Hybrid - Office 365

Organisation

The ABAC settings for the Agency organisation can be found below. This includes Residency, Licensing and Licensing Manual Groups, Theme, Add-ins and Security and Privacy settings.

Please note, if a setting is not mentioned in the below, it should be assumed to have been left at its default setting.

Residency

Azure Active Directory > Properties

Table 2 describes the Office 365 Region settings.

Microsoft 365 Admin center > Settings > Org settings > Organization profile

Licensing

Microsoft 365 Admin center > Billing

Table 3 describes the Microsoft 365 Licensing settings.

Licensing manual groups

Search > Licenses > Microsoft 365 E5 > Licensed groups

Table 4 describes the configuration for the manual allocation of Microsoft 365 E5 licenses.

Theme

Microsoft 365 Admin Center > Settings > Org settings > Organisation Profile > Custom themes

Table 5 describes the Custom Theme settings.

Endpoint Manager Admin Center > Tenant administration > Customization

• Branding
  • Organization name: <Agency Name>
  • Theme color: #512876
  • Show in header: Organization logo only
  • Upload logo for theme color background: Agency supplied
  • Upload logo for theme color light background: Agency supplied
  • Upload brand image: Agency supplied
• Support information
  • Contact name: <Agency Acronym> IT Service Desk
  • Phone number: <Agency Support Telephone Number>
  • Email address: ITServiceDesk@Agency.gov.au
  • Website name: -
  • Website URL: -
  • Additional information: -
• Configuration
  • Device enrollment: Available, with prompts
  • Privacy messages in Company Portal for iOS/iPadOS: Default
  • Privacy statement URL: -
  • Send a push notification to users when their device ownership type changes from personal to corporate (Android and iOS/iPadOS only): No
  • Hide remove button on corporate Windows devices: Yes
  • Hide reset button on corporate Windows devices: No
  • Hide remove button on corporate iOS/iPadOS devices: No
  • Hide reset button on corporate iOS/iPadOS devices: No

Add-ins

Microsoft 365 Admin Center > Settings > Org settings > Services

Security and privacy

Table 8 describes the Microsoft 365 Security and Privacy settings.

Microsoft 365 admin center > Org Settings > Security & Privacy

Exchange Online

The ABAC settings for the Agency Exchange Online instance can be found below. This includes Connectors, Mail Exchange (MX) Records, SPF, DNS Records, Accepted and Remote Domains, Client Access Services (CAS) Mailbox Plan, Authentication Policy, Outlook Web Access Policy, Mailbox Archive and Auditing, Mail Flow Rules, Journaling, Mailbox Retention, Shared and Resource Mailboxes, Distribution, Dynamic and Office 365 Groups. Please note, if a setting is not mentioned in the below, it should be assumed to have been left at its default setting.

Connectors

Exchange admin center > Mail flow > Connectors

Table 9a describes the Exchange Online inbound mail connectors

Table 9b describes the Exchange Online outbound mail connectors

MX records

Table 10 describes the MX records that have been configured.

These records are not set within Azure or Exchange and have been configured with the hosting provider.

SPF records

Table 11 describes the SPF records have been configured.

These records are not set within Azure or Exchange and have been configured with the hosting provider.

DNS records

Table 12a describes the DNS record settings for Agency.gov.au (default)

Table 12b describes the DNS record settings for Agency.onmicrosoft.com

Accepted domains

Exchange Admin Centre > mail flow > Accepted domains

Table 13 describes the Accepted Domains settings.

Remote domains

Table 14 describes the Remote Domains have been configured.

CAS mailbox plan

Table 15 describes the CAS Mailbox Plans that have been configured. These settings have been configured with PowerShell.

Mailbox attributes

Below describes the Mailbox attribute that have been configured. These settings have been configured with PowerShell.

Exchange Admin Center > recipients > mailboxes > <username> > mailbox features

• Litigation hold: False (configured as true only when required)`

Exchange Admin Center > recipients > mailboxes > <username> > mailbox usage

• Exchange Mailbox Size: 100GB per user

Exchange Admin Center > recipients > mailboxes > three dots > Set default message size restrictions

• Maximum szie for sent messages (KB): 90MB
• Maximum size for received messages (KB): 90MB

Exchange Admin Center > recipients > mailboxes > <username> > email address

• Custom Primary SMTP Addressing: FirstName.LastName@<Agency>.gov.au
• Language: English (en-au)
• Default Time Zone: GMT +10 (AUS Eastern Standard Time)
• Exchange Online PowerShell
  • Disabled for standard users: True

Authentication policy

Table 17 describes the Authentication Policies that have been configured. These settings have been configured using PowerShell.

Outlook Web Access policy

Table 18 describes the Outlook Web Access Policies have been configured. These settings have been configured using PowerShell.

Mailbox archive

Exchange Admin Center > recipients > mailboxes > <username> > mailbox features

Table 19 describes the mailbox archive settings. These settings can only be configured using the On-Premises Exchange Administrator console.

Mailbox auditing

Table 20 describes the mailbox archive settings. These settings have been configured using PowerShell.

