Microsoft 365 updates for better enterprise data privacy

Microsoft has announced new privacy controls for Microsoft 365 enterprise customers: they will be able to revoke access to encrypted emails, block sensitive information from being shared or leaked when using Teams, use new data investigation capabilities, and improve compliance.

These new features come at the same time as new steps to increase customers’ transparency and control over their data.

“We’ve realized that customers want a simpler experience – information should be easier to find, easier to understand, and easier to act on through the tools we provide,” said Julie Brill, Microsoft’s Corporate VP and Deputy General Counsel.

In order to provide that, Microsoft will:

• Categorize the data they collect as either “required” or “optional”, and allow customers to choose whether the want the latter to be collected at all.
• Improve the documentation for their major products and services, make it easier to find and understand.
• Release a privacy report two times a year, which will point out changes to Microsoft’s data collecting practices, especially when made in response to new privacy laws, industry standards and regulations.

The new controls

The new controls are available only to the E5 customer tier, the only one that includes audio conferencing, phone system, advanced threat protection, cloud app security, and advanced compliance features.

From now on, admins will be able to automatically expire or revoke access to encrypted emails sent outside the organization and to block sensitive information from being leaked in chat messages and channel conversations.

“[The blocking feature] helps limits the disclosure of information by controlling communication between the holders of information and colleagues representing different interests, for example, in Firstline worker scenarios. This is particularly helpful for organizations that need to adhere to ethical walls requirements and other related industry standards and regulations,” Microsoft says.

Another new capability (still in Preview, though) is data investigation. Admins will now be able to quickly investigate security and privacy incidents and take action to remediate the risk.

“For example, in the event of a data leak, you can create an investigation to search and identify impacted content or people, then delete the email messages that may contain confidential information to prevent end users from accessing the content,” Microsoft explains.

The company now also offers new Compliance Manager features, which allow compliance officers to use it as a centralized tool for collaborating with stakeholders, collecting evidence and prepare for audit reports in a secure and compliant cloud environment.