CLD206x Compliance in Office 365: Data Governance

Transcription

1 CLD206x Compliance in Office 365: Data Governance Student Lab Manual WARNING Be prepared for Office 365 UI changes Given the dynamic nature of Microsoft cloud tools, you may experience Office 365 user interface (UI) changes that were made following the development of this training content that either do not match up with lab instructions or with the screen shots presented in this lab. The Microsoft Learning and Readiness team will update this training course as soon as any such changes are brought to our attention. However, given the dynamic nature of cloud updates, you may run into UI changes before this training content is updated. If this occurs, you will have to adapt to the changes and work through them in the labs as needed. Page 1

2 Module 2 Lab Implementing Data Governance Exercise 1 - Sign Up for a free Trial Tenant The lab exercises in this course access a Microsoft demonstration environment for Contoso, Ltd. To access this demo environment, you must first sign up for a free trial tenant account, during which you will enter a unique Contoso Office 365 trial tenant name in the following format: ContosoXXXXXX The Office 365 sign-up wizard will warn you if the tenant name that you enter is not unique, in which case you must choose another number or prefix until it is unique. During the labs, you will see many references to ContosoXXXXXX, where XXXXXX is your unique Contoso Office 365 trial tenant name. You will need to replace this XXXXXX value with the unique value that you entered for your trial tenant account. WARNING: The steps in the lab exercises will fail if you just copy and paste the commands referencing ContosoXXXXXX from this Student Lab Manual into the lab interface; instead, you must replace XXXXXX with the value you choose to make your tenant name unique. For example, let s assume you choose to make your Contoso trial tenant name a combination of your initials plus today s date. If your name is John Doe and the date is Oct 31, 2016, you could enter ContosoJD This comes into play when you sign into the Office portal as a specific user account. Since the lab instructions will direct you to sign in with your ContosoXXXXXX tenant name, you would sign in Perform the following steps to create your Office 365 Enterprise E5 trial tenant account: 1. Using your favorite supported web browser, go to the Microsoft product page for Office 365 Enterprise E5 at 2. In the middle of the page, below the Contact sales area, click Free trial. Page 2

3 3. In the Welcome, let s get to know you page, complete the following fields. Regardless of your location, use the following information: Country: United States First name: Ramiro Last name: Armenta Business address: Use your own personal account Business phone number: Use your mobile phone number, including international code for your current country. Company name: Contoso, Ltd. Organization size: people 4. Click Next. 5. In the Create your user ID page, you must create a unique domain for the Company name to use in the course. Enter a unique Office 365 name as outlined in the introduction of this lab manual. User name: admin Company name: ContosoXXXXXX (where XXYYZZ is your unique Contoso Office 365 trial tenant name; write down the value that you enter for future reference) NOTE: Once you enter the Company name and step off the field, the system will validate whether the trial tenant name that you entered is unique. If so, it will display a green check mark indicating that you can proceed. 6. For the rest of the fields, use the following information: Password: Pa$$w0rd Confirm password: Pa$$w0rd 7. Click Create my account. 8. On the Prove. You re. Not. A. Robot. page, you must confirm your identity by using your mobile phone. a. Select Text me (if it s not already selected). b. From the drop-down box, select the code for the country that you are now in. c. In the Phone number box, enter your correct mobile phone number. IMPORTANT: The phone number that you enter must be able to receive text messages. When you click Text me in the next step, the system will attempt to send a text message to this phone number. The message will contain a verification code that you must enter into the system so that it can validate your account and create your trial tenant. d. Click Text me. 9. When you receive the confirmation text on your mobile phone, enter the code provided in the Enter your verification code box and click Next. 10. Once your new Office 365 tenant is provisioned, the Save this info. You ll need it later. page is displayed, which contains the link to the sign-in page as well as your user ID. a. If you have not already done so, write down the value of your tenant name (ContosoXXXXXX) for future reference. b. Click You re ready to go 11. The Office 365 page should appear. Click on the user ID that you just created for Ramiro Armenta. This will open Office 365 for Ramiro s tenant account. 12. You have completed the steps to provision your trial tenant account. Leave your web browser on Ramiro s Office 365 home page and proceed to the next exercise. Page 3

