Don’t make me think about security in Microsoft Teams

Microsoft Teams is a part of Office 365 and must be licensed along that way. Due to the current situation with the COVID-19 virus, Microsoft has made the Office 365 Feature Teams available free of charge for everyone until 01.2021. The details can be found in this article: https://news.microsoft.com/en-my/2020/03/17/our-commitment-to-customers-during-covid-19/

Many companies and schools around the world have now taken advantage of this offer. The topics Data Security, Data Protection and IT Security often fades into the background behind urgent business needs.

13 steeps to quickly secure you Microsoft Teams environment

Security and also Compliance aspects in Microsoft Teams are configured in the Teams Admin Center. Multiple policy packages can be created for different scenarios, users and groups. A policy package combines settings that relate to typical work processes of these users and groups.

Teams Settings

1. E-mail integration - Security impact: low

E-mail integration allows mail to be sent directly to a Team channel. The content of the e-mail is displayed in the chat in the channel and is visible to all members.

2. Files - Security impact: medium

Enable or disable file sharing and cloud file storage options for the Files tab in teams.

3. Devices - Security Impact: low

Settings for devices in the meeting room.

Meetings & Messaging Policies

Meeting policies are used to control what features are available to users when they attend Teams meetings.

4. Audio & Video - Security impact: medium

The audio and video settings can be used to turn on or off specific functions used in Teams.

5. Content Sharing - Security impact: high

Content Sharing" controls which functions are available in a Teams meeting in this context.

6. Participant & Guest - Security impact: high

The settings for participants and guests control access to Teams meetings.

7. Meeting Settings - Security Impact: high

Meeting settings are used to control whether anonymous users can attend Teams meetings.

8 Live Events Policies - Security Impact: high

Live event policies are used to configure, for example, whether participants can transcribe or whether live events can be recorded.

9. Messaging Policies - security impact: high

Messaging policies are used to control which chat and channel messaging features are available to users in Teams.

Teams Apps

10 Org-wide App Settings - Security Impact: high

This function controls which applications are available to users in Teams. Furthermore, it can be configured which 3rd party apps can be used.

11 App Permission Policies - Security Impact: high

The App Permission Policies control which apps users can use, depending on the settings in the previous step.

Org-Wide Settings

12 External Access - Security Impact: high

External access allows users to communicate with other users outside your organization. By default, users can communicate with all external domains.

13 Guest Users - Security Impact: high

Teams allows users to invite external users to join Teams. When external users are added to a team, they receive an invitation that they must accept before they can access it. Microsoft has provided a checklist for Guest Users in Teams: https://docs.microsoft.com/en-us/microsoftteams/guest-access-checklist  

What rights guest users have is set in the Team Admin Center.

Some permissions are configured directly in Teams.

Advanced Features (Office 365 E3 / E5) - Information Protection and Labeling for Teams

Microsoft has consolidated the topic of classification / labeling under the name Unified Labeling, which can be found in the Office 365 Security & Compliance Center. The menu Classification->Sensitivity Labels let you create labels that also affect Microsoft teams.

Encryption:

Who can access files and e-mail messages that are labeled, regardless of the user rights that person has in Teams.

Content labeling:

Add custom headers, footers, and watermarks to email messages or documents that are labeled.

Prevent data loss:

Currently, only endpoint DLP features offered by Windows Information Protection (WIP) are available. DLP settings for Office 365 applications will be available soon.

Site and Group Settings (also affecting Microsoft Teams):

Note that these settings are not applied to files, so they have no effect on downloaded copies of files.

Auto-labeling for Teams:

An auto label policy always includes the location of a file. For example, all files that are stored in a particular Team can automatically get a label. This function can be supplemented by rules that only assign the label if the defined parameters also exist, such as a specific phrase in a document.

Coaching your users through the External Sharing Experience

If your organization is sharing documents or collaborating directly with vendors, clients, or customers, then you can use the external sharing features and guest access in Office 365 to support this. Or, if this is not the case, you may want to limit the use of external collaboration in your organization.

Note that external sharing is turned on by default for your entire Office 365 environment. Every user can invite external people to Groups, Teams and SharePoint sites and can share content using OneDrive for Business. You may want to turn it off globally until you know exactly how you want to use the feature.

