Build a Data Classification MVP for M365
Kickstart your governance with data classification users will actually use!
- Resources are the primary obstacle to getting a foot hold in O365 governance, whether it is funding or FTE resources.
- Data is segmented and is difficult to analyze when you can’t see it or manage the relationships between sources.
- Organizations expect results early and quickly and a common obstacle is that building a proper data classification framework can take more than two years and the business can't wait that long.
Our Advice
Critical Insight
- Data classification is the lynchpin to ANY effective governance of O/M365 and your objective is to navigate through this easily and effectively and build a robust, secure, and viable governance model.
- Start your journey by identifying what and where your data is and how much data you have. You need to understand what sensitive data you have and where it is stored before you can protect it or govern that data.
- Ensure there is a high-level leader who is the champion of the governance objective.
Impact and Result
- Using least complex sensitivity labels in your classification are your building blocks to compliance and security in your data management schema; they are your foundational steps.
Build a Data Classification MVP for M365 Research & Tools
1. Build a Data Classification MVP for M365 Deck – A guide for how to build a minimum-viable product for data classification that end users will actually use.
Discover where your data resides, what governance helps you do, and what types of data you're classifying. Then build your data and security protection baselines for your retention policy, sensitivity labels, workload containers, and both forced and unforced policies.
Build a Data Classification MVP for M365
Kickstart your governance with data classification users will actually use!
Executive Summary
Info-Tech Insight
- Creating an MVP gets you started in data governance
Information protection and governance are not something you do once and then you are done. It is a constant process where you start with the basics (a minimum-viable product or MVP) and enhance your schema over time. The objective of the MVP is reducing obstacles to establishing an initial governance position, and then enabling rapid development of the solution to address a variety of real risks, including data loss prevention (DLP), data retention, legal holds, and data labeling. - Define your information and protection strategy
The initial strategy is to start looking across your organization and identifying your customer data, regulatory data, and sensitive information. To have a successful data protection strategy you will include lifecycle management, risk management, data protection policies, and DLP. All key stakeholders need to be kept in the loop. Ensure you keep track of all available data and conduct a risk analysis early. Remember, data is your highest valued intangible asset. - Planning and resourcing are central to getting started on MVP
A governance plan and governance decisions are your initial focus. Create a team of stakeholders that include IT and business leaders (including Legal, Finance, HR, and Risk), and ensure there is a top-level leader who is the champion of the governance objective, which is to ensure your data is safe, secure, and not prone to leakage or theft, and maintain confidentiality where it is warranted.
Executive Summary
Your Challenge
|
Common Obstacles
Data governance has several obstacles that impact a successful launch, especially if governing M365 is not a planned strategy. Below are some of the more common obstacles:
|
Info-Tech’s Approach
|
Info-Tech Insight
Data classification is the lynchpin to any effective governance of O/M365 and your objective is to navigate through this easily and effectively and build a robust, secure, and viable governance model. Start your journey by identifying what and where your data is and how much data do you have. You need to understand what sensitive data you have and where it is stored before you can protect or govern it. Ensure there is a high-level leader who is the champion of the governance objectives. Data classification fulfills the governance objectives of risk mitigation, governance and compliance, efficiency and optimization, and analytics.
Questions you need to ask
Four key questions to kick off your MVP.
1Know Your DataDo you know where your critical and sensitive data resides and what is being done with it?Trying to understand where your information is can be a significant project. |
2Protect Your DataDo you have control of your data as it traverses across the organization and externally to partners?You want to protect information wherever it goes through encryption, etc. |
3Prevent Data LossAre you able to detect unsafe activities that prevent sharing of sensitive information?Data loss prevention (DLP) is the practice of detecting and preventing data breaches, exfiltration, or unwanted destruction of sensitive data. |
4Govern Your DataAre you using multiple solutions (or any) to classify, label, and protect sensitive data?Many organizations use more than one solution to protect and govern their data, making it difficult to determine if there are any coverage gaps. |
Classification tiers
Build your schema.
Info-Tech Insight
Deciding on how granular you go into data classification will chiefly be governed by what industry you are in and your regulatory obligations – the more highly regulated your industry, the more classification levels you will be mandated to enforce. The more complexity you introduce into your organization, the more operational overhead both in cost and resources you will have to endure and build.
Microsoft MIP Topology
Microsoft Information Protection (MIP), which is Microsoft’s Data Classification Services, is the key to achieving your governance goals. Without an MVP, data classification will be overwhelming; simplifying is the first step in achieving governance.
(Source: Microsoft, “Microsoft Purview compliance portal”)
Info-Tech Insight
Using least-complex sensitivity labels in your classification are your building blocks to compliance and security in your data management schema; they are your foundational steps.
MVP RACI Chart
Data governance is a "takes a whole village" kind of effort.
