Office 365

This document covers the following topics.

Section	Description
Office 365 Organisation	Office 365 allows for the configuration of organisation wide settings through the use of a centralised management portal.
Office 365 Connectivity	Office 365 is a globally distributed service. The user experience with Office 365 involves connectivity through highly distributed service connection points that are scaled over many Microsoft locations worldwide.
Exchange Online	Exchange Online is a cloud hosted email solution that has the capabilities of on-premises Exchange Services.
SharePoint Online	SharePoint online is an online collaboration and file storage solution. SharePoint integrates heavily with Teams and OneDrive.
OneDrive for Business	OneDrive is a file hosting and file synchronisation solution.
Microsoft Teams	Teams is a cloud hosted unified communications platform. It provides chat, meetings, file storage, and application integrations.
Power Platform	The Power Platform includes PowerApps, Power BI, and Microsoft Flow.
Security and Compliance	Office 365 provides Security and Compliance tools which can be utilised to implement an organisation’s Information Management Policy and to assist with information governance.
Exchange Online Protection	Exchange Online protection is a cloud hosted email security service (Mail Gateway) that acts to filter spam and scan for viruses on email entering and leaving Exchange Online.
Office 365 Advanced Threat Protection (ATP)	Office 365 ATP is a cloud-based mail threat protection service. The service provides protection against unknown malware and viruses through the use of robust zero-day protection and inclusion of features to safeguard an organisation from harmful links in real time.

For each component within the document there is a brief description of the contents of the section, a commentary on the things that have been considered in determining the decisions and the design decisions themselves.

Assumptions

• Where data for any Microsoft service does not reside in Australia this has been explicitly called out
• Agencies can provide collateral for custom branding

Office 365 Organisation

Residency

Office 365 is a global service which is offered in many different physical regions. Choosing a region to store data is required to ensure that the data of the Agency does not get transferred or stored offshore.

Office 365 tenant residency is critical when setting up the Agency’s Office 365 tenant. The region where the Office 365 tenant is set up determines where the data is store. Details of Office 365 data residency can be found from Microsoft’s site.

Office 365 tenant data residency consideration is required to ensure the Agency’s Office 365 tenant is created and data is stored in Australia.

Office 365 Region Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Office 365 Region	Australia	Aligns with ACSC guidance.

Licence

Microsoft licenses access to Office 365 and its security offerings through user-based licensing.

Microsoft offers several enterprise licencing options for Office 365, Enterprise Mobility and Security (EMS), and Windows.

These licencing options are summarised below:

• Microsoft 365 E5 (recommended for this Blueprint) – Top level Enterprise Plan. Microsoft 365 E5 includes everything inside Microsoft 365 E3 plus additional features and services (largely security and compliance related). In the case of Office 365 E5, the capabilities in Office 365 Advanced Threat Protection (ATP) suite as well as other services such as Office 365 Advanced Compliance are increased.
• Microsoft 365 E3 - Mid range Enterprise Plan. Microsoft 365 E3 provides access to core products with enhanced features and security features. In the case of Office 365 E3, the Office client suite is included, and the service limits are increased.

To grant access to the services a license is assigned to an individual user account. A license can be assigned by an administrator at the time of the user account is created or through Azure AD group-based licensing. Azure AD group-based licensing allows an Administrator to associate a license to a group. Any members within the group will be assigned that license automatically. When a user is removed from the group the license is removed.

Licencing Design Decisions for all agencies and implementation types

Decision Point	Design Decision	Justification
Products Licenced	Microsoft 365 E5	Microsoft 365 E5 licences combines Office 365 E5, EMS E5, and Windows 10 E5 are required to ensure that Office 365 tenant can be rated up to Protected.
Licence Allocation Method	Automated	Dynamic Security Groups in Azure AD will be used to automatically assign licences and reduce the management overhead associated with licensing.

Licencing Configuration for all agencies and implementation types.

Configuration	Value	Description
Admin Licence Group	rol-AgencyName-Administrator	This is the group that the Agency administrators belong to.
User Licence Groups	rol-AgencyName-Users	This is the group that the Agency non-administrator users belong to.

Self Service Purchase

Self-Service purchase add-ins for Office 365 allows users of Office 365 to purchase 3rd party add-ins to be added into Office 365 tenancy.

Self-service purchase of applications from the Microsoft Power Platform products was introduced in January 2020. By default, this is enabled for all users within the tenant and paid by credit card.

These processing of data for these add-ins does not sit within Office 365 tenancy. This might cause the data to flow outside and/or stored outside of Australia.

Self-Service Design Decisions for all agencies and implementation types

Decision Point	Design Decision	Justification
Global self-service purchase	Disabled	Only administrators are permitted to purchase applications
Power BI self Service purchase	Disabled	Only administrators are permitted to purchase applications
Power Apps self-service purchase	Disabled	Only administrators are permitted to purchase applications
Power Automate (Flow) self-service purchase	Disabled	Only administrators are permitted to purchase applications

Themes

Office 365 Themes provide a method to customise the portal’s look and feel for users.

The logo of the organisation can be added to the top navigation panel. Themes assist users with familiarisation and adoption of the new system.

Theme Design Decisions for all agencies and implementation types

Decision Point	Design Decision	Justification
Custom Portal Theme	Configured	Customising the Theme setting assists user to identify that they are in the correct portal.

Note: Themes will be the responsibility of the Agency and this table contains recommendations and restrictions for the themes.

Theme Configuration for all agencies and implementation types

Configuration	Value	Description
Logo Image	Agency logo is recommended	Under 10 KB, 200 x 30 pixels in JPG, PNG, GIF, or SVG format. SVG is the preferred format.
Background Image	Agency logo is recommended	15 KB or less, 1366 x 50 pixels in JPG, PNG, or GIF format. This is in line with Microsoft best practice.
Prevent users from overriding their theme	Yes	Flip this toggle to prevent users from choosing their own theme from the Microsoft theme gallery. This is enabled to maintain cadence between potential personal tenancies and the ‘corporate’ environment.
Navigation bar colour	Default	Based on Agency branding standards. To maintain cadence with corporate standards.
Text and icon colour	Default	Based on Agency branding standards.
Accent Colour	Default	Based on Agency branding standards.
Show the users name on the top navigation bar when the user is signed in	Yes	The users name will be shown to identify who is signed in.

Office 365 Services and Add-Ins

Office 365 centrally manages Office services and add-ins. Office services and add-ins can enhance both the way information is accessed and the way business is conducted. Enabling Services and Add-ins also comes with risks (such as the risk of data loss). Out of the box several services and add-ins are configured within the portal.

The design will take into consideration the services and add-in that are part of Office 365. The design decision is based on the requirement provided by the Agency and location of the application that is hosted on.