User Mailbox and Shared Mailbox Audit Configuration

Mail flow rules

Exchange Admin Centre > mail flow > rules

Disclaimer

• Apply this rule if: The recipient is locked..Outside the organization
• Do the following actions: Append the message with the disclaimer

'<br/>
<br/>
<p style="font-size:8pt; line-height:10pt; font-family: 'Cambria','times roman',serif;">The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.</p>'. 

• If the disclaimer can’t be applied, reject the message.
• ExceptIfSubjectMatchesPatterns: -
• FromScope: -
• HeaderContainsMessageHeader: -
• HeaderContainsWords: -
• Mode: Enforce
• Name: Disclaimer
• PrependSubject: -
• Priority: 0
• SentToScope: NotInOrganization
• State: Enabled

UNOFFICIAL

• If the message: Is sent to Inside the organization and msip_labels header contains MSIP_Label_217258b3-6022-44f0-adb4-d6eca052ad20_Enabled=true and Is received from Inside the organization
• Take the following actions: Prepend the subject with [SEC=UNOFFICIAL]
• Except if the message: Includes these patterns in the message subject: (SEC=UNOFFICIAL)
• ExceptIfSubjectMatchesPatterns: (SEC=UNOFFICIAL)
• FromScope: InOrganization
• HeaderContainsMessageHeader: msip_labels
• HeaderContainsWords: MSIP_Label_217258b3-6022-44f0-adb4-d6eca052ad20_Enabled=true
• Mode: Enforce
• Name: UNOFFICIAL
• PrependSubject: [SEC=UNOFFICIAL]
• Priority: 1
• SentToScope: InOrganization
• State: Enabled

OFFICIAL

• If the message: Is sent to Inside the organization and msip_labels header contains MSIP_Label_8260affa-0595-45d6-a83e-a3b79a9c02c4_Enabled=true and Is received from Inside the organization
• Take the following actions: Prepend the subject with [SEC=OFFICIAL]
• Except if the message: Includes these patterns in the message subject: (SEC=OFFICIAL)
• ExceptIfSubjectMatchesPatterns: (SEC=OFFICIAL)
• FromScope: InOrganization
• HeaderContainsMessageHeader: msip_labels
• HeaderContainsWords: MSIP_Label_8260affa-0595-45d6-a83e-a3b79a9c02c4_Enabled=true
• Mode: Enforce
• Name: OFFICIAL
• PrependSubject: [SEC=OFFICIAL]
• Priority: 2
• SentToScope: InOrganization
• State: Enabled

OFFICIAL:Sensitive

• If the message: Is sent to Inside the organization and msip_labels header contains MSIP_Label_42227f60-6734-42bf-b4e6-da15ab730981_Enabled=true and Is received from Inside the organization
• Take the following actions: Prepend the subject with [SEC=OFFICIAL:Sensitive]
• Except if the message: Includes these patterns in the message subject: (SEC=OFFICIAL:Sensitive)
• ExceptIfSubjectMatchesPatterns: (SEC=OFFICIAL:Sensitive)
• FromScope: InOrganization
• HeaderContainsMessageHeader: msip_labels
• HeaderContainsWords: MSIP_Label_42227f60-6734-42bf-b4e6-da15ab730981_Enabled=true
• Mode: Enforce
• Name: OFFICIAL:Sensitive
• PrependSubject: [SEC=OFFICIAL:Sensitive]
• Priority: 3
• SentToScope: InOrganization
• State: Enabled

PROTECTED

• If the message: Is sent to Inside the organization and msip_labels header contains MSIP_Label_12dcf2ca-f80e-4ac2-861b-4b6557faeea3_Enabled=true and Is received from Inside the organization
• Take the following actions: Prepend the subject with [SEC=PROTECTED]
• Except if the message: Includes these patterns in the message subject: (SEC=PROTECTED)
• ExceptIfSubjectMatchesPatterns: (SEC=PROTECTED)
• FromScope: InOrganization
• HeaderContainsMessageHeader: msip_labels
• HeaderContainsWords: MSIP_Label_12dcf2ca-f80e-4ac2-861b-4b6557faeea3_Enabled=true
• Mode: Enforce
• Name: PROTECTED
• PrependSubject: [SEC=PROTECTED]
• Priority: 4
• SentToScope: InOrganization
• State: Enabled

Double classification

• If the message: Includes these patterns in the message subject: \[SEC\=.*\].*\[SEC\=.*\] and Is received from Inside the organization
• Take the following actions: reject the message and include the explanation Multiple Security Classifications in Subject Line with the status code: 5.7.1
• ExceptIfSubjectMatchesPatterns: -
• FromScope: InOrganization
• HeaderContainsMessageHeader: -
• HeaderContainsWords: -
• Mode: Enforce
• Name: Double Classification
• PrependSubject: -
• Priority: 5
• SentToScope: -
• State: Enabled

Journaling

Exchange Admin Centre > compliance management > journal rules is not configured.`

Mailbox retention

Exchange Admin Centre > compliance management > retention polices

Table 23 describes the Mailbox Retention settings for Default MRM Policy.

