Reconnect Series: Praveen Nair

by Contributed | May 19, 2021 | Technology

This article is contributed. See the original author and article here.

Welcome back to Reconnect, the biweekly series that catches up with former MVPs and their current activities. 

This week we are thrilled to be joined by none other than four-time titleholder Praveen Nair! Hailing from Kochi, India, Praveen is a passionate technology enthusiast who believes in giving back to the community in the form of knowledge.

Praveen currently works as the Program Director for Adfolks LLC, a full-service catalyst for transformation in the cloud. Most recently, Praveen has been working on architect business applications and data management projects, as well as working with pre-sales and marketing teams to provide business and technology solutions, largely in Azure and .NET.

When he’s not working, Praveen remains active with his regional tech community. The tech professional volunteers with the Kerala Microsoft Users Group (K-MUG) as a regular speaker and event organizer. Praveen says his ethos is to “help and get help,” and that he enjoys inspiring and working alongside fellow members of the community.

For newcomers to the MVP program, Praveen advises: “Not to worry or desire for the result but perform one’s karma. Recognitions will flow automatically when you concentrate on the objectives.” Looking forward, Praveen hopes to conduct more technology events, write more articles and help online communities.

For more information on Praveen, check out his Twitter @ninethsense and blog.

Announcing Multi-Stage Disposition in Microsoft Records Management

by Contributed | May 19, 2021 | Technology

This article is contributed. See the original author and article here.

Customers rely on the Microsoft Information Governance and Records Management solutions to help govern the lifecycle of content and manage content to meet compliance regulations. Our goals are to make it easy for customers to address compliance in Microsoft 365 and tailor our solutions to meet unique business needs. We are committed to helping organizations manage risk through appropriate governance and today we are accelerating our investments in these areas.

Today, we are excited to announce the following items:

• The public preview of multi-stage disposition
  
  
  
  • Configure a multi-stage process
  
  
  • Disposition review experience improvements
  
  
  • Enhancements for records managers
  
  
  
  


• Expansion of the availability of Microsoft Teams message retention and deletion


• Sign up for the private preview of adaptive policy scopes


• Our latest SharePoint governance performance improvements


• Other recent Microsoft Information Governance feature releases

Announcing multi-stage disposition approval

Many compliance requirements or organizational policies require approval before the deletion of records. Often this review process has multiple phases and involves numerous groups of people. Previously, Microsoft Records Management allowed only one stage of review.

Today, we are announcing the public preview of multi-stage disposition approval. Multi-stage disposition approval is available today worldwide in all commercial tenants. Please try these features and give us your feedback. This release includes several groups of new features, including:

• The ability to specify a multi-stage approval process in retention label settings


• Improvements to the reviewer experience


• Additional features for records management admins

We will cover each of these areas in-depth in the following sections.

Configure a multi-stage approval process

Records management administrators can now configure up to five stages of disposition approval in a retention label’s settings. This ability allows you to customize the disposition process to meet the needs of your organization. For each stage, you can specify users or mail-enabled security groups that should be solicited for their approval.

Figure 1: The multi-stage disposition settings screen, showing three stages and configuration options

If you already have retention labels configured for disposition review, then you can edit it to use multi-stage disposition.  

You can learn how to configure a retention label to use multi-stage disposition in our documentation.

Disposition review experience improvements

Firstly, we overhauled the disposition experience for approvers to make it faster and easier to use. When reviewers visit the disposition review area, we trim the file list to show them only the items they need to approve, rather than all files awaiting approval. Reviewers can also sort the list of available files by location, such as a specific SharePoint site or mailbox.

Figure 2: The review disposition screen, showing the list of items requiring approval and a document preview

Next, we improved the view of files for reviewers. Users can click on a file to view its contents in a mini-preview pane directly in the review experience. We also added the ability for reviewers to add other reviewers to approve certain items in addition to the existing actions of approving disposition, retention extension, or relabeling the item.

Lastly, reviewers now have more context to help with their review decision. The new history and details tabs enable reviewers to see an item’s review history, including who has approved the item before and their comments.

To learn more about the disposition reviewer experience, please see our documentation.

Enhancements for records managers

We enhanced the records manager experience with the multi-stage disposition release. Records managers can now customize the email sent to reviewers letting them know that there are items pending review. Records managers can append text to the standard system message. This feature allows the records manager to highlight specific processes and documentation within their organization. The customization of the message will apply to all labels. Learn more about customizing the disposition reviewer email here.

Next, while reviewers only see items that require their approval, records managers will be able to see all items pending disposition. To configure this view, the records manager will need to complete a one-time setup. Please see our documentation for the setup instructions.

Lastly, the new multi-stage disposition review process fully supports multi-geo environments. If needed, reviewers can review content not located in their geographical location.

Expansion of Microsoft Teams message retention and deletion

With the rise in remote work, organizations want to govern Teams messages using retention and deletion policies. Today we are excited to announce that Teams retention policies are available to all paid Office 365 licenses, including F1, F3, E1, G1, business basic, and business standard. Organizations can use retention policies to keep or delete Teams messages according to their policies.