Services and Add-ins Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Azure Speech Services	Disabled	Default setting
Bookings	Disabled	Exposes a public web page. No requirement.
Calendar	Disabled	External sharing is disabled to prevent potential data spills.
Cortana	Disabled	To align with ACSC Windows 10 1709 hardening, Page 55.
External Form sharing	Disabled	Microsoft Forms is hosted outside of Australia.
Microsoft Graph Data Connect	Enabled	API connectivity required for solution management.
Microsoft Planner	Enabled	Internet calendars will be enabled, it is up to the Agency which calendars they wish to publish.
Microsoft Search in Bing	Disabled	Microsoft Search integrates with bing.com for Search. Office 365 data is indexed to provide bing.com search functionality and is therefore not desirable for this design.
Microsoft communication to users	Disabled	System admins will be responsible for communication to users
Modern Authentication	Enabled	Modern authentication is a group of technologies that combines authentication, authorisation and conditional access policies to secure an Office 365 tenant. Enabling of Modern Authentication provides ability to use Multi Factor Authentication.
MyAnalytics	Enabled	Provides users with details about their usage of Office 365
External Office 365 group content sharing	Enabled	External collaboration will be conducted in Microsoft Teams which relies on Office 365 groups
‎Office‎ software download settings	Disabled	Only one instance of the Office Suite is to be installed per user on their Government issued device. Office applications will be deployed to users via the Business Store.
Office What’s New management preview	Disabled	System admins will be responsible for communication to users.
Office on the web	Disabled	Do not allow users to open files in third party storage
Reports	Disabled	Disable data reporting to Microsoft on Office 365 usage.
SharePoint	Enabled	New and Existing guests must sign in or provide a verification code when accessing SharePoint data.
External Sway sharing	Disabled	External collaboration will be conducted in teams.
User owned apps and services	Disabled	Applications will be delivered via the Business Store, there is no need to have the Official Store enabled.
Whiteboard	Disabled	Microsoft Whiteboard is not hosted in Australia.

Role Based Access Control

Role Based Access Control (RBAC) defines what an end user or administrator can do. In relation to system administration, RBAC provides various roles each of which can only perform certain tasks. For example, help desk staff may be able to only view certain resources, whereas system administrators could view, create, and delete those resources. Office 365 provides a subset of administrative roles available in Microsoft Azure.

Privileged Identity Management (PIM) can be leveraged to enhance the RBAC model for Azure Active Directory role-based management access, and parts of other Microsoft services like Office 365 and Intune. PIM requests are made through the Azure portal for elevated access only when they are required, and access is expired after a specified period.

The following Office 365 roles can be assigned via PIM:

• Exchange administrator
• SharePoint administrator
• Teams Service administrator
• Power BI Administrator

Role Based and Access Control Design Decisions for all agencies and implementation types

Decision Point	Design Decision	Justification
PIM	Configured	PIM provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. PIM
Office 365 administrative sub-roles	Not Configured	Office 365 administrative sub-roles will not be configured in favour of PIM. This ensures Azure is the location to manage Role Base Access Control permission for the Agency tenant.

Customer Lockbox

Customer lockbox provides a time-boxed, secure mechanism for Microsoft Support Engineers to assist in customers support query in Office 365. Microsoft Support engineers will have to request authorisation from the Agency to access the underlying data in Office 365 tenant.

Customer Lockbox address situations where Microsoft Engineers require access to client data within Office 365 to resolve an incident. All access requests are recorded for auditing purpose.

Customer Lockbox Design Decisions for all agencies and implementation types

Decision Point	Design Decision	Justification
Customer Lockbox	Enable	This is to ensure the Agency approves and log interaction with Microsoft Support Engineers.

Office 365 Connectivity

Office 365 is a publicly facing SaaS offering and firewall ports are required to be opened to allow communication between infrastructure and desktops and Office 365. These ports configurations are updated frequently and are available online from (Microsoft)[https://docs.microsoft.com/en-au/office365/enterprise/urls-and-ip-address-ranges].

It is important to note the traffic between the clients and the Office 365 offering is TLS 1.2 encrypted.

Configuration will occur on the proxy and external gateway of the Agency as required.

Further details on the firewall configuration for the solution can be found in the Network Configuration ABAC.

Mail Flow and Gateway

Mail flow is the path taken by an email from the sender to a receiver. A Mail Gateway acts as the central egress and ingress point for mail traffic into an organisation.

For agencies implementing a PROTECTED environment, DTA recommends the use of a separate mail gateway to interface with GovLink for the following functions:

• Encryption
• Message rules
• Header modification

This will achieve the closest alignment to whole of government policy for Secure Internet Gateways, guidance of the Information Security Manual and the Protective Security Policy Framework.

GovLink enables secure communication between Commonwealth entities across public infrastructure and is required for PROTECTED mail to be securely transferred between government organisations. When a GovLink mail gateway is required, Agencies can either use an existing gateway or a new gateway.

It is not possible to configure Exchange Online to directly send email via GovLink. Exchange Online must resolve to a public facing IP address, which is not possible across the GovLink network. In this instance a Mail Relay would be required with a public facing interface and a second interface that is able to connect to GovLink.

DTA is currently working with Microsoft and the Department of Finance to simplify an agency’s ability to achieve this, however at the time of writing there is no native solution to allow a direct interface between the Office365/Exchange Online environment and GovLink.

The following image shows the high-level mail flow for agencies implementing without on-premises infrastructure.

The figure below shows the high-level mail flow for agencies leveraging on-premises infrastructure in a hybrid configuration.

Design Decisions summary for all agencies and implementation types

Implementation Type	Mail Gateway	Mail Connectors	Mail Ingress	Mail Egress	Sensitivity Labels
Cloud	Exchange Online Protection (EOP)	Not required	EOP	EOP	Required
Hybrid	Existing mail gateway	EOL <-> Mail gateway	Mail gateway	Mail gateway	Required

Note that Exchange Online Protection, a mail gateway may be required to interface with GovLink.

Optimisation

Office 365 is a globally distributed service. The user experience with Office 365 involves connectivity through highly distributed service connection points that are scaled over many Microsoft locations worldwide. This section outlines two sets of design decisions, representing advice to achieve the highest level of maturity and adherence to existing Whole of Government policies and advice to maximise optimisation outside and user experience. The below information is to inform agencies, including on how best to maximise optimisation and user experience, however consideration should be given for the risk implications of implementing in such a way. While this approach of optimisation represents the current best practice published by Microsoft it is inconsistent with the previously referenced guidance of the ISM and PSPF relating to Secure Internet Gateways. We have provided configuration controls for both scenarios below.

To minimise latency, a customer network can route user requests to the closest Office 365 service entry point, rather than connecting to Office 365 through an egress point in a central location or region.

The following achieves optimal Office 365 connectivity and performance:

• Local DNS resolution and Internet egress - Provision local DNS servers in each location and ensure that Office 365 connections egress to the internet as close as possible to the user’s location. This configuration minimises latency and improves connectivity to the closest Office 365 entry point.
• Add regional egress points - If the Agency network has multiple locations but only one egress point, add regional egress points to enable users to connect to the closest Office 365 entry point. This configuration minimises latency and improves connectivity to the closest Office 365 entry point.
• Bypass proxies and inspection devices - Configure browsers to send Office 365 traffic directly to egress points and bypass proxies. Configure edge routers and firewalls to permit Office 365 traffic without inspection. This configuration minimises latency and reduces the load on network devices.
• Enable split tunnelling connection for VPN users - If a VPN solution is required Always on VPN should be integrated into the agency infrastructure. For VPN users, enable Office 365 connections to connect directly from the user’s network rather than over the VPN tunnel by implementing split tunnelling. This configuration minimises latency and improves connectivity to the closest Office 365 entry point.

Optimisation design considerations and decisions apply to all agencies and implementation types.