4 Exercise 2 Enable an Archive mailbox Now that you have provisioned your free trial tenant, you must create several Contoso user accounts that will be used throughout the remaining lab exercises. IMPORTANT: If you closed your web browser prior to completing all the lab exercises, sign back in to Office 365 at the following URL using Ramiro Armenta s tenant account that you created in the prior exercise: If this link to the Admin portal automatically signs you in under a different account, then sign out and sign back in using Ramiro Armenta s tenant account. 1. On the Office 365 page, if a Say hello to the app launcher dialog box is displayed, close it now. 2. Click the Admin tile to go to the Office 365 admin center. 3. Close the Welcome to the new Office 365 admin center dialog box. 4. On the Home page of the Office 365 Admin Center, in the Users group, click Add a user. 5. On the New User page, create a user record for Tasha Blackburn. a. First name: Tasha b. Last name: Blackburn c. Display name: Tasha Blackburn (this should display automatically once you tab off the Last name field) d. User name: Tasha e. Location: select your company location 6. Click on Password to display the password settings. 7. Select the Let me create the password option, and then enter Pa$$word in the Password field. 8. Un-check the box that says: Make this user change their password when they first sign in. 9. You do not need to update the Roles or Product licenses fields, since default values are already assigned that are appropriate. 10. Click Add. 11. On the User was added page, enter your actual, real-life address and then click Send and Close. 12. Verify that you receive an from the Microsoft Online Services Team that displays Tasha s username and password. Verify that the password that you entered for Tasha s account is correct. 13. In the dialog box that asks you to take a minute to answer a survey question, click Cancel. 14. On the Office 365 Admin Center Home page, click on Admin Centers in the lower left navigation bar to expand it (or if a list of icons are instead displayed on the left navigation bar, click on the last icon, which represents the Admin Centers), and then click Exchange. 15. In the Exchange Admin Center, in the left-hand column, click recipients. 16. The current list of mailbox recipients is displayed, which should include Tasha s account that you just created. Click on Tasha Blackburn. 17. The detailed information for Tasha s mailbox should display in the right-hand column. In this Tasha Blackburn pane, scroll down to the In-Place Archive section. This section shows Page 4

5 that Archiving is currently Disabled. Click on Enable to enable archiving for Tasha s mailbox. Select Yes in the Warning dialog box. 18. In the list of mailbox recipients in the Exchange admin center, notice that the mailbox type for Tasha Blackburn changed from User to User(Archive). 19. Leave your web browser on the Exchange Admin Center and proceed to the next exercise. Exercise 3 - Create a Retention Tag in the Exchange Admin Center 1. After completing the prior exercise, you should still be in the recipients section of the Exchange Admin Center. 2. In the left-hand column, click on compliance management. 3. On the menu bar on the top of the page, click on the retention tags tab. 4. On the toolbar, click the + sign. In the drop-down menu, select Applied by users to items and folders (personal). 5. In new tag applied by users to items and folders (personal) window, under Name, enter 3 Year Move Archive after three years. 6. Under Retention Action, select the Move to Archive option. 7. Under Retention period, select the When the item reaches the following age (in days) option, and enter 1095 in the retention period field. 8. Click Save. Exercise 4 - Create a Retention Policy in the Exchange Admin Center 1. After completing the prior exercise, you should still be in the compliance management section of the Exchange Admin Center; if not, navigate here now. 2. On the menu bar on the top of the page, click on the retention policies tab. 3. On the toolbar, click the + sign. 4. In New retention policy window, under Name, enter Office Retention Policy. 5. Under Retention tags, click the + sign. 6. Click the tag starting with 3 Year Move (the column width will truncate the displayed name), click Add, and then click OK. 7. On the new retention policy window, click Save. 8. In the Exchange Admin Center, in the left-hand column, click on recipients. 9. In the list of recipient mailboxes, select Tasha Blackburn and then click on the pencil icon in the toolbar to edit the properties of Tasha s mailbox. 10. In the Tasha Blackburn properties window, click on mailbox features. If a Warning dialog box appears that indicates the user hasn t logged on to the mailbox yet, click OK. 11. Click the drop-down arrow in the Retention Policy field and select Office Retention Policy. 12. Click on Save. Page 5