This update includes managing messages in Teams chats, conversations, private channels (currently in private preview) and connect channels when they launch. It consists of both commercial and government cloud environments. Please note that for users with one of the above licenses, the supported minimum retention or deletion period is 30 days. For more information about the timings for Teams retention policies, see How retention works with Microsoft Teams.

For instructions to set up a retention policy, see Create and configure retention policies.

Sign up for the private preview of adaptive policy scopes

Today, we are also announcing the private preview for adaptive policy scopes. This new functionality allows admins to create attribute-based retention or label policies that can be scoped to geography, department, other user, group, or site attribute. For example, admins can create a policy specifically for users in the UK’s human resources team using an adaptive policy scope.

Adaptive policy scopes are especially useful for retention policies where you want to exclude or include specific users, sites, or groups. Currently, when manually including or excluding locations there are limits per policy. However, adaptive policy scopes are not subject to these per-policy limits and will automatically and dynamically manage policy membership as users change roles without any manual intervention.

This private preview program is open to all qualified organizations who are interested in early access to this feature and help shape the future of it. Completing the form does not guarantee access to the private preview. If you would like to participate in this preview, please complete this form: https://aka.ms/MIPC/AdaptiveScopes-Preview

Our latest SharePoint governance performance improvements

Some solution releases are not evident in the user interface of a product but have an enormous impact on our customers. Throughout the last year, we invested heavily in performance improvements for the service powering Microsoft Information Governance and Records Management for SharePoint and OneDrive.

The specific performance improvements are related to increasing the number of items we can label and delete per tenant in one week. Initial telemetry in SharePoint and OneDrive from this update has shown an increase of approximately 700 times more deletions per week and 10 times more items labeled per week compared to a year ago. For some large organizations this means over 75 million items deleted and well over 200 million files labeled per week.

The improvements released are aimed at exponentially increasing the scalability of the service within each tenant. This helps large organizations when they first begin to use Microsoft Information Governance and Records Management. It is also useful when configuring a new action with a large scope and there is a lot of content to initially label and delete.

Other recent Microsoft Information Governance feature releases

Since September 2020, we have also released several other Microsoft Information Governance and Records Management features, including:

• Yammer retention. Admins can now create retention policies to manage Yammer messages when the Yammer network is in native mode. Yammer retention is rolling out worldwide now


• Ability to delete an unused record label. Previously, admins could not delete retention labels marked as a record. Now, you can delete these labels if they are not applied to content or used in a policy. This feature is now available worldwide


• Target a Microsoft 365 group policy to only SharePoint or Exchange. Previously, when you had a retention or labeling policy targeting Microsoft 365 groups, the policy would always apply to both the SharePoint site and the Exchange group mailbox associated with the group. Now you can target the retention policy to both or just one location through PowerShell. This feature is rolling out worldwide now


• A modernized accessible user experience. As we continue delivering on our promise of accessibility across all Microsoft’s products, the user interfaces for Microsoft Information Governance and Records Management are now WCAG 2.1 compliant


• SharePoint Syntex content processing integration. Continuing our investments integrating compliance scenarios with SharePoint Syntex intelligence, users can now automatically apply a retention label to content that matches a forms processing model. SharePoint Syntex content processing helps you to automate capture, ingestion, and categorization of content and streamline content-centric processes using Power Automate. A common example is using SharePoint Syntex to process invoices

We hope these announcements make it easier for you to govern your content and use the Microsoft Information Governance and Records Management solutions. We cannot wait for you to try these features! Please let us know in the comments if you have any questions. We would also love to hear how you plan to use these features!

Azure Arc for Security Engineers

by Contributed | May 19, 2021 | Technology

This article is contributed. See the original author and article here.

Azure Arc and the Azure control plane enables Security Engineers to take care of Cloud Governance and make sure that their hybrid and multi cloud environment are configured in a secure and compliant state. 
In this blog post, we are going to have a look at Azure Arc for Security Engineers. Azure Arc allows you to extend Azure management and Azure services to anywhere. Meaning that you can manage and govern resources running across hybrid and multi cloud environments, and bring services such as Azure SQL Database and Azure PostgreSQL Hyperscale to your on-premise datacenter, edge location, or other cloud providers. Since Azure Arc can help in many different scenarios. I wanted to summarize how Security Engineers, IT Administrators, IT Operators can take advantage of Azure Arc.

Azure Arc

Azure Arc simplifies governance and management by delivering a consistent multi-cloud and on-premises management platform. Azure Arc enables you to manage your entire environment, with a single pane of glass, by projecting your existing resources into Azure Resource Manager. You can now manage virtual machines, Kubernetes clusters, and databases as if they are running in Azure. Regardless of where they live, you can use familiar Azure services and management capabilities. Azure Arc enables you to continue using traditional ITOps, while introducing DevOps practices to support new cloud-native patterns in your environment.

