Select **Start** and type **regedit** to open **Registry Editor**. --2. Navigate to **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection\EnableNetworkProtection** --3. Select **EnableNetworkProtection** and confirm the value: - - 0=Off - - 1=On - - 2=Audit + > [!NOTE] + > Optional: Follow the steps in [Check if network protection is enabled](#check-if-network-protection-is-enabled) to verify that your Group Policy settings are correct. ### Microsoft Endpoint Configuration Manager 1. Open the Configuration Manager console. -2. Go to **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. +2. Go to **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. 3. Select **Create Exploit Guard Policy** from the ribbon to create a new policy. - To edit an existing policy, select the policy, then select **Properties** from either the ribbon or the right-click menu. Edit the **Configure network protection** option from the **Network Protection** tab. -4. On the **General** page, specify a name for the new policy and verify the **Network protection** option is enabled. +4. On the **General** page, specify a name for the new policy and verify the **Network protection** option is enabled. 5. On the **Network protection** page, select one of the following settings for the **Configure network protection** option: - **Block** |
| security | Mac Install With Other Mdm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-install-with-other-mdm.md | As part of the Endpoint Detection and Response capabilities, Microsoft Defender - Filter type: Plugin - Plugin bundle identifier: `com.microsoft.wdav` - Filter data provider bundle identifier: `com.microsoft.wdav.netext`-- Filter data provider designated requirement: `identifier "com.microsoft.wdav.tunnelext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`+- Filter data provider designated requirement: `identifier "com.microsoft.wdav.netext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9` - Filter sockets: `true` ## Check installation status |
| security | Mac Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-whatsnew.md | ms.technology: mde > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +## 101.66.54 (20.122041.16654.0) ++- Addressed an issue where `mdatp diagnostic real-time-protection-statistics` was not printing the correct process path in some cases. +- Bug fixes + ## 101.64.15 (20.122032.16415.0) - Fixed a regression introduced in version 101.61.69 where the status menu icon was sometimes showing an error icon, even though no action was required from the end user |
| security | Tamperprotection Macos | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tamperprotection-macos.md | You can configure the tamper protection mode by providing the mode name as enfor **Highly recommended settings:**  -1. System Integrity Protection (SIP) enabled -1. Use a Mobile device management (MDM) tool to configure Microsoft Defender for Endpoint +1. System Integrity Protection (SIP) enabled. For more information, see [Disabling and Enabling System Integrity Protection](https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection). +1. Use a Mobile device management (MDM) tool to configure Microsoft Defender for Endpoint.   |
| security | Set Up Anti Phishing Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/set-up-anti-phishing-policies.md | The following impersonation settings are only available in anti-phishing policie - **Enable domains to protect**: Prevents the specified domains from being impersonated **in the message sender's domain**. For example, all domains that you own ([accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains)) or specific custom domains (domains you own or partner domains). This list of **sender domains** that are protected from impersonation is different from the list of **recipients** that the policy applies to (all recipients for the default policy; specific recipients as configured in the **Users, groups, and domains** setting in the [Common policy settings](#common-policy-settings) section). > [!NOTE]- > The maximum number of protected domains that you can define in all anti-phishing policies is 50. + > You can specify a maximum of 50 custom domains in each anti-phishing policy. By default, no sender domains are configured for impersonation protection in **Enable domains to protect**. Therefore, by default, no sender domains are covered by impersonation protection, either in the default policy or in custom policies. |