6 Exercise 5 - Create a Custom Data Loss Prevention Policy in the Exchange Admin Center 1. After completing the prior exercise, you should still be in the recipients section of the Exchange Admin Center. 2. In the left-hand column, click on compliance management. 3. On the menu bar on the top of the page, click on the data loss prevention tab. 4. On the toolbar, click the + sign. In the drop-down menu, select New custom DLP Policy. 5. In the new custom DLP policy window, in the Name field, type IP address block. 6. In the Choose a mode for the requirements in this DLP policy section, select Enforce, and then click save. 7. The IP address book policy that you just created now appears in the list of DLP policies. Click on the IP address book policy and then click the pencil icon (Edit) in the toolbar. 8. In the IP address book window, click rules. 9. Click the + sign in the toolbar. In the drop-down menu, select Block messages with sensitive information. 10. In the new rule window, on the right-hand column, select the Outside the organization link. 11. In the select recipient location window, click on the drop-down arrow and select Inside the organization, and then click OK. 12. In the new rule window, on the right-hand column, select Select sensitive information types. 13. In the Contains any of these sensitive information types window, click the + sign on the toolbar. 14. In the Sensitive information types window, scroll down the list and select IP Address. Click add, and then click OK twice. 15. In the new rule window, in the Do the following field, click the drop-down arrow and select Generate incident report and send it to. 16. To the right of the Do the following field, click the Select one link. In the Select Members window, select Ramiro Armenta (your administrator), and then click OK. 17. To the right of the Do the following field, click the Custom content link. 18. In the Include message properties window, select recipients and original mail, and then click OK. 19. To the right of the Do the following field, click the Block the message link. 20. In the notify the sender with a Policy Tip window, click the drop-down arrow and select Block the message. In the Enter the message for the NDR that users will receive text box, type Your message is blocked. Click OK. 21. In the new rule window, scroll down and under Choose a mode for this rule, select the Enforce option. 22. Select the Activate this rule on the following date check box. Click the drop-down arrow in the date field and click today. 23. Click Save. 24. If you get a warning about the date, just click OK. 25. In IP address book window, click Save. Exercise 6 - Create a Data Loss Prevention Policy by template in the Exchange Admin Center Page 6

7 1. After completing the prior exercise, you should still be in the data loss prevention tab of the compliance management section of the Exchange Admin Center; if not, navigate here now. 2. Click the + sign in the toolbar. In the drop-down menu, select New DLP policy from template. 3. In the DLP policy from template window, in the Name field, type Prevent financial data flow. 4. In the Choose a template field, scroll down and select U.S. Financial Data. 5. Click Save. 6. In the Exchange admin center, in the list of DLP policies, select the Prevent financial data flow policy, and then click the pencil icon (Edit). 7. In the Prevent financial data flow window, the general tab in the left-hand column is displayed by default. In the Choose a mode for the requirements in this DLP policy section, select Enforce. 8. In the left-hand column, click rules. 9. In the list of rules, select U.S. Financial: Scan sent outside high count, and then click the pencil icon (Edit). 10. In the U.S. Financial: Scan sent outside high count window, click the down arrow in the Do the following field. In the drop-down list, select Block the message, and then in the menu box that appears to the right, select reject the message and include an explanation. 11. In the specify rejection reason window, type This message contains financial information and can t be sent outside the organization. Click OK. 12. Click the add action button. 13. In the Select one field that appears above the add action button, click the drop-down arrow and select Generate incident report and send it to. 14. Click the Select one link to the right of the drop-down list. 15. In the Select Members window, click Ramiro Armenta (your administrator), and then click OK. 16. To the right of the Generate incident report and send it to field, click the Include message properties link. 17. In the Include message properties window, select original mail, and then click OK. 18. In the U.S. Financial: Scan sent outside high count window, scroll down and under Choose a mode for this rule, select the Enforce option. 19. Select the Activate this rule on the following date check box. Click the drop-down arrow in the date field and click today. 20. Click Save. If you get a warning about the date, just click OK. 21. In the Prevent financial data flow window, click Save. 22. In the Exchange admin center, in the toolbar, click the Customize Policy Tips icon. 23. In the Policy Tips window, click the + sign. 24. In the New Policy Tip setting window, click the drop-down arrow in the Policy Tip field and select notify the sender. 25. Click the drop-down arrow in the Locale field and select English. 26. In the Text field, type This message contains information that you are not allowed to send. 27. Click Save, and then click Close. Module 3 Lab Using Data Governance Page 7