Poorly there is no mater switch to turn external sharing and inviting external user ON or OFF globally. We need to configure it per service and there are also cross sites effects between the services.

Settings overview

External sharing overview

Content Level

When sharing a SharePoint site with an authenticated external user, an invitation is sent to them via email which contains a link to the site. During the login process they are asked to log in using the username and password of their Microsoft account or their work or school account. If the login is successful, the account is added to the Azure AD associated to the Office 365 subscription. The account is added with #EXT# in the user name.

An external user did not need to have a license. To discontinue sharing with an authenticated external user, remove the permissions from the site or delete the user in the Azure AD.

If you share a file or folder with an external user, this user gets an email with a link to the file or folder. The user gets a time-sensitive code via email that he can use to verify his identity. Once he proved his identity by using the code the user is added as a external user in the Azure AD and he can access the file using his account. Sharing a file or folder with a user that did not have a Microsoft account or work or school account this user needs to use the code every time to access the shared content.

To discontinue sharing with an authenticated external user you can delete the sharing link that was sent to him.

To share with anonymous users, you can set several options:

• Edit, view or upload to a folder
• Set link to expire at a specified time
• Block download

The (external) user will receive a E-Mail with the link to the file or folder.

Anonymous users are not added to the Azure AD. To discontinue sharing you need to delete the anonymous link.

Collaboration Level

Guest access on the collaboration level is included with all Office 365 Business Premium, Office 365 Enterprise, and Office 365 Education subscriptions. No additional licensing for the guest users is requirement. You can have up to 5 guests per licensed user on your tenant. For more information about licensing, see Azure Active Directory B2B collaboration licensing guidance.

Office 365 Groups

To collaborate with external users in your Office 365 Group this feature must be activated as showed in the table above. By default, guest access is turned on in Office 365. That means, that everyone in your organization can add external users to an Office 365 Group. When an external user is invited to join a group, he receives an invitation email. The external user will have access to the following Office 365 Group features:

• Conversations: Externals did not get access to the conversation history, but they will become part of the Office 365 Group distribution list.
• Notebook: Externals get access to OneNote
• Calendar: No access, but they receive calendar invitations
• SharePoint Team Site: Externals get access to the SharePoint Team Site
• Planner: To access a plan, guests either need to use a specific plan URL or go to https://tasks.office.com/%organizationdomainname%

Microsoft Teams

Because of Microsoft Teams is using services like SharePoint Online etc. the external access configuration belongs on the settings in you tenant.

Each level controls the guest access as shown:

• Azure Active Directory: External access in Microsoft Teams relies on Azure AD.
• Microsoft Teams: Controls external access in Microsoft Teams.
• Office 365 Groups: Controls external access in Office 365 Groups and Microsoft Teams.
• SharePoint Online and OneDrive for Business: Controls external access in SharePoint Online and OneDrive for Business.

Advanced

Office 365 inter-tenant collaboration

We have several options to collaborate between two Office 365 tenants. Based on Azure Active Directory B2B we can set up collaboration for nearly all Office 365 services. Details are described in this Microsoft article: Office 365 inter-tenant collaboration

Tenant restrictions

Tenant restrictions enables you to control access to other Office 365 tenants. Tenant restrictions gives organizations the ability to specify the list of tenants that their users are permitted to access. Details, pre-requirements and limitations are described in this Microsoft article: Use Tenant Restrictions to manage access to SaaS cloud applications

Office 365 user vs. Windows Live ID

Anyone with a Microsoft work or school account or a consumer email account, such as Outlook, Gmail, or others, can participate as a guest in Office 365.

If a user has an Office 365 hosted E-Mail address, he will automatically have a work or school account created by his IT department. This account original exists in an Azure AD.

If a user does not have a work or school account, he can use a LiveID. To get one the user needs to go to the Microsoft account sign-in page: https://account.microsoft.com/. In the upper right corner select “Login” and then select “No account”. He needs to fill out the form and create a password. Details see below in “Coaching your (guest) users through the External Sharing Experience” The LiveID is original hosted by Microsoft.