Office 365 Connectivity Optimisation Design Decisions for an increased security posture

Decision Point	Design Decision	Justification
Workstation Connectivity	VPN with central internet gateway	Provides the highest level of auditing and monitoring.
Local DNS resolution and Internet egress	Not Configured	All traffic will egress centrally through an internet gateway.
Add regional egress points	Not Configured	All traffic will egress centrally through an internet gateway.
Bypass proxies and inspection devices	Configured	Proxies and internet gateway will be configured following Microsoft best practice guidance to allow services to function correctly.
Enable split tunnelling connection for VPN users	Not Configured	All traffic will always traverse the VPN and egress through the internet gateway.

Office 365 Connectivity Optimisation Design Decisions for an enhanced User Experience

Decision Point	Design Decision	Justification
Workstation Connectivity	Direct connection to the internet	Provides the best performance for users
Local DNS resolution and Internet egress	Configured if required	DNS will be resolved to the gateway of their internet device.
Add regional egress points	Configured if required	Regional Egress Points are not configured in this solution due to the workstations being directly connected to the internet.
Bypass proxies and inspection devices	Configured	Proxys are not configured in this solution due to the workstations being directly connected to the internet.
Enable split tunnelling connection for VPN users	Configured	Split tunnelling is configured in this solution to enable workstations to directly connect to Microsoft services. If a VPN solution is required Always on VPN should be integrated into the agency infrastructure

Exchange Hybrid

Exchange Online can be used standalone or integrated with an on-premises Exchange Server(s), extending the organisations messaging farm in a hybrid configuration.

A Hybrid configuration provides administrators with added flexibility to transition users to the Cloud without isolating them from the on-premises resources.

This section is only relevant for agencies implementing a hybrid solution that leverages an on-premises Exchange Server(s)

Establishing a hybrid deployment requires an Exchange hybrid server that is supported with your existing on-premises Exchange Server. Microsoft recommends the deployment of the newest Exchange Hybrid server for your environment to ensure the best compatibility with Exchange Online.

Exchange Hybrid Server Supported Configurations

On-premises environment	Exchange 2019 Hybrid Deployment	Exchange 2016 Hybrid Deployment	Exchange 2013 Hybrid Deployment	Exchange 2010 Hybrid Deployment
Exchange 2019	Supported	Not supported	Not supported	Not supported
Exchange 2016	Supported	Supported	Not supported	Not supported
Exchange 2013	Supported	Supported	Supported	Not supported
Exchange 2010	Not supported	Supported	Supported	Supported

The following table outlines the Exchange server roles required to be installed based on on-premises Exchange environment version. The roles mentioned for Exchange 2013 and 2010 can be installed separately or on one server, Microsoft strongly recommend installing all roles on one server.

On-premises environment	Mailbox server	Client Access server	Hub Transport
Exchange 2016 and newer	At least one instance	Not required	Not required
Exchange 2013	At least one instance	At least one instance	Not required
Exchange 2010	At least one instance	At least one instance	At least one instance

Exchange Hybrid design considerations and decisions only apply to agencies leveraging a hybrid implementation.

Decision Point	Design Decision	Justification
Exchange Hybrid Deployment	Exchange 2016-based	The Agency will use their existing Exchange 2016 server to establish the hybrid connection.
Edge Transport Server	Configured	The Agency will leverage an Edge Transport server to prevent the exposure of internal Exchange servers directly to the internet.

Mail Exchange Records

Mail Exchange (MX) records specify the mail server responsible for accepting mail on behalf of the domain.

The record is a resource in the Domain Name System (DNS), and it is possible for a single domain to have multiple MX records. Multiple records are largely configured for availability, redundancy, and load balancing reasons.

Mail Exchange Records Design Decisions for cloud native implementations

Decision Point	Design Decision	Justification
Authoritative DNS MX Record	<Mail Gateway>	This is the ingress point for the mail for the Agency, the mx records will point to the Agency gateway
Mail Exchanger/s	<Mail Gateway>	This is the ingress point for the mail for the Agency, the mx records will point to the Agency gateway

Mail Exchange Records Design Decisions for hybrid implementations

Decision Point	Design Decision	Justification
Authoritative DNS MX Record	Configured	If the agency hosts mail for more than one domain a MX record for each is required. These records are listed.
Mail Exchanger/s	Configured	If the Agency requires its on-premises mail gateways to continue to be used, the Virtual IP (VIP) of the gateways is used.

Mail Connectors

Mail connectors use TLS to secure communication and can customise the way mail flows into and out of the organisation.

Generally mail connectors are required. An exception may be where an agency does not use a mail gateway and relies on Exchange Online Protection.

When the organisation intends to operate at the PROTECTED level, the Blueprint assumes that all agencies are implementing the configuration with a Mail Gateway and as such, provides detailed configurations on implementing mail connectors via the relevant gateway.

Mail Connector design considerations and decisions apply to all agencies and implementation.

Decision Point	Design Decision	Justification
Mail Connectors	Configured	Mail connectors are required for all Exchange and Exchange Online implementations. Specific connectors are configured when implementing Exchange hybrid.

Mail Connector Configuration for all agencies and implementation types for environments intended to be used at the PROTECTED level

Configuration	Value	Description
Certificate details	Configured	Certificate to be issued from the gateway hosting the GovLink connection.
Virtual IP address (VIP)	Configured	Virtual IP Address details will be provided by the gateway provider.
Exchange Online Receive Connector
Name	Inbound-connector-from-<GATEWAY>	Describes the source and directionality of mail.
Retain internal mail headers	Unchecked	Internal Mail headers are stripped off messages.
On-premises server identification method and value	Identify by Senders Domain. Reject email messages if they are not sent over TLS. Require subject name matching <DOMAIN>	Ensures mail is being sent over an encrypted connection to a known domain.
Exchange Online Send Connector
Name	outbound-connector-to-<GATEWAY>	Describes the source and directionality of mail.
Retain internal mail headers	Checked	When reporting spam that slips past the filters, it is essential that we receive the full message headers from a message
When to use the connector	* (All Mail)	All mail should use the connector
Message routing	Route through these smart hosts.	This should be used route mail to the gateway.
Connector Authentication settings	Always use TLS issued by a trusted Certificate Authority with a SAN matching <DOMAIN>	Ensures mail is being sent over an encrypted connection to a known domain.

Autodiscover

Autodiscover is a mechanism for the configuration of a user’s email client with minimal user input. The required input from the user is their email address and password.

Autodiscover for a cloud environment varies from the process utilised when on-premises Exchange is leveraged. With a cloud environment, an Autodiscover Endpoint representing the domain is not available. Instead, DNS redirection and Hypertext Transfer Protocol Secure (HTTPS) redirection is leveraged to direct the Autodiscover client to a trusted Autodiscover Endpoint. The high-level process is:

• The Autodiscover endpoint looks for a host named autodiscover.{DomainName}.com
• DNS provides the Internet Protocol (IP) address of the host autodiscover.outlook.com
• The Autodiscover client attempts communication utilising HTTPS (This fails)
• The Autodiscover client requests redirection over Hypertext Transfer Protocol (HTTP) (This directs the client to autodiscover-s.outlook.com)
• The Autodiscover client attempts communication utilising HTTPS. The communication is successful. However, the new Autodiscover endpoint does not have a server certificate for the requested hostname. This communication is then redirected using HTTPS redirection to an additional Autodiscover endpoint which can provide the required Autodiscover information.
• The Autodiscover client completes the Autodiscover process with the new Autodiscover endpoint.