Shared mailboxes and resource mailboxes

Exchange Admin Centre > recipients

None available

Exchange Admin Centre > recipients > groups

• Display name: grp-<Agency Acronym>O365-Outlook
  • Group email address: grp-<Agency Acronym>0365-outlook@<Agency>.gov.au
  • Privacy: Private – Only members can see content
  • Language: English (Australia)
  • Subscribe new members: Enabled
  • Let people outside the organization send email to the group: Disabled
  • Owners: <Agency Owner> (Admin)
  • Members: <Agency Owner> (Admin)
  • Delivery Management
    • Accept messages from: All senders
    • Reject message from: No senders
  • Group Delegation
    • Send As: None
    • Send on Behalf: None
• Display name: Grp-<Agency Acronym>O365-Teams
  • Group email address: Grp-<Agency Acronym>0365-Teams@<Agency>.gov.au
  • Privacy: Private – Only members can see content
  • Language: English (Australia)
  • Subscribe new members: Disabled
  • Let people outside the organization send email to the group: Disabled
  • Owners: <Agency Owner> (Admin)
  • Members: <Agency Owner> (Admin)
  • Delivery Management
    • Accept messages from: All senders
    • Reject message from: No senders
  • Group Delegation
    • Send As: None
    • Send on Behalf: None
• Display name: Protected Desktop Experience
  • Group email address: ProtectedDesktopDemo@<Agency>.gov.au
  • Privacy: Private – Only members can see content
  • Language: English (Australia)
  • Subscribe new members: Disabled
  • Let people outside the organization send email to the group: Disabled
  • Owners: <Agency Exchange Owners>
  • Members: <Agency Exchange Administrators>
  • Delivery Management
    • Accept messages from: All senders
    • Reject message from: No senders
  • Group Delegation
    • Send As: None
    • Send on Behalf: None

Exchange Admin Centre > recipients > resources

• Display name: Equipment 1
  • Email address: equipment1@<Agency>.gov.au
  • Capacity: -
  • Department: -
  • Company: -
  • Address book policy: [No policy]
  • Booking delegates
    • Booking requests: Use customized setting to accept or decline booking requests.
  • Booking options
    • Allow repeating meetings: Enabled
    • Allow scheduling only during working hours: Disabled
    • Always decline if the end date is beyond the limit: Enabled
    • Maximum booking lead time: 180 days
    • Maximum duration: 24 hours
  • Contact Information
    • Location: -
    • Phone: -
    • Street: -
    • City: -
    • State: -
    • Post Code: -
    • Country: -
  • Email address
    • Email address: equipment1@<Agency>.gov.au
  • Mailbox delegation
    • Send As: NT AUTHORITY\SELF
    • Send on Behalf: None
    • Full Access: None
• Display name: Room1
  • Email address: Room1@<Agency>.gov.au
  • Capacity: -
  • Department: -
  • Company: -
  • Address book policy: [No policy]
  • Booking delegates
    • Booking requests: Use customized setting to accept or decline booking requests.
  • Booking options
    • Allow repeating meetings: Enabled
    • Allow scheduling only during working hours: Disabled
    • Always decline if the end date is beyond the limit: Enabled
    • Maximum booking lead time: 180 days
    • Maximum duration: 24 hours
  • Contact Information
    • Location: -
    • Phone: -
    • Street: -
    • City: -
    • State: -
    • Post Code: -
    • Country: -
    • Email address
    • Email address: Room1@<Agency>.gov.au
  • Mailbox delegation
    • Send As: NT AUTHORITY\SELF
    • Send on Behalf: None
    • Full Access: None

Distribution lists

Exchange Admin Centre > recipients > groups > <three dots> > Configure group naming policy

• Group Naming Policy: grp-<Department>-<Group Name>
• Blocked words: None

Dynamic security groups

These settings have been configured using PowerShell.

• Naming Policy: grp-[Department]-[Group Name]
• Display Name: Grp-<Agency Acronym>0365-Outlook
  • Welcome Email: Disabled
• Display Name: Grp-<Agency Acronym>O365-Teams
  • Welcome Email: Disabled

Office 365 groups

Search > Azure Active Directory > Groups > General

• Self Service Group Management
  • Owners can manage group membership requests in the Access Panel: No
  • Restrict user ability to access groups features in the Access Panel. Administrators (Global, Group and User Admin) will have access regardless of the value of this setting.: Yes
• Security Groups
  • Users can create security groups in Azure portals: No
  • Owners who can assign members as group owners in Azure portals: All
• Office 365 Groups
  • Users can create Office 365 groups in Azure portal: No
  • Owners who can assign members as group owners in Azure portal: All

Search > Azure Active Directory > Groups > Naming policy

• Group naming policy: Grp-<Department>-<Group name>

Search > Azure Active Directory > Groups > Expiration

• Group lifetime (in days): 365
• Email contact for groups with no owners: Office365_Group_Expiration@<Agency>.gov.au
• Enable expiration for these Office 365 groups: All