Clarify who is expected to do what with a RACI chart.
| End User | M365 Administrator | Security/ Compliance | Data Owner | |
| Define classification divisions | R | A | ||
| Appy classification label to data – at point of creation | A | R | ||
| Apply classification label to data – legacy items | R | A | ||
| Map classification divisions to relevant policies | R | A | ||
| Define governance objectives | R | A | ||
| Backup | R | A | ||
| Retention | R | A | ||
| Establish minimum baseline | A | R |
What and where your data residesData types that require classification. |
|
| M365 Workload Containers | |||
|
 
|
|
|
Email
|
Site Collections, Sites | Sites | Project Databases |
| Contacts | Teams and Group Site Collections, Sites | Libraries and Lists | Sites |
| Metadata | Libraries and Lists | Documents
|
Libraries and Lists |
| Teams Conversations | Documents
|
Metadata | Documents
|
| Teams Chats | Metadata | Permissions
|
Metadata |
Permissions
|
Files Shared via Teams Chats | Permissions
|
|
Info-Tech Insight
Knowing where your data resides will ensure you do not miss any applicable data that needs to be classified. These are examples of the workload containers; you may have others.
Discover and classify on- premises files using AIP
AIP helps you manage sensitive data prior to migrating to Office 365:
|
|
Azure Information Protection scanner helps discover, classify, label, and protect sensitive information in on-premises file servers. You can run the scanner and get immediate insight into risks with on-premises data. Discover mode helps you identify and report on files containing sensitive data (Microsoft Inside Track and CIAOPS, 2022). Enforce mode automatically classifies, labels, and protects files with sensitive data. |
Info-Tech Insight
Any asset deployed to the cloud must have approved data classification. Enforcing this policy is a must to control your data.
Understanding governance
Microsoft Information Governance
Information Governance
|
Records Management
|
| Retention and Deletion
‹——— Connectors for Third-Party Data ———› |
|
| Information governance manages your content lifecycle using solutions to import, store, and classify business-critical data so you can keep what you need and delete what you do not. Backup should not be used as a retention methodology since information governance is managed as a “living entity” and backup is a stored information block that is “suspended in time.” | Records management uses intelligent classification to automate and simplify the retention schedule for regulatory, legal, and business-critical records in your organization. It is for that discrete set of content that needs to be immutable. |
Retention and backup policy decision
Retention is not backup.
Info-Tech InsightRetention is not backup. Retention means something different: “the content must be available for discovery and legal document production while being able to defend its provenance, chain of custody, and its deletion or destruction” (AvePoint Blog, 2021). |
|
Understand retention policy
What are retention policies used for? Why you need them as part of your MVP?
Do not confuse retention labels and policies with backup.
Remember: “retention [policies are] auto-applied whereas retention label policies are only applied if the content is tagged with the associated retention label” (AvePoint Blog, 2021).
E-discovery tool retention policies are not turned on automatically.
Retention policies are not a backup tool – when you activate this feature you are unable to delete anyone.
“Data retention policy tools enable a business to:
- “Decide proactively whether to retain content, delete content, or retain and then delete the content when needed.
- “Apply a policy to all content or just content meeting certain conditions, such as items with specific keywords or specific types of sensitive information.
- “Apply a single policy to the entire organization or specific locations or users.
- “Maintain discoverability of content for lawyers and auditors, while protecting it from change or access by other users. […] ‘Retention Policies’ are different than ‘Retention Label Policies’ – they do the same thing – but a retention policy is auto-applied, whereas retention label policies are only applied if the content is tagged with the associated retention label.
“It is also important to remember that ‘Retention Label Policies’ do not move a copy of the content to the ‘Preservation Holds’ folder until the content under policy is changed next.” (Source: AvePoint Blog, 2021)
Definitions
Data classification is a focused term used in the fields of cybersecurity and information governance to describe the process of identifying, categorizing, and protecting content according to its sensitivity or impact level. In its most basic form, data classification is a means of protecting your data from unauthorized disclosure, alteration, or destruction based on how sensitive or impactful it is.
Once data is classified, you can then create policies; sensitive data types, trainable classifiers, and sensitivity labels function as inputs to policies. Policies define behaviors, like if there will be a default label, if labeling is mandatory, what locations the label will be applied to, and under what conditions. A policy is created when you configure Microsoft 365 to publish or automatically apply sensitive information types, trainable classifiers, or labels.
Sensitivity label policies show one or more labels to Office apps (like Outlook and Word), SharePoint sites, and Office 365 groups. Once published, users can apply the labels to protect their content.
Data loss prevention (DLP) policies help identify and protect your organization's sensitive info (Microsoft Docs, April 2022). For example, you can set up policies to help make sure information in email and documents is not shared with the wrong people. DLP policies can use sensitive information types and retention labels to identify content containing information that might need protection.