To ensure this process functions as described above, appropriate DNS records are required.

Autodiscover Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
DNS Records (CNAME)	Autodiscover: autodiscover.outlook.com	A DNS record that points clients to the Autodiscover service.

Autodiscover Design Decisions for cloud native implementations

Decision Point	Design Decision	Justification
Autodiscover	CNAME autodiscover autodiscover.outlook.com	Autodiscover will improve the user experience and is required to configure a user’s Outlook profile and inbox.

Autodiscover Design Decisions for the HYBRID solution

Decision Point	Design Decision	Justification
Autodiscover internally	Configured - Service Connection Point	Autodiscover will continue to point to the internal Exchange Servers until all mailboxes have been migrated to Office 365 to ensure functionality.
Autodiscover externally	Configured – DNS record	To ensure autodiscover functions externally to the Agency.

SPF, DMARC and DKIM

Sender Policy Framework (SPF), Domain Key Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC) are tools for email authentication. These tools can coexist to provide enhanced capabilities.

These tools can coexist to provide enhanced capabilities.

• SPF - SPF is a DNS entry which lists the servers which can send emails from a specific domain. It allows recipients to verify the identity of incoming mail
• DKIM - DKIM, unlike SPF is a tool to verify whether the content of the message is trustworthy. This is completed using a public/private key signing process
• DMARC - DMARC enables both SPF and DKIM using policy. A DMARC policy sets out how to handle messages which do not align to what the receiver knows about the sender. This can include rejecting the message; suggesting the message is quarantined; or allowing the message

SPF, DKIM, & DMARC Design Decisions for all agencies and implementation types

Decision Point	Design Decision	Justification
SPF	Configured	Configuration of SPF record(s) are required as a baseline for the deployment.
DKIM	Configured	DKIM is a public/private key signing process used to verify the content of an email. DKIM signing is enabled on emails originating from an organisation’s domains.
DMARC	Configured	One DMARC policy is to be configured per Agency domain. This is to be configured at the gateway that the Agency consumes. DMARC records are configured for all domains such that emails are rejected if they fail SPF or DKIM checks.

Accepted Domains

Accepted Domains are SMTP namespaces configured within Exchange Online. Only emails addressed to users within the nominated domains are accepted.

Accepted Domains consist of the following types:

• Authoritative Domains - Authoritative Domains are domains where the Exchange Organisation accepts messages addressed to recipients and is responsible for generating non-delivery reports. On creation of an Exchange Online organisation the tenant domain Fully Qualified Domain Name (FQDN) and the <tenantname>.onmail.onmicrosoft.com FQDN are automatically populated as an Authoritative Domains; and
• Relay Domains - Relay Domains are often called Non-Authoritative Domains. The Exchange Organisation will accept the messages addressed to the recipients; however, it is not responsible for generating non-delivery reports. Hybrid Exchange leverages Relay Domains and mail connectors to relay messages between both on-premises infrastructure and Exchange Online.

Accepted Domain Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Configure Additional Accepted Domains	Configured	Required to integrate with additional agencies. Any additional Agencies that require access to the system are to be included.
Authoritative Domains	Configured	The <agency-tenant>.onmicrosoft.com authoritative domain is created during the enablement of Office 365 and represents the Exchange Online Organisations SMTP address space. The additional authoritative domains are required as each Agency will have a corresponding authoritative domain.

Additional Accepted Domain Design Decisions for hybrid implementations

Decision Point	Design Decision	Justification
Relay Domains	Configured	This setting is required to be configured in a Hybrid Exchange scenario.

Remote Domains

Remote Domains allow administrators to control the type of replies and format of messages users send to the destination domain.

Administrators can configure Exchange to allow (or block) the following:

• Out of Office messages
• Automatic replies and forwards
• Read or delivery receipts
• Non-delivery report to a specified domain

The default remote domain will apply the same settings to all messages; however, administrators can configure specific settings for specific domains.

Remote Domain Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Configure Remote Domains	Default configuration applied	The default configuration within Exchange Online will be leveraged.

Remote Domain Configuration for all agencies and implementation types

Policy Setting	Configuration	Description
Name: *
Domain Name	* Note - * means all external agencies	Name of the remote domain.
Out of Office Automatic Replies	Allow Only External Out of Office replies - Selected	Allows the limiting of the type of client automatic replies.
Automatic Replies	Allow Automatic Replies – Unchecked Allow automatic forwarding - Unchecked	Allows the limiting of automatic replies and automatic forwards.
Message Reporting	Allow Delivery Reports - Ticked Allow Non-delivery Reports – Ticked Allow Meeting Forward Notifications - Unchecked	Allows the limiting of delivery reports, no-delivery reports, and meeting forward notifications.
Use rich text format	Follow User Settings - Selected	Allows the control over message format.
Supported Character Set	None	Allows the control over the character set.

Certificates

There are additional specific certificate requirements when configuring Exchange Hybrid that only apply to agencies implementing a hybrid configuration as Exchange Online encrypts all traffic to the on-premises environment. Agencies implementing cloud only environments that do not leverage an on-premises Exchange Server do not need require these configurations.

The following certificates are associated with an Exchange Hybrid deployment:

• Azure Active Directory Connect (Azure AD Connect) with Active Directory Federation Services (AD FS) – a third party certificate from a Trusted Authority (CA) is required to establish a trust between web clients and federations server proxies used to sign and decrypt security tokens
• Exchange Federation – a self-signed certificate is used to create a secure connection between the on-premises Exchange server and Azure Active Directory authentication
• Exchange Services – a third party certificated from a Trusted Authority (CA) is required to secure the TLS communication between Exchange servers and clients. These include Outlook on the web, Exchange ActiveSync, Outlook Anywhere and secure message transport
• Existing Exchange Servers – might use self-signed or certificates issued by a Trusted Authority (CA) depending on Exchange server certificates. These certificates may need updating for Exchange Hybrid

Suggested FQDNs for hybrid deployment

Service	Suggested FQDN	Field
Primary shared Simple Mail Transfer Protocol (SMTP) domain	agency.gov.au	Subject name
Autodiscover	To be determined by the Agency. Label that matches the external Autodiscover FQDN on the Exchange Client Access server, such as Autodiscover.contoso.com	Subject alternative name
Transport	To be determined by the Agency. Label that matches the external FQDN of the Edge Transport servers, such as edge.contoso.com	Subject alternative name

Additional Certificate Design Decisions for hybrid implementations

Decision Point	Design Decision	Justification
Hybrid Server Certificate	New certificate to be purchased	As the only new service which is being configured is the Exchange Hybrid Server, that is the only certificate which requires validation and updates as required.

Exchange Online

Microsoft Exchange Online is a cloud-hosted messaging solution that has the capabilities of on-premises Exchange services. Exchange Online provides email, calendar, contacts, and tasks. Exchange Online supports mailbox delegation, where a delegate can have send-on-behalf and management rights over other mailboxes. Shared mailboxes can be assigned to and administered by many users. Application mail sending is supported where the application can authenticate against the Simple Mail Transport Protocol (SMTP) message submission to users inside the managed environment or authenticated SMTP message relay to addresses outside the managed environment.

Agencies should also refer to Mail Flow and Gateway for more information on mail flows, mail gateways and the use of GovLink.