8 If you did not complete the exercises in the Module 2 lab, you must do so now before proceeding with the Module 3 lab exercises. Exercise 1 - Use Archiving While the retention policy assigned to a mailbox is automatically applied to its received messages, a user can override this default parent folder policy by creating a custom retention policy and assigning it to selected messages. In this exercise, you will send an from Ramiro Armenta to Tasha Blackburn. You will then log into Office 365 as Tasha, locate the in her Inbox, and then assign the a custom retention policy that you create. 1. Sign into Office 365 ( You should still be signed into Office 365 as Ramiro Armenta. However, if you previously signed out of Office 365, then on the Office 365 sign-in page, sign in to Ramiro s admin@contosoxxxxxx.onmicrisoft.com account using a password of Pa$$w0rd. 2. On the Office 365 page, click on the Mail tile to open Outlook on the Web. 3. If this is the first time you use mail for this user, you will be prompted to provide a Language and Time zone. Choose the appropriate language and time zone and then click Save. 4. Create a new by clicking on the New button. 5. Enter Tasha on the To line. If the Tasha Blackburn account is displayed, select it now; otherwise, select Search Directory, and then select Tasha s account. 6. Enter Archive Test in the Subject line. 7. Enter Use this to test archiving in the body of the Click Send. 9. You should now sign out of Office 365 for Ramiro. Click on the user icon in the upper right corner of the toolbar, and in the drop down menu that appears, click Sign out. 10. Sign into Office 365 ( using the Tasha Blackburn account that you created in the Module 2 lab. On the Office 365 sign-in page, select Tasha s account from the user list that s displayed. If Tasha s account does not appear in the list of users on the sign-in portal, click Use another account, and then enter tasha@contosoxxxxxx.onmicrisoft.com (where XXXXXX is replaced with your trial tenant) and a password of Pa$$w0rd. 11. Outlook on the Web may automatically open for Tasha; however, if the Office 365 Home page is returned instead, then click on the Mail tile to open Outlook on the Web. If this is the first time you use mail for this user, you will be prompted to provide a Language and Time zone. Choose the appropriate language and time zone and then click Save. 12. In Tasha s Inbox, you should see the message that Ramiro just sent to Tasha. Note: Back when you created Tasha s mailbox in the Module 2 lab, you enabled her mailbox for archiving, and you assigned the retention policy titled Office Retention Policy to her mailbox. This policy included the 3 Year Move Archive after three years retention tag. While this policy will be applied by the Managed Folder Assistant to all the received messages in Tasha s mailbox, she has decided to override this policy for the message that she just received from Ramiro. Since this message was somewhat meaningless to her, Tasha has Page 8