Retention policies and retention label policies help you keep what you want and get rid of what you do not. They also play a significant role in records management.
Data examples for MVP classification
- Examples of the type of data you consider to be Confidential, Internal, or Public.
- This will help you determine what to classify and where it is.
Internal Personal, Employment, and Job Performance Data
|
Confidential Information
|
Internal Data
|
Public Data
|
New container sensitivity labels (MIP)
New container sensitivity labels
| Public | Private | |
| Privacy |
|
|
| Allowed | Not Allowed | |
| External guest policy |
|
|
What users will see when they create or label a Team/Group/Site
(Source: Microsoft, “Microsoft Purview compliance portal”)
Info-Tech Insights
Why you need sensitivity container labels:- Manage privacy of Teams Sites and M365 Groups
- Manage external user access to SPO sites and teams
- Manage external sharing from SPO sites
- Manage access from unmanaged devices
Data protection and security baselines
| Data Protection Baseline
“Microsoft provides a default assessment in Compliance Manager for the Microsoft 365 data protection baseline" (Microsoft Docs, June 2022). This baseline assessment has a set of controls for key regulations and standards for data protection and general data governance. This baseline draws elements primarily from NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) and ISO (International Organization for Standardization) as well as from FedRAMP (Federal Risk and Authorization Management Program) and GDPR (General Data Protection Regulation of the European Union). |
Security Baseline
The final stage in M365 governance is security. You need to implement a governance policy that clearly defines storage locations for certain types of data and who has permission to access it. You need to record and track who accesses content and how they share it externally. “Part of your process should involve monitoring unusual external sharing to ensure staff only share documents that they are allowed to” (Rencore, 2021). |
Info-Tech Insights
- Controls are already in place to set data protection policy. This assists in the MVP activities.
- Finally, you need to set your security baseline to ensure proper permissions are in place.
Prerequisite baseline
Security MFA or SSO to access from anywhere, any device Banned password list BYOD sync with corporate network |
Users Sign out inactive users automatically Enable guest users External sharing Block client forwarding rules |
Resources Account lockout threshold OneDrive SharePoint |
Controls Sensitivity labels, retention labels and policies, DLP Mobile application management policy |
Building baselines
Sensitivity Profiles: Public, Internal, Confidential; Subcategory: Highly Confidential
Microsoft 365 Collaboration Protection Profiles
| Sensitivity | Public | External Collaboration | Internal | Highly Confidential |
| Description | Data that is specifically prepared for public consumption | Not approved for public consumption, but OK for external collaboration | External collaboration highly discouraged and must be justified | Data of the highest sensitivity: avoid oversharing, internal collaboration only |
| Label details |
|
|
|
|
| Teams or Site details | Public Team or Site open discovery, guests are allowed | Private Team or Site members are invited, guests are allowed | Private Team or Site members are invited, guests are not allowed | |
| DLP | None | Warn | Block | |
Please Note: Global/Compliance Admins go to the 365 Groups platform, the compliance center (Purview), and Teams services (Source: Microsoft Documentation, “Microsoft Purview compliance documentation”)
Info-Tech Insights
- Building baseline profiles will be a part of your MVP. You will understand what type of information you are addressing and label it accordingly.
- Sensitivity labels are a way to classify your organization's data in a way that specifies how sensitive the data is. This helps you decrease risks in sharing information that shouldn't be accessible to anyone outside your organization or department. Applying sensitivity labels allows you to protect all your data easily.
MVP activities
| PRIMARY ACTIVITIES |
Define Your Governance
The objective of the MVP is reducing barriers to establishing an initial governance position, and then enabling rapid progression of the solution to address a variety of tangible risks, including DLP, data retention, legal holds, and labeling. Decide on your classification labels early. |
CATEGORIZATION
CLASSIFICATION |
MVP | ||||
| Data Discovery and Management
AIP (Azure Information Protection) scanner helps discover, classify, label, and protect sensitive information in on-premises file servers. You can run the scanner and get immediate insight into risks with on-premises data. |
|||||||
| Baseline Setup
Building baseline profiles will be a part of your MVP. You will understand what type of information you are addressing and label it accordingly. Microsoft provides a default assessment in Compliance Manager for the Microsoft 365 data protection baseline. |
|||||||
| Default M365 settings
Microsoft provides a default assessment in Compliance Manager for the Microsoft 365 data protection baseline. This baseline assessment has a set of controls for key regulations and standards for data protection and general data governance. |
|||||||
| SUPPORT ACTIVITIES |
Retention Policy
Retention policy is auto-applied. Decide whether to retain content, delete content, or retain and then delete the content. |
Sensitivity Labels
Automatically enforce policies on groups through labels; classify groups. |
Workload Containers
M365: SharePoint, Teams, OneDrive, and Exchange, where your data is stored for labels and policies. |
Unforced Policies
Written policies that are not enforceable by controls in Compliance Manager such as acceptable use policy. |
Forced Policies
Restrict sharing controls to outside organizations. Enforce prefix or suffix to group or team names. |
||
ACME Company MVP for M/O365
| PRIMARY ACTIVITIES | Define Your Governance
| CATEGORIZATION
CLASSIFICATION | MVP | ||||
| Data Discovery and Management
| |||||||
| Baseline Setup
| |||||||
| Default M365 settings
| |||||||
| SUPPORT ACTIVITIES | Retention Policy
| Sensitivity Labels
| Workload Containers
| Unforced Policies
| Forced Policies
| ||
Related Blueprints
Office 365 is as difficult to wrangle as it is valuable. Leverage best practices to produce governance outcomes aligned with your goals.