Azure Arc Management Overview

This provides you with a single control plane for your hybrid and multicloud environment.

Azure Arc for Security Engineers

Let’s have a look at some key Azure Arc scenarios for Security Engineers.

Use the Azure Portal to gain central visibility

In hybrid and multicloud environments, it can be difficult for Security Engineers to get a central view of all the resources they need to manage. Some of these resources are running in Azure, some on-premises, at branch offices, or even at other cloud providers. By connecting resources to the Azure Resource Manager using Azure Arc, Security Engineers can get central visibility of a wide range of resources including Windows and Linux servers, SQL server, Kubernetes clusters, and Azure services running in Azure and outside of Azure.

Azure Arc and Azure resources in the Azure Portal

Organization and Inventory

The single control plane using Azure Resource Manager lets you organize and inventory assets through a variety of Azure scopes, such as management groups, subscriptions, resource groups, and tags.

Azure Arc Tagging

Azure Resource Graph

Establish central visibility in the Azure portal and enable multi-environment search with Azure Resource Graph. This allows you to run queries against the Azure resource graph and provide you with a centralized view of all your resources running in Azure and outside of Azure.

Manage Access

As a Security Engineer, you want to make sure that only people who need to have access can access to these systems. You can delegate access and manage security policies for resources using role-based access control (RBAC) in Azure. With Azure Arc enabled servers, we are seeing customers removing the local access for administrators and only provide them access to the system in the Azure portal using Azure Arc and Azure Management services. If you run in multiple environments and tenants, Azure Arc also integrated perfectly in Azure Lighthouse. Azure Lighthouse is especially interesting for managed services providers.

Role-based Access Control

Update Management

As a Security Engineer, one of your jobs is to make sure that all the systems have the latest updates and patches installed to protect against vulnerabilities. Often customers spend hours orchestrating or deploying patched or building automation for their patch management. With Update Management you can manage operating system updates for your Windows and Linux servers. It allows you to schedule and automate patching for your servers.

Update Management

Monitoring

You do not just want to manage your systems; you also want to monitor them and make sure that you get alerted in case anything is happening which you disrupted your environment and applications. You can monitor your Kubernetes clusters and containers, Linux, and Windows Servers. Azure Monitor provides you with monitoring guest operating system performance and discover application components to monitor their processes and dependencies with other resources the application communicates using VM insights.

Monitoring

One of the great features in Azure Monitor which can help Security Engineers is the Microsoft Dependency agent. This provides you with information about the incoming and outgoing connections to a specific server.

Azure Monitor Map

Log collection and analytics

Log collection and analytics can be very helpful to a Security Engineer in many ways. With Azure Log Analytics you can collect, sort, filter, and analyze your logs centrally. It allows Security Engineers to get a central view of all the security logs of the systems they manage. These logs can also be used for thread hunting using Azure Sentinel.

Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.

Change Tracking and Inventory

With change tracking and inventory, you can get an overview of the changes happening in your environment and get an inventory of software installed on your Windows and Linux servers.

Change Tracking and Inventory

Certificate Management

You might have managed certificates on your servers using Active Directory and Group Policies for your local environment. In hybrid cloud or mutlicloud environments, servers are often not even domain joined. That can make managing certificates a challenge. With a combination of the Azure AD Managed Identity assigned by the Azure Arc agent and Azure Key Vault you can easily and securely deploy and manage certificates to your Windows and Linux servers.

Security Center

Making sure that your servers and Kubernetes clusters are secured is often a challenging task, especially in a hybrid or multicloud environment. With Azure Security Center you get threat detection and proactively monitor for potential security threats for your Azure Arc resources. It allows you to deploy Azure Defender for servers and Azure Defender for Kubernetes to your hybrid and multicloud resources.

Security Center

Get compliance state

As an IT Pro you want to know if your servers or Kubernetes clusters are compliant with the company policies. Or you are even in charge to make sure that all your systems are configured correctly and secure. This is where Azure Policy Guest Configuration on your Azure Arc enabled servers can help you to make sure that everything is compliant.

Azure Policy

Next steps

• 
  

  Learn more about Arc enabled servers, see the following overview

  
  


• 
  

  Learn more about Arc enabled Kubernetes, see the following overview

  
  


• 
  

  Learn more about Arc enabled data services, see the following overview

  
  


• 
  

  Experience Arc enabled services from the Jumpstart proof of concept

  
  

Also, check out my video on how to manage your hybrid cloud using Azure Arc on Microsoft Channel 9.

https://channel9.msdn.com/Shows/IT-Ops-Talk/Manage-your-hybrid-cloud-environment-using-Azure-Arc/player?WT.mc_id=modinfra-23498-thmaure

Conclusion

Azure Arc enables Security Engineers and others with the right tooling to manage and operate hybrid and multicloud resources such as Windows and Linux servers, Kubernetes clusters, and other resources. If you have any questions, feel free to leave a comment below.