9 decided to archive it sooner than 3 years. She will do this by creating a custom, personal retention policy and assigning it a retention tag that archives messages after 1 year. 13. Perform the following steps to create a custom retention policy: a. Click on the Settings icon in the upper right corner of the toolbar (this is the gearshaped icon). b. In the drop-down menu that appears, scroll to the bottom of the menu, and under the Your app settings section, click on Mail. c. In the Options pane that appears on the left-hand side of the screen, under Mail Automatic processing, click on Retention policies. d. Click on the + to add a custom retention policy. e. Select the Personal 1 year move to archive retention tag and click Add. f. Click Save at the top of the screen. 14. Perform the following steps to assign the custom retention policy to a selected message: a. In the Options pane, click on Options in the top left corner to return to Tasha s mailbox. b. In the Inbox, right click on the message that she received from Ramiro with the subject: Archive Test. c. In the menu that appears, click on Assign Policy. In the Assign Policy menu, under Archive Policy, select Personal 1 year move to archive (1year). This personal retention policy will now override the parent folder policy for this specific message, which will be moved to Tasha s In-Place archive mailbox after 1 year rather than 3 years. Note: If you want to assign a personal retention policy to multiple messages at one time, you should select the messages to be updated in your Inbox, and then click on the ellipses ( ) icon on the ribbon at the top. This allows you to select the same Assign policy option, from which you can select the custom retention policy to be applied to the selected messages. 15. Remain signed in to Office 365 as Tasha. Exercise 2 - Send sensitive s In the Module 2 lab, you created a Data Loss Prevention policy that blocked messages containing IP addresses. This exercise will test that DLP policy. 1. If you signed out of Office 365, sign back using the Tasha Blackburn account that you created in the Module 2 lab. If the Tasha account does not appear in the list of users on the sign-in portal, click Use another account, and then enter tasha@contosoxxxxxx.onmicrisoft.com (where XXXXXX is replaced with your trial tenant) and a password of Pa$$w0rd. 2. If Outlook on the Web opens, then go to the next step. However, if the Office 365 page appears, then click on the Mail tile to open Outlook on the Web. Page 9

10 3. Create a new by clicking on the New button. 4. Enter Ramiro on the To line. If the Ramiro Armenta account is displayed, select it now; otherwise, select Search Directory, and then select Ramiro s account. 5. Enter IP address test 1 in the Subject line. 6. Enter in the body of the Click Send. 8. You should receive an from Office 365 saying that your message could not be delivered because of a custom mail flow rule. 9. Create another new by clicking on the New button. 10. Enter Ramiro once again on the To line and select the Ramiro Armenta account. 11. Enter IP address test 2 in the Subject line. 12. Enter in the body of the On the toolbar at the top of the page, click on the ellipsis icon ( ) to the right of Discard, and then click Save Draft in the menu that appears. 14. You should notice a warning message above the To line that the message violates a policy. 15. Now click Send. 16. Notice the warning message that the message includes one or more recipients who aren t authorized to receive sensitive information. Click OK. 17. Click Discard. In the Discard message dialog box, click Discard again. 18. Sign out of Office 365 by clicking on the top right user profile icon and then clicking on Sign out. Exercise 3 - Review incident reports 1. Sign into the Office 365 ( using the Ramiro Armenta account that you created in the Module 2 lab (admin@contosoxxxxxx.onmicrisoft.com; where XXXXXX is replaced with your trial tenant) and a password of Pa$$w0rd. 2. If Outlook on the Web opens, then go to the next step. However, if the Office 365 page appears, then click on the Mail tile to open Outlook on the Web. 3. In the list of messages in the Inbox, locate the message from Microsoft Outlook called Rule detected: Sent to scope Inside the organization. Click on this message to view it. 4. Notice that this notification includes as an attachment the original message (subject: IP address test 1) that contained the IP address. Click on this attached to open it. After verifying that this is the message with the IP address, close the window displaying the attachment. 5. The notification from Microsoft Outlook can now be printed or saved for evidence regarding the incident. Close the notification Sign out of Office 365 by clicking on the top right user profile icon and then clicking on Sign out. Page 10