Coaching your (guest) users through the External Sharing Experience

Content Level

IF you are inviting an external user to a SharePoint site or added him to a SharePoint group, he will receive an invitation E-Mail:

The link in the email will point the user to a website asking him what type of account he has:

If the user enters his email but did not have a Microsoft account, he will see the following dialog:

Click “Create One!” to register a new Microsoft account:

Set a password:

Provide your details:

Microsoft will send a code to verify the email address:

If a file or folder in SharePoint or OneDrive for Business is shared to an external user and the user did not already exists in the Azure AD, he will also need to verify his E-Mail address:

Sharing a file or folder with a user that did not have a Microsoft work or school account this user needs to use the code every time to access the shared content.

Collaboration Level

When an external user is invited to a group, he receives an E-Mail:

External member's can join conversations through their inbox and receive calendar invitations.

When an external user is invited to a group, he also receives an E-Mail with the details:

Using site classification for SharePoint Sites

Site classification is a must-have when we talk about Governance, Compliance and also topics around GDPR.

Beside 3^rd party solutions focusing on site and content classification we have also some out of the box options and developer opportunities in Office 365 and SharePoint on-prem. Depending on if we are talking about classic SharePoint Site Collections or if we talk about modem Team Sites, being part of an Office 365 Group, we have different szenarios.

To create a new SharePoint site in Office 365 we know two different ways.

1. We can create a SharePoint Online Site using the SharePoint Online Administration. This will create a SharePoint Site based on WebTemplate STS
2. We can go to SharePoint Home and click “create” in the upper left corner or we can go to Outlook Online and create a new Group. Both will create a SharePoint Site based on WebTemplate GROUP

To provide a site classification solution for classic Team Sites created by option 1 we need to implement the following: Implement a SharePoint site classification solution. This works also for SharePoint 2013 on-prem. The article describes a full solution including policies for site closing and deletion depending on the classification setting. As you can see the article describes some steps to do:

• Define and set site policies
• Insert a custom action
• Custom site classification
• Add a classification indicator to site page

Using the opportunities we have with Groups and Group Policies some of these things can be automatically put to a SharePoint Site based on WebTemplate GROUP.

This video by Vesa Juvonen is showing the steps and the final results:

As you can see we need to create the site bases on option 2.

(Dialogs already including policies)

SharePoint Home - Create:

Outlook Online -> Create Group:

Final result:

Step by Step

To enable this functionality in Office 365 we need to set up an “Settings Object” and a “Settings Template” in Azure AD. To do this we can use the Azure Active Directory cmdlets for configuring group settings.

First of all we need to install the preview of Azure Active Directory V2 PowerShell Module:

Install-Module -Name AzureADPreview

To set up the site classification options and configure properties like ClassificationList and ClassificationDescriptions etc follow these steps also shown in Vesas video:

#Connect

Connect-AzureAD

Get-AzureADDirectorySettingTemplate

#Create

$Template = Get-AzureADDirectorySettingTemplate -Id 62375ab9-6b52-47ed-826b-58e47e0e304b

$Setting = $template.CreateDirectorySetting()

$setting["UsageGuidelinesUrl"] = "http://sharepointtalk.com"

$setting["ClassificationList"] = "Public, Internal, TopSecret"

$setting["DefaultClassification"] = "TopSecret"

$setting["ClassificationDescriptions"] = "Public:no restrictions,Internal:all internal users can access,TopSecret:only special users can access"

$setting["GuestUsageGuidelinesUrl"] = "http://sharepointtalk.net"

New-AzureADDirectorySetting -DirectorySetting $setting

#Check

Get-AzureADDirectorySetting -All $True

(Get-AzureADDirectorySetting -Id %%YOUR ID%%).values

As described in the video we can now use the CLASSIFICATION property to assign a site policy or any other custom action. Details about site policies are part of Implement a SharePoint site classification solution.

Here the script taken from the video to get the CLASSIFICATION property:

#Get PnP PowerShellOnline

Install-Module SharePointPnPPowerShellOnline

#Get Site classfication value

Connect-PnPOnline https://%YOUR TENANT%.sharepoint.com/sites/%YOUR SITE%

Get-PnPSite

$Site.Classification

Get-PnPProperty -ClientObject $Site -Property Classification