Search > Azure Active Directory > Groups

• Group Name: ADMIN_O365_Admin
  • Membership type: Assigned
  • Source: Windows server AD
  • Type: Security
  • Members: Admin accounts
  • Owners: None
  • Group membership: None
  • Applications: None
  • Licenses: None
  • Azure role assignment: None
• Group Name: ADMIN_O365_DCA_Accounts
  • Membership type: Assigned
  • Source: Windows server AD
  • Type: Security
  • Members: Admin accounts
  • Owners: None
  • Group membership: None
  • Applications: None
  • Licenses: None
  • Azure role assignment: None
• Group Name: ADMIN_O365_GlobalAdmins
  • Membership type: Assigned
  • Source: Windows server AD
  • Type: Security
  • Members: Admin accounts
  • Owners: None
  • Group membership: None
  • Applications: None
  • Licenses: None
  • Azure role assignment: None
• Group Name: Grp-<Agency Acronym>O365-Outlook
  • Membership type: Assigned
  • Source: Cloud
  • Type: Office
  • Email: Grp-<Agency Acronym>o365-outlook@<Agency>.gov.au
  • Members: <Agency User>
  • Owners: <Agency User>
  • Group membership: None
  • Applications: None
  • Licenses: None
  • Azure role assignment: None
• Group Name: Grp-<Agency Acronym>O365-Teams
  • Membership type: Assigned
  • Source: Cloud
  • Type: Office
  • Email: Grp-<Agency Acronym>o365-teams@<Agency>.gov.au
  • Members: <Agency User>
  • Owners: <Agency User>
  • Group membership: None
  • Applications: None
  • Licenses: None
  • Azure role assignment: None
• Group Name: Grp-<Agency Acronym>O365-Teams
  • Membership type: Assigned
  • Source: Cloud
  • Type: Office
  • Email: Grp-<Agency Acronym>o365-teams@<Agency>.gov.au
  • Members: <Agency User>
  • Owners: <Agency User>
  • Group membership: None
  • Applications: None
  • Licenses: None
  • Azure role assignment: None
• Group Name: Office365_AssignLicense_CloudUsers
  • Membership type: Assigned
  • Source: Cloud
  • Type: Security
  • Members: None admin accounts
  • Owners: <Agency Owner> (Admin)
  • Group membership: None
  • Applications: None
  • Licenses: Microsoft 365 E5
  • Azure role assignment: None
• Group Name: Office365_AssignLicense_StandardUsers
  • Membership type: Assigned
  • Source: Windows server AD
  • Type: Security
  • Members: None admin accounts
  • Owners: None
  • Group membership: None
  • Applications: None
  • Licenses: Microsoft 365 E5
  • Azure role assignment: None
• Group Name: Office365_Conditional_Access_Exclude
  • Membership type: Assigned
  • Source: Cloud
  • Type: Security
  • Members
    • Break Glass account
      • TenantAdmin
      • TenantAdmin2
    • AAD Connect Synchronization accounts
      • Sync_<AAD Server 1>_144f9a623d47
      • Sync_<AAD Server 2>_b49bd30fb398
  • Owners: None
  • Group membership: None
  • Applications: None
  • Licenses: None
  • Azure role assignment: None
• Group Name: Office365_Grant_AzureAD_Join
  • Membership type: Assigned
  • Source: Windows server AD
  • Type: Security
  • Members: Admin accounts
  • Owners: None
  • Group membership: None
  • Applications: None
  • Licenses: None
  • Azure role assignment: None
• Group Name: Office365_Grant_CreateGroups
  • Membership type: Assigned
  • Source: Cloud
  • Type: Security
  • Members: <Agency User>
  • Owners: None
  • Group membership: None
  • Applications: None
  • Licenses: None
  • Azure role assignment: None

Exchange Online Protection

The ABAC settings for the Agency Exchange Online Protection instance can be found below. This includes the Connection Filtering, Anti-Malware, Policy Filtering, and Content Filtering configuration. Please note, if a setting is not mentioned in the below, it should be assumed to have been left at its default setting.

Connection filtering

Exchange admin center > protection > connection filter

Table 28 describes the Connection Filters have been configured for Default-Connection-Filter

Anti-Malware

Table 29 following Malware Filters have been configured. These settings are configured through PowerShell.

Content filtering

Table 30 describes the Content Filters have been configured. These settings have been configured with PowerShell.

Teams

The ABAC settings for the Agency Teams instance can be found below. This includes the Teams Policy, Meetings Policy, Live Events Policy, Meetings Settings, Live Events Policy, Messaging Settings, Manage Apps, App Permission Policy, App Setup Policy, Calling Policy, Caller ID Policy, External Access Settings, Guest Access, and Team Settings. Please note, if a setting is not mentioned in the below, it should be assumed to have been left at its default setting.

Teams policy

Teams admin center > Teams > Teams policies

Table 31 describes the Teams Policies configuration.