Mail Migration

The implementation of Exchange Online can be coupled with a migration from the existing on-premises Exchange infrastructure. If a migration is not required, the deployment is referred to as a greenfield deployment of Exchange Online.

There are three migration options:

• Hybrid Migration – Often referred to as a staged migration, is where the on-premises Exchange environment is extended to Office 365 through departmental relationships or federation. During migration user mailboxes will be spread between the online and on-premises environments, this necessitates planning to ensure free/busy, calendar and mailbox sharing all continue to work.
• Cutover Migration – A cutover migration is only recommended for organisations with less than 150 mailboxes and occurs over one or a few days. During this period email access may be unavailable. Prior to the migration event, a connection between the on-premises Exchange organisation and Exchange Online needs to be established.
• PST Migration – A Personal Storage Table (PST) migration is where PST files with a mapping file are either shipped to or uploaded into Office 365. The Exchange Online instance is a greenfield deployment with no configuration required on the on-premises Exchange environment.

Mail Migration Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Office 365 Tenant	Single tenant	Exchange Online services will be hosted within the Agency’s secure Office 365 tenant.

Additional Mail Migration Design Decisions for cloud native implementations

Decision Point	Design Decision	Justification
Deployment Type	Exchange Online only	Exchange Online is suitable for agencies that are not leveraging any on- premises equipment.

Additional Mail Migration Design Decisions for hybrid implementations

Decision Point	Design Decision	Justification
Deployment Type	Hybrid Migration	User mailboxes should be migrated from the on-premises Exchange environment.

User Mailbox Configuration

User Mailboxes are Exchange Mailboxes that are associated with a user account. Usually one mailbox is associated to one user account.

User mailboxes can be configured to:

• Allow or disallow Internet Message Access Protocol (IMAP) and Post Office Protocol (POP) connections to them
• Prevent mail from deletion
• Control ActiveSync connections to them
• Control mail size limits
• Control the use of mail archives

The above configuration can be completed on all new mailboxes using a Client Access Services (CAS) Mailbox Plan. A CAS Mailbox Plan is used to configure settings when a licence is assigned to a new user. If the licence is changed, the CAS Mailbox plan linked to that new licence is applied. CAS Mailbox plans will be inherited from the existing Agency plans.

In addition to the above mailbox configuration, by default, standard user accounts have access to Exchange Online via Exchange Online PowerShell . ACSC guidance to disable unneeded features requires that this feature be disabled.

User Mailbox Configuration Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Disable IMAP	Configured	IMAP will be disabled to meet ACSC guidance to disable unneeded features.
Disable POP	Configured	POP will be disabled to meet ACSC guidance to disable unneeded features.
Exchange Mailbox Size	100GB per user	Included with Office 365 E3 / E5 licencing.
Language	English	The default language is English, users will have the ability to adjust this if required.
Default time zone	GMT +10	The default time zone is GMT +10 however this will be adjusted based on user location.
Exchange Message Size Limits	Up to 90MB	Default setting. Note that message limits may be smaller when sending messages to external mail recipients (can be as low as 10MB).
Custom Primary SMTP Addressing	first.last@agency.gov.au Usernames are recommended to follow the Universal Principal Name (UPN) format of the user, which is first.last@<agency>.gov.au	The primary SMTP address will be changed from first.last@<tenant>.onmicrosoft.com to ensure email continues to function in the same manner
Exchange Online PowerShell	Disabled for standard users	Standard users have no need to access Exchange Online via Powershell

Authentication Policies

Authentication policies control the authentication methods which can be used to access Exchange Mailboxes.

Authentication polices can be leveraged to protect the organisation from brute force and spray attacks. To protect against this, Basic Authentication can be blocked. Basic authentication is where a username and a password are leveraged for client access requests.

Blocking Basic Authentication forces clients to use Modern Authentication. Blocking Basic Authentication can cause issues when clients within the environment do not support Modern Authentication. If this occurs, it is recommended to investigate whether the client can be upgraded to support Modern Authentication. If it can, then it is recommended that the client be upgraded. If it cannot then a separate authentication policy can be leveraged enabling Basic Authentication for that client only.

Authentication Policy Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Basic Authentication	Disabled	Basic Authentication has known exploits, Modern Authentication is preferred.
Authentication Policy Configuration	Configured	Authentication Policy will be deployed to meet the security requirements of the Agency and be deployed in conjunction with the Agency security requirements.

Outlook on the Web Policies

Formerly known as Outlook Web App or Outlook Web Access, Outlook on the Web (OWA) policies, are used to control the availability of features and settings in Outlook on the Web. There are no security concerns with enabling OWA however agencies may wish to consider internal agency policies to inform decisions. A decision to disable OWA will not alter an agency’s cyber security posture.

A mailbox can only be assigned one OWA policy and every mailbox must have a policy assigned.

Features and settings which can be controlled by an OWA policy include:

• Third party file provider integration
• Office 365 group creation
• Microsoft Satisfaction survey prompts

OWA Policy Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Outlook on the Web	Enabled	OWA will be enabled to allow users to access their email in a flexible manner
Third party file provider integration	Disabled	Only Microsoft file providers are approved for integration, no third-party file providers will be configured. This decreases security risk associated with third-party tools.
Office 365 group creation by users	Disabled	Groups can only be created by administrators, not users. This will ensure that the GAL is the most up to date and that there is a consistent naming convention utilised.

Mailbox Archive

Office 365 Mailbox Archives provide an unlimited email storage space for users. A mailbox archive is an additional mailbox storage space.

This archive can be accessed through the web portal or the Outlook client. Users can move or copy mail between their primary and archive mailboxes. Administrators can enable archive and deletion policies. These policies automatically move mail to the archive and, if required, delete mail from the archive when the set criteria are met. Mailbox archives are also subject to retention policies.

Mailbox Archive Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Mailbox Archive	Enabled	The archive mailbox is required to control primary mailbox cache sizes.
Mailbox Archive Policy	Enabled	The use of automated archive mailbox policies improves the user experience and ensures that primary mailbox sizes are controlled.
Archive configuration	Configured

Mailbox Auditing

Mailbox Auditing provides visibility into the access and modification of user mailboxes by owners, delegates, and administrators.

Once enabled on a user’s mailbox, the activities subject to audit appear within the Office 365 audit log. This information is then available for security to review and run analysis. It is recommended that this audit log be exported to a centralised logging service.

Mailbox Auditing Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Mailbox Auditing	Configured	An event log auditing process, and supporting event log auditing procedures, is developed and implemented covering the scope and schedule of audits, what constitutes a violation of security policy, and actions to be taken when violations are detected, including reporting requirements.
Centralised Logging Facility	Not Configured	Agencies should consider their operational and security requirements around the use of a SIEM separately to the implementation of the Blueprint. This design will implement Office ATP and Defender ATP which audit most Office and Defender logs for up to two years. These technologies send alert emails to Global Administrators and selected Office 365 administrators.

Mailbox Auditing configuration applicable to all agencies and implementation types.

