天美影院

This document gives deployment security considerations when configuring the Office 365 Admin Centre (OAC) for the Microsoft Office 365 (O365) web service. The secure configuration of a cloud-hosted service aligns with government鈥檚 guidance on implementing the Cloud Security Principles. Please send any feedback you may have to enquiries@cesg.gsi.gov.uk.

1. Office 365 Admin Centre

The OAC allows an administrator of O365 to configure users鈥� settings and privileges (including restricting user access to O365 features) using the . There are additional Admin Centres for certain individual services; such as the Exchange Admin Centre (EAC) and the SharePoint Admin Centre (SAC), which are available under OAC | Admin.

The OAC provides some security options that need to be addressed:

• The should automatically be the same as the on-premise policy if the enterprise is implementing federated identity with O365. Otherwise, the expiry policy can be set or changed for O365 under OAC | Service Settings | Passwords.

• The decision to enable should be assessed as part of enterprise鈥檚 authentication practice, as an option to enhance the security of user access. CESG strongly recommend it for at least administrative users. It can be implemented with a phone call, a mobile app, or an SMS message. Enabling two-step verification will disable PowerShell access for that account. If it is required, CESG recommend having a separate administrator account for PowerShell access, which should be disabled until it is needed.

2. Users

There are some security considerations relating to users:

• Not all features will be needed by all users. CESG recommend that an administrator takes the time to familiarise themselves with the features available to users and consider their relevancy to the enterprise. There should also be continued careful observation of the services features available to users as Microsoft develops its product range. Restricting a user鈥檚 access to features can be done on initial deployment by not assigning a license for that feature. If configured after initial deployment, .

• Under no circumstances should a user鈥檚 login credentials be known to anyone other than the user. The credentials are only needed for the normal login process, and are not needed for any diagnostic process.

When removing a user from O365 two options are available, the choice of which should be defined by an enterprise鈥檚 data retention policy:

1. Remove their account from O365. This will delete all user data and remove all licenses. There is a 30-day grace period in which a user account may be restored. The user鈥檚 data may be exported by an administrator during this period (for example, to OneDrive) and will be deleted at the end of this period. A mailbox can be retained by converting it to a before removal of the account; other users are added and the original user removed, giving control to the new users and freeing up the license. No passwords are required to access a shared mailbox. Microsoft provide guidance on . If an enterprise synchronises user accounts to O365 from a local Active Directory (AD) environment, ensure that the user accounts are deleted and restored in the AD service.

2. Disable their account. This will retain all information about the user until an administrator removes it and will block the user from accessing their account. The sign-in status should be set to 鈥淏locked鈥� under Users | User Page | Settings.

3. Administrative controls

Users can be granted administrative privileges by assigning administrator roles to them. These roles determine what information they can access and which management tasks they can perform.

• Microsoft offer which allow common business functions to be fulfilled, such as a Billing Admin.

• It cannot be assumed that an administrator role directly translates across all services 鈥� different services have , such as SharePoint.

• The pre-built Global Admin role grants the user access to all features in the OAC. They can manage all aspects of the enterprise鈥檚 account. Careful assignment of this role to a small number of users should be ensured; its elevated access permissions are not required for many administrative tasks.

The principle of 鈥榣east privilege鈥� should be adopted when:

• assessing each user鈥檚 administration requirements

• fulfilling good practice for administrative users by assigning them separate, non-privileged accounts to be used when they carry out non-privileged work

It is possible to ; this administrator must be a Microsoft authorised partner. They will be able to create or edit users, reset user passwords, manage user licenses, manage domains and assign administrator permissions to other users in an enterprise. If this option is pursued, CESG recommend that careful thought is given to the amount of control that should be given to the partner enterprise.

4. Sharing Controls

O365 is a collaborative toolset and working environment; rather than using the traditional model of only sharing information through email, there are many ways in which enterprise information can be shared using O365. For example, SharePoint Online allows users to share documents and information through the creation and editing of sites and site collections, onto which sharing permissions can be applied. O365 also allows users to share some information externally by default; for instance they can use a public URL to share their calendars.