Meeting policy

Teams admin center > Teams > Meeting policies

• Name: Global
  • Custom policy: No
  • General
    • Allow Meet Now in channels: On
    • Allow the Outlook add-in: On
    • Allow scheduling private meetings: On
    • Allow channel meeting scheduling: On
  • Audio & Video
    • Allow transcription: Off
    • Allow cloud recording: On
    • Allow IP Video: On
    • Media bit rate: 50000
  • Content sharing
    • Screen Sharing Mode: EntireScreen
    • Allow Participant Give/Request Control: On
    • Allow External Participant Give/Request Control: Off
    • Allow PowerPoint Sharing: On
    • Allow Whiteboard: Off
    • Allow Shared Notes: On
  • Participants & guests
    • Let anonymous people to start a meeting: Off
    • Automatically admit users: Everyone in your organization
    • Allow dial-in users to bypass the lobby: Off
    • Allow Meet now in private messages: On
    • Enable live captions: Disable but the organizer can override
    • Allow chat in meetings: Enable
• Name: AllOn
  • Custom policy: No
  • General
    • Allow Meet Now in channels: On
    • Allow the Outlook add-in: On
    • Allow scheduling private meetings: On
    • Allow channel meeting scheduling: On
  • Audio & Video
    • Allow Transcription: Off
    • Allow cloud recording: On
    • Allow IP Video: On
    • Media bit rate: 50000
  • Content sharing
    • Screen Sharing Mode: EntireScreen
    • Allow Participant Give/Request Control: On
    • Allow External Participant Give/Request Control: Off
    • Allow PowerPoint Sharing: On
    • Allow Whiteboard: On
    • Allow Shared Notes: On
  • Participants & guests
    • Let anonymous people start a meeting: Off
    • Automatically admit people: Everyone in your organization
    • Allow dial-in users to bypass the lobby: Off
    • Allow meet now in private meetings: On
    • Enable live captions: Disabled but the organizer can override
    • Allow chat in meetings: Enabled
• Name: RestrictedAnonymousAccess
  • Custom policy: No
  • General
    • Allow Meet Now in channels: On
    • Allow the Outlook add-in: On
    • Allow scheduling private meetings: On
    • Allow channel meeting scheduling: On
  • Audio & Video
    • Allow Transcription: Off
    • Allow cloud recording: On
    • Allow IP Video: On
    • Media bit rate: 50000
  • Content sharing
    • Screen Sharing Mode: EntireScreen
    • Allow Participant Give/Request Control: On
    • Allow External Participant Give/Request Control: Off
    • Allow PowerPoint Sharing: On
    • Allow Whiteboard: On
    • Allow Shared Notes: On
  • Participants & guests
    • Let anonymous people start a meeting: Off
    • Automatically admit people: Everyone in your organization
    • Allow dial-in users to bypass the lobby: Off
    • Allow meet now in private meetings: On
    • Enable live captions: Disabled
    • Allow chat in meetings: Enabled
• Name: AllOff
  • Custom policy: No
  • General
    • Allow Meet Now in channels: Off
    • Allow the Outlook add-in: Off
    • Allow scheduling private meetings: Off
    • Allow channel meeting scheduling: Off
  • Audio & Video
    • Allow Transcription: Off
    • Allow cloud recording: Off
    • Allow IP Video: Off
    • Media bit rate: 50000
  • Content sharing
    • Screen Sharing Mode: Disabled
    • Allow Participant Give/Request Control: Off
    • Allow External Participant Give/Request Control: Off
    • Allow PowerPoint Sharing: Off
    • Allow Whiteboard: Off
    • Allow Shared Notes: Off
  • Participants & guests
    • Let anonymous people start a meeting: Off
    • Automatically admit people: Everyone in your organization
    • Allow dial-in users to bypass the lobby: Off
    • Allow meet now in private meetings: Off
    • Enable live captions: Disabled
    • Allow chat in meetings: Disabled
• Name: RestrictedAnonymousNoRecording
  • Custom policy: No
  • General
    • Allow Meet Now in channels: On
    • Allow the Outlook add-in: On
    • Allow scheduling private meetings: On
    • Allow channel meeting scheduling: On
  • Audio & Video
    • Allow Transcription: Off
    • Allow cloud recording: Off
    • Allow IP Video: On
    • Media bit rate: 50000
  • Content sharing
    • Screen Sharing Mode: EntireScreen
    • Allow Participant Give/Request Control: On
    • Allow External Participant Give/Request Control: Off
    • Allow PowerPoint Sharing: On
    • Allow Whiteboard: On
    • Allow Shared Notes: On
  • Participants & guests
    • Let anonymous people start a meeting: Off
    • Automatically admit people: Everyone in your organization
    • Allow dial-in users to bypass the lobby: Off
    • Allow meet now in private meetings: On
    • Enable live captions: Disabled
    • Allow chat in meetings: Enabled
• Name: Kiosk
  • Custom policy: No
  • General
    • Allow Meet Now in channels: On
    • Allow the Outlook add-in: Off
    • Allow scheduling private meetings: Off
    • Allow channel meeting scheduling: Off
  • Audio & Video
    • Allow Transcription: Off
    • Allow cloud recording: Off
    • Allow IP Video: On
    • Media bit rate: 50000
  • Content sharing
    • Screen Sharing Mode: EntireScreen
    • Allow Participant Give/Request Control: On
    • Allow External Participant Give/Request Control: Off
    • Allow PowerPoint Sharing: On
    • Allow Whiteboard: On
    • Allow Shared Notes: On
  • Participants & guests
    • Let anonymous people start a meeting: Off
    • Automatically admit people: Everyone in your organization
    • Allow dial-in users to bypass the lobby: Off
    • Allow meet now in private meetings: On
    • Enable live captions: Disabled
    • Allow chat in meetings: Enabled
• Name: Custom All On Policy
  • Custom policy: Yes
  • General
    • Allow Meet Now in channels: On
    • Allow the Outlook add-in: On
    • Allow scheduling private meetings: On
    • Allow channel meeting scheduling: On
  • Audio & Video
    • Allow Transcription: On
    • Allow cloud recording: On
    • Allow IP Video: On
    • Media bit rate: 50000
  • Content sharing
    • Screen Sharing Mode: EntireScreen
    • Allow Participant Give/Request Control: On
    • Allow External Participant Give/Request Control: On
    • Allow PowerPoint Sharing: On
    • Allow Whiteboard: On
    • Allow Shared Notes: On
  • Participants & guests
    • Let anonymous people start a meeting: Off
    • Automatically admit people: Everyone
    • Allow dial-in users to bypass the lobby: On
    • Allow meet now in private meetings: On
    • Enable live captions: Disabled but the organizer can override
    • Allow chat in meetings: Enabled