Configuration	Value	Description
User Mailbox and Shared Mailbox Audit Configuration
Admin Audited Actions	ApplyRecord Copy Create FolderBind HardDelete MessageBind Move MoveToDeletedItems RecordDelete SendAs SendOnBehalf SoftDelete Update UpdateCalendarDelegation UpdateFolderPermissions UpdateInboxRules	All available audit actions will be selected in order to provide the required visibility of changes made to a mailbox.
Delegate Audited Actions	ApplyRecord Create FolderBind HardDelete Move MoveToDeletedItems RecordDelete SendAs SendOnBehalf SoftDelete Update UpdateFolderPermissions UpdateInboxRules	All available audit actions will be selected in order to provide the required visibility of changes made to a mailbox.
Owner Audited Actions	ApplyRecord Create HardDelete MailboxLogin Move MoveToDeletedItems RecordDelete SoftDelete Update UpdateCalendarDelegation UpdateFolderPermissions UpdateInboxRules	All available audit actions will be selected in order to provide the required visibility of changes made to a mailbox.
Office 365 Group Mailbox Audit Configuration
Admin Audited Actions	Create HardDelete MoveToDeletedItems SendAs SendOnBehalf SoftDelete Update	All available audit actions will be selected in order to provide the required visibility of changes made to a mailbox.
Delegate Audited Actions	Create HardDelete MoveToDeletedItems SendAs SendOnBehalf SoftDelete Update	All available audit actions will be selected in order to provide the required visibility of changes made to a mailbox.
Owner Audited Actions	HardDelete MoveToDeletedItems SoftDelete Update	All available audit actions will be selected in order to provide the required visibility of changes made to a mailbox.

Journaling

Journaling within Exchange is the recording of email communications as part of an organisation’s retention strategy.

Journaling can assist with achieving compliance with government regulations. A Journal rule can be scoped to:

• Internal messages only
• External messages only
• All messages
• Specific recipients

Office 365 supports the use of journaling with the caveat that an Exchange Online mailbox cannot be used as a journaling mailbox. When configuring a mailbox for journaling, it must reside on an Exchange server. Journal reports can be delivered to a separate system to the Exchange Online instance.

Within Office 365, additional options are available to be leveraged in an organisation’s retention strategy. These include:

• Retention Policies
• Litigation hold

Retention Policies can also be leveraged across the Office 365 organisation, whereas litigation hold is configured on a per-mailbox basis. These options reduce the complexity and management overhead involved with recording email and backing up to separate systems.

Journaling Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Configure Journaling	Not Configured	In place of Journaling, Litigation hold and retention policies in conjunction with eDiscovery will be leveraged by the Agency to meet investigation requirements.

Litigation Hold

Litigation hold preserves a mailbox and its contents from being modified or removed for e-Discovery purposes. A user can continue to send and receive email whilst litigation hold is enabled, even delete an item from the mailbox, and Office 365 will retain the items for discovery purposes.

Litigation hold is not enabled by default, and legal teams will need to proactively enable the feature to avoid users potentially deleting any critical data elements. You can also specify the duration for the hold, this is calculated from the date a mailbox item is received or created. If a duration is not set, items are held indefinitely or until the hold is removed.

Litigation hold is not an alternative to backups. While it is true that it keeps a copy of your data elements it is not saved in a separate location and cannot be restored to its original location.

Litigation Hold Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Litigation hold	Configured as required on selected users	Litigation hold requirements are unique to each Agency and user.

Shared Mailboxes

A Shared Mailbox is a mailbox which allows one or more users read and send messages. Shared Mailboxes also allow the sharing of a calendar between multiple people.

Within Office 365 shared mailboxes do not require a licence to be assigned to them unless the mailbox has over 50GBs of data.

Unlike user mailboxes, within AD, these mailboxes are represented by a disabled user account. These accounts can be enabled however this poses a security risk as the mailbox account is not related to a single user.

User access to the mailbox is provided using mailbox delegation rights (Full Access, Send As, Send on Behalf). These rights can be assigned either directly or using a mail enabled security group.

Shared Mailbox Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Shared mailbox delegation (Full Access, Send As, Send on Behalf)	Configured via mail-enabled Security groups which are hidden from the Global Address book	Mail-enabled security groups limit the management overhead associated with mailbox delegation when compared to direct delegations. A security group is required to be mail-enabled to appear within Office 365.
Naming standard for security groups	Configured	To distinguish between a security groups managing a shared mailbox a naming standard will be followed. e.g. GMSG_<mailboxname>
Shared Mailbox user account	Disabled	Default configuration. Accounts will remain disabled to reduce system attack surface.

Resource Mailboxes

A Resource Mailbox is a mailbox which is assigned to a resource as opposed to a user.

Resource Mailboxes have two types:

• Room mailboxes – Used for meeting rooms
• Equipment mailboxes – Used for non-location specific resources such as computers, projectors, microphones, or cars

Users book these resources using meeting requests. Resource Mailboxes can be configured to accept or decline the request based on their availability.

Room Mailboxes can be sorted into lists using Room Lists. Room Lists are leveraged to simplify the booking process by grouping all rooms that meet a certain requirement together (Room lists are usually configured by location). When a user books a meeting, they can select the appropriate room list and then see the available rooms for that time.

Resource Mailbox Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Room Mailboxes	Configured	There is a requirement for booking rooms within the solution. Rooms will be configured with a mailbox so that users can book them through their calendars.
Equipment Mailboxes	Configured	There is a requirement for booking equipment within the solution. Equipment will be configured with a mailbox so that users can book them through their calendars.
Room Lists	Configured	There is a requirement for booking rooms within the solution. Room Assets will be configured with a list so that users can book them through their calendars.
Naming standards for Resource mailboxes	Configured e.g. RES_<location>	To distinguish between resource mailboxes a naming standard will be followed for each resource mailbox.

Distribution Lists

A distribution list is a grouping of mail recipients that is addressed as a single recipient. Distribution lists are used to send e-mail to groups of people without having to enter each recipient’s individual address. Distributions lists can be established to receive and distribute internal, external, or internal and external email.

This saves the sender from needing to enter each individual email address when emailing a group. These groups/lists are generally leveraged for emailing an entire team or project. Only internal agency employees can send emails to the “Agency-all” distribution list.

Distribution lists are created in different ways depending on the Exchange architecture:

• Cloud Deployments - For cloud only deployments, distribution lists are created within Office 365
• Hybrid Deployments - For hybrid deployments, distribution lists can be created both within Office 365 and on-premises. upon-premises lists are then synchronised to Office 365. The on-premises method has the benefit of living with the user identity source of truth however it does create complexity when it is not managed in the same location as Exchange

Management of Distribution lists can be streamlined through the enforcement of a Naming Policy. A Distribution list Naming Policy allows the enforcement of a consistent naming strategy across Office 365 Groups. It consists of two parts:

• Prefix-Suffix Naming Policy – Setting of prefixes or suffixes for groups names. The prefixes/suffixes can be either fixed strings or user attributes
• Custom Blocked Words – Blocking of words in the name based on a custom list

Distribution List Design Decisions for cloud native implementations

Decision Point	Design Decision	Justification
Distribution Groups creation	Cloud Created	Management activities for Exchange Online will occur within the portal. The use of cloud created distribution groups also allows for the groups to be upgraded to Office 365 groups at a later stage.
Distribution Naming Policy	Configured The naming convention will be AgencyName-PolicyName	Naming policies streamline the management of Distribution lists and allow for groups to be easily sorted.

Distribution List Design Decisions for hybrid implementations

Decision Point	Design Decision	Justification
Distribution Groups creation	Hybrid Created	Management activities for Exchange Online will occur on the on-premises Exchange server.
Distribution Naming Policy	Configured	Naming policies streamline the management of Distribution lists and allow for groups to be easily sorted.