The security of the collaborative features of O365 should be assessed, with some features outlined here:

• The external sharing of user鈥檚 Calendars, Sites and Lync accounts can be turned off under External Sharing in the OAC

• External sharing for Integrated Apps can be turned off under External Sharing | Sharing Overview | Integrated Apps. If turned on, enterprise users can allow third party apps to access their O365 information. In addition, turning off Integrated Apps does not remove installed apps or revoke permissions. Even after turning Integrated Apps off, administrators can still register apps to make them available to their users and allow those apps access to their users鈥� information.

• OneDrive for Business is primarily a personal data store. On initial deployment the existing folder on OneDrive has permissions of 鈥渟hared with everyone鈥�. By default, all user-created folders can only be read and edited by the creator. The sharing permissions of a folder can be changed when viewing the folder under OAC |OneDrive.

• Files can be shared with others in the enterprise by saving into a shared folder. Files automatically inherit the permissions of their folder but individual permissions can be changed.

5. SharePoint Online

The first defined Global Admin (GA) automatically becomes the first SharePoint administrator. However, SharePoint has its own security model 鈥� the GA is the only role which transfers directly to SharePoint. To share a specific document or site, Microsoft has detailed .

SharePoint has the option to allow users to include in their sites. An administrator should consider whether they want to allow their users to do this.

Sites in SharePoint are organised into .

• Site collections are hierarchical - all sites in a collection are organised under one root site. Any settings applied to the root site will apply by default to all sites in the collection, although settings can be personalised for individual sites.

• Site collection administrators can manage SharePoint Online at the site collection level, and their permissions extend to all sub-sites and content in that site collection.

Configuration of SharePoint Online can enable a number of different sharing models and the default permissions depend on where content is created and stored:

• The options for sharing sites and documents include sharing with invited authenticated users who must sign in with a or . Alternatively, guest users who do not require credentials can sign in via a guest link. CESG recommend that by default, most users should only be able to share documents within their enterprise. When they are to be shared externally, CESG strongly recommend that this is done using the invite mechanism which requires the guest to authenticate. For sites where external sharing is enabled, an administrator should consider enabling Azure RMS to protect the data.

• External sharing is turned on by default for the entire SharePoint Online environment

• External sharing can be turned on or off for the whole of SharePoint or for individual site collections, in line with the enterprise鈥檚 sharing policy.

• Administrators should be aware that in order for external sharing to be enabled for some sites, it must be first turned on for the whole O365 instance. It can then be turned off for individual sites.

Default sharing permissions also depends on the type of SharePoint site. These include:

• Team Sites: all users of the enterprise have read and write access to documents by default. These permissions can be altered to only allow some users, groups or devices to access or write to files. If the functionality is enabled, individual files or the entire site can be shared with named individuals outside of the enterprise.

• Public Sites: can publish documents directly to the Internet. All content on this site will be readable without authentication. Publishing rights can be restricted to a subset of authenticated users by assigning permissions on creation of the site. Microsoft removed the ability to create public sites on SharePoint in January 2015 - any purchase of O365 and SharePoint after this date will not have the option to implement them. Existing users will get two years of public site usage before it is fully removed.

As with other online services, sharing controls only restrict access to items while they are stored inside O365. The ability to share documents outside of an enterprises鈥� O365 instance is not usually desired for enterprises which handle sensitive information. (RMS) can be enabled to maintain access controls when documents are sent between users outside of O365, and to keep them encrypted when in transit. Note that these controls are designed to prevent accidental data loss, rather than to protect against a malicious user.

Templates for classifications can be created to apply different settings and permissions to a certain classification. For example, RMS could be used to identify and protect OFFICIAL SENSITIVE documents in the SharePoint file store.

6. Data privacy

The European Parliament has issued a directive (95/46/EC), which describes the protection of individuals with regard to the processing and free movement of personal data. Microsoft鈥檚 standard contractual terms for Office 365 include EU model contract clauses to accord with this directive.