Live events policy

Teams admin center > Live events policies > Global

• Custom policy: No
• Allow scheduling: On
• Allow transcription for attendees: On
• Who can join scheduled live events: Everyone in the organization
• Who can record an event: Always record

Teams admin center > Live events policies > Live Events Organisers

• Custom policy: Yes
• Allow scheduling: On
• Allow transcription for attendees: On
• Who can join scheduled live events: Everyone in the organization
• Who can record an event: Always record

Meeting settings

Teams admin center > Meetings > Meeting settings > participants

• Anonymous users can join a meeting: On

Teams admin center > Meetings > Meeting settings > Email invitation

• Logo URL: Not configured
• Legal URL: Not configured
• Help URL: Not configured
• Footer: Not configured

Teams admin center > Meetings > Meeting settings > Network

• Insert Quality of Service (QoS) markers for real-time media traffic: Off
• Select a port range for each type of real time media traffic: Specify port ranges

Live events settings

Teams admin center > Meetings > Live events settings

• Support URL
  • Customize the support URL if a user needs to contact support during a live event: https://support.office.com/home/contact
• Third party video distribution providers
  • Use a third party distribution provider: Off

Messaging policy

Teams admin center > Messaging policies \ Global

• Name: Global (Org-wide default)
• Description: Global Teams Messaging Policy
• Owners can delete sent messages: Off
• Delete sent messages: On
• Edit sent message: On
• Read receipts: User Controlled
• Chat: On
• Use Giphys in conversation : On
• Giphy content rating : Strict
• Use Memes in conversations: On
• Use Stickers in conversations: On
• Allow URL previews: On
• Translate messages: Off
• Allow Immersive Reader for viewing messages: On
• Send urgent messages using priority notifications: On
• Create voice messages: Allowed in chats and channels
• On mobile devices, display favorite channels above recent chats: Disabled
• Remove users from group chats: On

Manage apps

Teams admin center > Team apps > Manage apps > Org-wide app settings > Third party apps

• Allow third party apps: Off
• Allow any new third party apps published to the store by default: Off

Teams admin center > Team apps > Manage apps > Org-wide app settings > Custom apps

• Allow interaction with custom apps: Off

App permission policy

Teams admin center > Team apps > Permission policies \ Global > Microsoft apps

• Choose which Teams apps published by Microsoft or its partners can be installed by your users: Allow all apps

Teams admin center > Team apps > Permission policies \ Global > Third party apps

• Choose which Teams apps published by a third-party that can be installed by your users: Block all apps

Teams admin center > Team apps > Permission policies \ Global > Custom apps

• Choose which custom apps can be installed by your users: Block all apps

Teams admin center > Team apps > Permission policies \ App Reviewers > Microsoft apps

• Choose which Teams apps published by Microsoft or its partners can be installed by your users: Allow all apps

Teams admin center > Team apps > Permission policies \ App Reviewers > Third party apps

• Choose which Teams apps published by a third-party that can be installed by your users: Allow all apps

Teams admin center > Team apps > Permission policies \ App Reviewers > Custom apps

• Choose which custom apps can be installed by your users: Allow all apps

App setup policy

Teams admin center > Team apps > Setup policies \ FirstLineWorker

• Upload custom apps: Off
• Allow user pinning: On

Teams admin center > Team apps > Setup policies \ FirstLineWorker > Pinned apps

Teams admin center > Team apps > Setup policies \ Global

• Upload custom apps: Off
• Allow user pinning: On

Teams admin center > Team apps > Setup policies \ Global > Pinned apps

Calling policy

Teams admin center > Voice > Calling polices > Global (org-wide default)

• Name: Global
• Description: Not Configured
• Make private calls: On
• Call forwarding and simultaneous ringing to people in your organization: On
• Call forwarding and simultaneous ringing to external phone numbers: On
• Voicemail is available for routing inbound calls: User controlled
• Inbound calls can be routed to call groups: On
• Allow delegation for inbound and outbound calls: On
• Prevent toll bypass and send calls through the PSTN: Off
• Busy on busy is available when in a call: Off
• Allow web PSTN calling: On

Teams admin center > Voice > Calling policies > AllowCalling

• Name: Tag:AllowCalling
• Description: Not Configured
• Make private calls: On
• Call forwarding and simultaneous ringing to people in your organization: On
• Call forwarding and simultaneous ringing to external phone numbers: On
• Voicemail is available for routing inbound calls: User controlled
• Inbound calls can be routed to call groups: On
• Allow delegation for inbound and outbound calls: On
• Prevent toll bypass and send calls through the PSTN: Off
• Busy on busy is available when in a call: Off
• Allow web PSTN calling: On