Map your organizational goals to the administration features available in the Office 365 console. Your governance should reflect your requirements.
Jumping into an Office 365 migration project without careful thought of the risks of a cloud migration will lead to project halt and interruption. Intentionally plan in order to expose risk and to develop project foresight for a smooth migration.
Remote work calls for leveraging your Office 365 license to use Microsoft Teams – but IT is unsure about best practices for governance and permissions. Moreover, IT has few resources to help train end users with Teams best practicesIT Governance, Risk & Compliance
Several blueprints are available on a broader topic of governance, from Make Your IT Governance Adaptable to Improve IT Governance to Drive Business Results and Build an IT Risk Management Program.
Bibliography
“Best practices for sharing files and folders with unauthenticated users.” Microsoft Build, 28 April 2022. Accessed 2 April 2022.
“Build and manage assessments in Compliance Manager.” Microsoft Docs, 15 June 2022. Web.
“Building a modern workplace with Microsoft 365.” Microsoft Inside Track, n.d. Web.
Crane, Robert. “June 2020 Microsoft 365 Need to Know Webinar.” CIAOPS, SlideShare, 26 June 2020. Web.
“Data Classification: Overview, Types, and Examples.” Simplilearn, 27 Dec. 2021. Accessed 11 April 2022.
“Data loss prevention in Exchange Online.” Microsoft Docs, 19 April 2022. Web.
Davies, Nahla. “5 Common Data Governance Challenges (and How to Overcome Them).” Dataversity. 25 October 2021. Accessed 5 April 2022.
“Default labels and policies to protect your data.” Microsoft Build, April 2022. Accessed 3 April 2022.
M., Peter. "Guide: The difference between Microsoft Backup and Retention." AvePoint Blog, 9 Oct. 2021. Accessed 4 April 2022.
Meyer, Guillaume. “Sensitivity Labels: What They Are, Why You Need Them, and How to Apply Them.” nBold, 6 October 2021. Accessed 2 April 2022.
“Microsoft 365 guidance for security & compliance.” Microsoft, 27 April 2022. Accessed 28 April 2022.
“Microsoft Purview compliance portal.” Microsoft, 19 April 2022. Accessed 22 April 2022.
“Microsoft Purview compliance documentation.” Microsoft, n.d. Accessed 22 April 2022.
“Microsoft Trust Center: Products and services that run on trust.” Microsoft, 2022. Accessed 3 April 2022.
“Protect your sensitive data with Microsoft Purview.” Microsoft Build, April 2022. Accessed 3 April 2022.
Zimmergren, Tobias. “4 steps to successful cloud governance in Office 365.” Rencore, 9 Sept. 2021. Accessed 5 April 2022.
About Info-Tech
Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.
We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.
What Is a Blueprint?
A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.
Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.
Talk to an Analyst
Our analyst calls are focused on helping our members use the research we produce, and our experts will guide you to successful project completion.
Book an Analyst Call on This Topic
You can start as early as tomorrow morning. Our analysts will explain the process during your first call.
Get Advice From a Subject Matter Expert
Each call will focus on explaining the material and helping you to plan your project, interpret and analyze the results of each project step, and set the direction for your next project step.
Unlock Sample ResearchContributors
- Björn Erkens, Product Owner, Rencore governance
Run Better Meetings
Migrate to Office 365 Now
Rationalize Your Collaboration Tools
Implement Desktop Virtualization and Transition to Everything as a Service
Establish a Communication and Collaboration System Strategy
Build a Digital Workspace Strategy
Govern Office 365
Create a Post-Implementation Plan for Microsoft 365
Microsoft Teams Cookbook
2020 Enterprise Collaboration Tools: Market Trends and Buyer’s Guide
Build a Data Classification MVP for M365
Drive Ongoing Adoption With an M365 Center of Excellence