Office 365 Groups

Office 365 Groups are an extension on the traditional mail Distribution Lists, Mail-enabled Security groups and Shared Mailboxes.

Office 365 Groups allow members to collaborate with a group email, shared a workspace for conversations, files, calendar events, and a Planner. Unlike Shared Mailboxes, Office 365 groups can be accessed via mobile applications. Office 365 groups are also integrated with Microsoft Teams and are created when a Team is created.

Membership of an Office 365 Group can be dynamically updated using user attributes available in Azure AD. This removes some of the management overhead involved with managing the traditional group structures.

Management of Office 365 Groups can be streamlined through the enforcement of a Naming Policy, Office 365 group expiry, and creation restrictions. An Office 365 Group Naming Policy allows the enforcement of a consistent naming strategy across Office 365 Groups. It consists of two parts:

• Prefix-Suffix Naming Policy – Setting of prefixes or suffixes for groups names. The prefixes/suffixes can be either fixed strings or user attributes; and
• Custom Blocked Words – Blocking of words in the name based on a custom list.

In conjunction with the Naming Policy, Office 365 groups can also be given expiration dates. This assists with unused group clean-up activities. The expiration period commences on group creation and can be renewed at the end of the period (The owner or contact for groups with no owners has 30 days to renew the group). When a group expires, it is soft deleted for 30 days. Retention policies will however hold the data for the period of the retention policy. An expiration policy can be applied globally to all groups or to specific groups.

Office 365 Groups, by default can be created by any user. This can be restricted to Administrators and members of a security group. This restriction prevents the needless creation of groups. It is advisable to develop a workflow to control the provisioning process.

Office 365 Group Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Office 365 Group creation restrictions	Configured Only administrators can create/configure Office 365 groups.	This will ensure that groups are approved before being created, ensuring all groups have a purpose. This setting also affects Exchange, SharePoint and Teams.
Naming Policy	grp-AgencyName-SecurityGroup-Role	Exchange groups will be named like the following AgencyName-Agency e.g. grp-DTA-ExchangeMailbox-ITHelpdesk
Group Expiration	All groups - annually	Group Expiration is required to simplify the management overhead associated with groups and to limit Azure AD clutter.

Address Book / Address List

The Outlook Address Lists, Global Address List (GAL), and Offline Address Book (OAB) are collections of mail-enabled objects.

They are leveraged for recipient lookup operations (i.e. When a user leverages either the Address book or Check names tools in Outlook). The types of mail-enabled object collections are as follows:

• GAL – The GAL is automatically created by Exchange and lists all mail-enabled objects. (The GAL is available by default to all users)
• OAB – The OAB is an offline version of the GAL leveraged by clients in Cached Mode
• Outlook Address List - An Outlook Address List is a subset of the mail-enabled objects. By default, a number of Address Lists are created, however, additional Address Lists can be created as required

Address Book and Address List Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Custom Address Lists	Configured	Custom address lists can be configured by Agency administrators, however one initial custom list, AgencyName-All, should be manually created.
GAL and OAB	Generated	These will be generated so that users can send emails within the organisation in accordance with Microsoft best practice.

SharePoint Online

SharePoint Sites

SharePoint Online provides the ability to create Intranet sites and Team Sites for groups or agencies to collaborate and manage their documents. A SharePoint site allows members of a team or from other teams to contribute content on a single platform. The information is limited to the members of the team or project.

The creation and storage sizing of SharePoint online sites can be controlled. Out of the box, users can create SharePoint sites and these sites have no storage limits applied. Without restriction there is potentially a large management overhead so we have set a 200GB default which agencies can override.

Administrators can put controls in place which restricts who can create a SharePoint site and set the size requirements.

SharePoint Site Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
SharePoint site naming convention	Avoid spaces and special characters in site collection naming	Spaces and special characters can cause problems with indexing and extend the length of the path. Short names are easier to remember
Configure Site Storage limits	Configured	Larger storage can increase management. This can be manually set by SharePoint Administrator. Suggest 200GB
Block access from unmanaged devices	Configured	Allow limited web only access. Default settings.
Enable Idle Session sign outs	Sign out users after 1 hr Give users this much notice before signing out: 5 minutes	Default settings
Only allow access from specific IP address locations	Not configured	Access to be controlled via Conditional Access policies.
Only allow access from apps that use modern authentication	Enabled	Default settings

SharePoint Hybrid

In a hybrid configuration SharePoint Online integrates with an existing on-premises SharePoint Servers, extending the functionality and access between the two environments. Enhanced search results and site redirection provides administrators the control on which location a user access information.

SharePoint hybrid offers the following options for a hybrid configuration:

• Hybrid Federated Search – In a Federated Search configuration, the index for documents remains in the same system as the data. A SharePoint server can display results from SharePoint Online by making a remote SharePoint query, and users can also search SharePoint on-premises directly from SharePoint Online.
• Hybrid Cloud Search – In Cloud Search, the index of the SharePoint Server is pushed and merged with the SharePoint Online index. All the Content Processing and Analytics are done in Office 365, where the index is stored.
• Hybrid Site following – Hybrid site following can be configured to send users from the on-premises SharePoint Server to the equivalent service in Office 365.

SharePoint Hybrid Design Decisions for hybrid implementations

Decision Point	Design Decision	Justification
SharePoint Hybrid	SharePoint Hybrid Search will be configured.	To allow searching capabilities between SharePoint on-premises and SharePoint Online.

Application Management

Application management allows the Agency to control who can purchase third party applications for SharePoint Online. These apps can be purchased from Microsoft App Store and used within SharePoint Online itself.

SharePoint default methods of displaying and sharing of sharing data are available. Third party applications may circumvent controls or auditing and provide other methods of displaying or sharing of SharePoint data. Any third-party applications will need to be validated for compliance.

The blueprint requires the Office 365 tenant to be rated up to Protected. The Agency must ensure information stays within the tenant to control the follow of information between its devices and Office 365 tenancy.

Application Management Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Users to have the ability to get apps from marketplace	Not Configured	Only administrators are approved to assign or purchase application.
Allow third party apps from the store be open office documents in the browser	Not Configured	This setting increases the security of the solution by ensuring documents in the browser cannot start third party apps for Office.

Web Parts

SharePoint Online provides spaces for users to customise their SharePoint page to include web parts into the page. Web Parts are additional functional parts that can be added into SharePoint pages to enhance productivity and usability for the site.

Web Parts are client-side applications that can be added into SharePoint Online. The document considers these two out of the box sets of webparts that needs to be considered as a part of the design decisions:

• Microsoft published webpart
• Third party published webpart

Web Part Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Microsoft published webpart	Enabled	Microsoft published webparts cannot be disabled in SharePoint.
Third Party published webpart	Disabled	Third party web parts will be disabled due to potential unsecure data flow outside of Office 365. If a third party published webpart is identified for use in future, the organisation will undertake a risk assessment before implementation.

Sharing and Access Controls

Sharing and Access controls provide granular control over external sharing and access to SharePoint Online. Sharing and Access control is essential for securing SharePoint Online document and information sharing.