Teams admin center > Voice > Calling policies > DisallowCalling

• Name: Tag:DisallowCalling
• Description: Not Configured
• Make private calls: Off
• Call forwarding and simultaneous ringing to people in your organization: Off
• Call forwarding and simultaneous ringing to external phone numbers: Off
• Voicemail is available for routing inbound calls: Disabled
• Inbound calls can be routed to call groups: Off
• Allow delegation for inbound and outbound calls: Off
• Prevent toll bypass and send calls through the PSTN: Off
• Busy on busy is available when in a call: Off
• Allow web PSTN calling: On

Caller ID policy

Teams admin center > Voice > Caller ID policies > Global

• Block incoming caller ID: Off
• Override the caller ID policy: Off
• Replace the caller ID with : User’s Number
• Replace the caller ID with this service number : Not configured

External access settings

Teams admin center > Org-wide settings > External access

• Users can communicate with other Skype for Business and Teams users: On
• Users can communicate with Skype users: Off
• Domain:

<Agency>.gov.au: Allowed
microsoft.com: Allowed

Guest access

Teams admin center > Org-wide settings > Guest Access

• Allow guest access in Teams: On

Teams admin center > Org-wide settings > Guest Access > Calling

• Make private calls: Off

Teams admin center > Org-wide settings > Guest Access > Meeting

• Allow IP video: On
• Screen sharing mode: Entire screen
• Allow Meet Now : On

Teams admin center > Org-wide settings > Guest Access > Messaging

• Edit sent messages: Off
• Delete sent messages: Off
• Chat: On
• Use Giphys in conversation: On
• Giphy content rating: Moderate
• Use Memes in conversations : On
• Use Stickers in conversations : On
• Allow immersive reader for viewing messages : On

Team settings

Teams admin center > Org-wide settings > Team settings > Notifications and feeds

• Suggested feeds can appear in a user’s activity feed: On

Teams admin center > Org-wide settings > Team settings > Tagging

• Tagging is enabled for:: `Team owners
• Team owner can override who can apply tags: On
• Members can add additional tags: On
• Suggested default tags: -

Teams admin center > Org-wide settings > Team settings > Email integration

• Allow users to send emails to a channel email address: On
• Accept channel email from these SMTP domains: <Agency>.gov.au

Teams admin center > Org-wide settings > Team settings > Files

• Turn on or turn off file sharing and cloud file storage options for the Files tab:

Citrix files: off
DropBox: off
Box: off
Google Drive: off

Teams admin center > Org-wide settings > Team settings > Organization

• Show Organization tab in chats: On

Teams admin center > Org-wide settings > Team settings > Devices

• Require a secondary form of authentication to access meeting content: No access
• Set content PIN: Required for outside scheduled meeting
• Resource accounts can send messages: On

Teams admin center > Org-wide settings > Team settings > Search by name

• Scope directory search using an Exchange address book policy: Off

SharePoint Online & OneDrive

The ABAC settings for the Agency SharePoint Online and OneDrive instances can be found below. This includes the Sharing Configuration, Access Control and SharePoint Settings. Please note, if a setting is not mentioned in the below, it should be assumed to have been left at its default setting.

Sharing

SharePoint admin center > Policies > Sharing > External Sharing

• Content can be shared with:

  SharePoint: New and existing guests
  OneDrive: Only people in your organization
  

• Limit external sharing by domain:

  Agency.gov.au
  microsoft.com
  

• Allow only users in specific security groups to share externally: False
• Guests must sign in using the same account to which sharing invitations are sent: True
• Allow guests to share items they don’t own: False
• People who use a verification code must reauthenticate after this many days : Not configured

SharePoint admin center > Policies > Sharing > File and Folder links

• Default link type: Specific people (only the people the user specifies)
• Default link permission : Edit

SharePoint admin center > Policies > Sharing > Other settings

• Show owners the names of people who viewed their files in OneDrive: True
• Let site owners choose to display the names of people who viewed files or pages in SharePoint: True
• Use short links for sharing files and folders : True

Access control

SharePoint admin center > Policies > Access control > Unmanaged devices

• Allow access from unmanaged devices: Block access

SharePoint admin center > Policies > Access control > Idle session sign-out

• Sign out inactive users automatically: On
• Sign out users after:: 1 hours
• Give users this much notice before signing them out: 5 minutes

SharePoint admin center > Policies > Access control > Network location

• Allow access only from specific IP address ranges: Off

SharePoint admin center > Policies > Access control > Apps that don’t use modern authentication

• Allow or block access from applications that don’t user modern authentication: Block access

SharePoint settings

SharePoint admin center > Settings > Default admin center

• New SharePoint admin center: True

SharePoint admin center > Settings > Pages

• Allow users to create new modern pages on sites that don’t already have site pages: True
• Allow commenting on modern pages : True

SharePoint admin center > Settings > SharePoint notifications

• Allow notifications: True

SharePoint admin center > Settings > Site creation

• Let users create sites from the SharePoint start page and OneDrive: False
• Create team sites under: https://<Agency>.sharepoint.com/sites/
• Default time zone : (UTC+10:00) Canberra, Melbourne, Sydney
• Default storage limit for new sites: 200 GB

SharePoint admin center > Settings > Site storage limits

Share storage among all sites or control storage limits: Manual

Security and compliance

The ABAC settings for the Agency Office 365 Security and Compliance instance can be found below. This includes the Alerts, Labels, Data Loss Prevention, Retention Policies, Audit Logging, and Customer Key configuration. Please note, if a setting is not mentioned in the below, it should be assumed to have been left at its default setting.

Audit logging

Office 365 Security & compliance > Search > Audit log search

• Enabled: True
• Admin Audit Log Age Limit: 1 year

Retention policies

Office 365 Security & compliance > Information governance > Retention | Exchange 3 Years Hold

• Status: On
• Policy Name: Exchange 3 Years Hold
• Description: Exchange 3 Years Hold
• Applies to content in these locations:

  Exchange email
  Exchange Public Folders
  

• Retention period: Keep content for 3 years
• Turn on preservation lock: No

Office 365 Security & compliance > Information governance > Retention | Office 365 Groups 3 Years Hold

• Status: On
• Policy Name: Office 365 Groups 3 Years Hold
• Description: Office 365 Groups 3 Years Hold
• Applies to content in these locations: Office 365 Groups
• Retention period: Keep content for 3 years
• Turn on preservation lock: No

Office 365 Security & compliance > Information governance > Retention | OneDrive 3 Years Hold

• Status: On
• Policy Name: OneDrive 3 Years Hold
• Description: OneDrive 3 Years Hold
• Applies to content in these locations: OneDrive Accounts
• Retention period: Keep content for 3 years
• Turn on preservation lock: No

Office 365 Security & compliance > Information governance > Retention | SharePoint 3 Years Hold

• Status: On
• Policy Name: SharePoint 3 Years Hold
• Description: SharePoint 3 Years Hold
• Applies to content in these locations: SharePoint sites
• Retention period: Keep content for 3 years
• Turn on preservation lock: No

Office 365 Security & compliance > Information governance > Retention | Teams Channel Messages 3 Years Hold

• Status: On
• Policy Name: Teams Channel Messages 3 Years Hold
• Description: Teams Channel Messages 3 Years Hold
• Applies to content in these locations: Teams channel messages
• Retention period: Keep content for 3 years
• Turn on preservation lock: No

Office 365 Security & compliance > Information governance > Retention | Teams Chats 3 Years Hold

• Status: On
• Policy Name: Teams Chats 3 Years Hold
• Description: Teams Chats 3 Years Hold
• Applies to content in these locations: Teams chats
• Retention period: Keep content for 3 years
• Turn on preservation lock: No

Retention labels

Office 365 Security & compliance > Information governance > Labels

Not Configured

Sensitivity labels

Office 365 Security & compliance > Information protection > Labels

• UNOFFICIAL: 0 – lowest
• OFFICIAL: 1
• OFFICIAL Sensitive: 2
• OFFICIAL Sensitive ACCESS=Legal-Privilege: 3
• OFFICIAL Sensitive ACCESS=Legislative-Secrecy: 4
• OFFICIAL Sensitive ACCESS=Personal-Privacy: 5
• PROTECTED: 6
• PROTECTED ACCESS=Legal-Privilege: 7
• PROTECTED ACCESS=Legislative-Secrecy: 8
• PROTECTED ACCESS=Personal-Privacy: 9
• PROTECTED CAVEAT=SH CABINET: 10
• PROTECTED ACCESS=Legal-Privilege CAVEAT=SH CABINET: 11
• PROTECTED ACCESS=Legislative-Secrecy CAVEAT=SH CABINET: 12
• PROTECTED ACCESS=Personal-Privacy CAVEAT=SH CABINET: 13 – highest

Sensitivity label policy

Office 365 Security & compliance > Information protection >Label polices > <Agency Acronym> sensitivity labels

• Name: <Agency Acronym> sensitivity labels
• Description: Default sensitivity labels based on PSPF infosec document
• Published Labels

  UNOFFICIAL
  OFFICIAL
  OFFICIAL Sensitive
  OFFICIAL Sensitive ACCESS=Legal-Privilege
  OFFICIAL Sensitive ACCESS=Legislative-Secrecy
  OFFICIAL Sensitive ACCESS=Personal-Privacy
  PROTECTED
  PROTECTED ACCESS=Legal-Privilege
  PROTECTED ACCESS=Legislative-Secrecy
  PROTECTED ACCESS=Personal-Privacy
  PROTECTED CAVEAT=SH CABINET
  PROTECTED ACCESS=Legal-Privilege CAVEAT=SH CABINET
  PROTECTED ACCESS=Legislative-Secrecy CAVEAT=SH CABINET
  PROTECTED ACCESS=Personal-Privacy CAVEAT=SH CABINET
  

• Published to: All
• Policy settings:

  Label is mandatory
  Users must provide justification to remove a label or lower its classification
  

Data loss prevention

Office 365 Security & compliance > Data Loss Prevention

• Australia Financial Data: 0
• Australia Health Records ACT (HRIP Act): 1
• Australia Personally Identifiable Information (PII) Data: 2
• Australia Privacy Act: 3
• Locations to apply this policy:

  Exchange email
  SharePoint sites
  OneDrive accounts
  Teams chat and channel messages
  

• Policy settings:

  Low volume of content detected
  High volume of content detected