Access to SharePoint Sites can be controlled through a variety of means to ensure that the data of the sites is protected. This includes the configuration of:

• Only allowing access from specific IP address locations
• Only allowing access from apps that use modern authentication
• Blocking access from devices which are not managed by the organisation through Intune
• Sites can be further secured through the implementation of Idle session timeouts. Idle session timeouts essentially act to log a user out of SharePoint after a period of inactivity

Access Controls provides an administrative tool to restrict access contents in SharePoint.

Sharing and Access Control Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Sharing Controls	Configured	Sharing to external users will be disabled. Documents within SharePoint Online can only be shared with internal users. Collaboration and sharing will be achieved using Teams.
Access Controls	Configured	Access to SharePoint Online will be controlled on a device level to ensure data is being accessed from approved devices.

Sharing Configuration applicable to agencies leveraging a cloud native implementation

Configuration	Value	Description
External Sharing
SharePoint	New and existing guests	Guest access is available in accordance with Collaboration in the DTA – Platform Design document
More external sharing settings	Limit external sharing by domain Guests must sign in using the same account to which the sharing invitations are sent	Checked. Add domains that are allowed Checked.
OneDrive	Only people in your organisation	No external sharing allowed.
File and folder links
Choose the type of link that is created by default when users get links	Specific people	Internal link which can only be sent to people in your organisation.
Other settings
Show owners the names of people who viewed their files in OneDrive	Checked	This is to ensure owners are aware of external users who have access to the document.
Let site owners choose to display the names of people who viewed files or pages in SharePoint	Checked	Permits display of activity on SharePoint sites to foster collaboration.
Use shorter links when sharing files and folders	Checked	Ensure URL are short and concise.
Default link permission	Edit	Users will have edit permissions by default to increase usability. If view permissions are required, this is also available.

Sharing Configuration applicable to agencies leveraging a hybrid implementation

Configuration	Value	Description
External Sharing
SharePoint	Only people in your organisation	No external sharing allowed.
OneDrive	Only people in your organisation	No external sharing allowed.
File and folder links
Choose the type of link that is created by default when users get links	Only people in your organisation	Internal link which can only be sent to people in your organisation.
Other settings
Show owners the names of people who viewed their files in OneDrive	Checked	This is to ensure owners are aware of external users who have access to the document.
Let site owners choose to display the names of people who viewed files or pages in SharePoint	Checked	Permits display of activity on SharePoint sites to foster collaboration.
Use shorter links when sharing files and folders	Checked	Ensure URL are short and concise.
Default link permission	Edit	Users will have edit permissions by default to increase usability. If view permissions are required, this is also available.

Access Control Configuration applicable to all agencies and implementation types

Configuration	Value	Description
Unmanaged Devices
Unmanaged Devices	Allow limited, web only access	Provide restricted access to devices that are not Intune compliant.
Idle session time-out
Sign out inactive users automatically	On	Controls idle time on users logged onto a device.
Sign out users after	1 hour	Ensure users are logged out after an idle time.
Give users this much notice	5 minutes	Ensure users are notified before they are signed out.
Network Location
Allow access only from a specific IP address range	Off	Define a trusted network boundary by specifying one or more authorized IP address ranges.
Apps that do not use modern Authentication
Apps that do not use modern Authentication	Block access	Some third-party apps and previous versions of Office cannot enforce device-based restrictions. Use this setting to block all access from these apps.

Legacy Features

Legacy features allow for backwards compatibility for legacy capabilities from SharePoint on-premises to SharePoint Online. Legacy features are enabled only when there is a reason to do so, as they restrict the features available in SharePoint Online.

SharePoint Online provides legacy features by default to ensure backwards compatibility with legacy SharePoint on-premises solution.

Legacy Features Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
InfoPath	Not configured	InfoPath is going to be deprecated and it is recommended that InfoPath forms to be redeveloped into PowerApps in Office 365
Records Management	Not configured	Records Management administrative screen provides configuration settings to route files from a SharePoint Document Library to a centralised SharePoint Records Management site. This is to support the traditional Centralised records management system in SharePoint.
Secure Store Settings	Not Configured	Secure Store in SharePoint Online provides a key vault to store all sensitive information in SharePoint. This is primarily used by InfoPath to store sensitive keys and passwords. It is recommended to use Azure Key Vault to store sensitive information.
Business Connectivity Settings	Not configured	Business Connectivity Settings provides SharePoint on-premises ability to consume information from third party OData Information store. It is recommended to use Power BI to consume third party data and publish it to SharePoint Online.
Search	Not configured	Search provides legacy support on crawled properties, managed properties and custom configuration required.
Term Store	To be configured based on Agency existing term store to support existing taxonomy if required.	Term store is configured for the solution if required by Agency. Term store provides a consistent taxonomy and ontology for the Agency. This enables ease of search for information within SharePoint.
User Profile	Not configured	User Profiles provide legacy support of custom properties for users and complied audience.
Hybrid Picker	Not configured	This is to ensure hybrid term stores are synchronised between SharePoint Online and on-premises.

OneDrive for Business

OneDrive for Business is a cloud-based, secure, personal document store. It allows storage and access of files from any approved device, allows offline editing, simple organisational collaboration, search tools, and advanced encryption and security features. The sharing of these documents can be controlled to allow or disallow sharing with external parties.

OneDrive data can be configured to automatically synchronise data, ensuring the user does not need to download files every time they wish to access them.

On deletion of a user’s account content can be deleted or retained for a specified period.

Sharing

The OneDrive sharing administration screen provides granular configuration. Controlling OneDrive sharing ensures that data is shared internally and externally in a secure manner.

OneDrive provides end users the ability to securely store their personal data in Office 365. The design considers that OneDrive is used for personal storage and sharing within the Agency.

OneDrive for Business Sharing Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
External Sharing	Disabled	Sharing to external users will be disabled. Collaboration and sharing will be achieved using Teams.

OneDrive sharing configuration applicable to all agencies and implementation types

Configuration	Value	Description
Links
Default Link Type	Internal: Only people in your organisation	No sharing is permitted outside the Agency.
External Sharing
SharePoint	Only people in your organisation	No external sharing allowed.
OneDrive	Only people in your organisation	No external sharing allowed.
Advanced settings for external sharing
Allow or block sharing with people on specific domains	Unchecked	Specific domains are not defined, meaning that content is permitted to be shared with all users within the directory (internal).
External users must accept sharing invitation using the same account that the invitations were sent to	Checked	Required to ensure users are authenticated before accepting sharing invitation
Let external users share items they don’t own	Unchecked	Restricts external users (guests) from re-sharing content.
Other settings
Display to owner the names of people who viewed their files	Checked	Ensure owner is are aware of who it has been shared with

Storage and Synchronisation

OneDrive and SharePoint can synchronise content locally through the OneDrive for Business client.

Content can be “pinned” for offline use, ensuring that specific content is available offline, and changes are merged later.

The Sync Administration screen provides control Synchronising of File in OneDrive and SharePoint.

The sync client is required to provide the ability for end users to work offline from Office 365.

Storage and Synchronisation Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Synchronisation client	Configured	The Agency must use the OneDrive sync client to provide an offline file capability.
Storage Limitations	Configured	To assist the Agency in managing user data specific storage and retention limitations will be configured.

Storage and Synchronisation Configuration applicable to all agencies and implementation types

Configuration	Value	Description
Show the Sync button on the OneDrive Website	Checked	The synchronise button allows OneDrive files to be synced locally through the OneDrive for Business client.
Allow syncing only on PC joined to specific domains	Checked	Access to OneDrive content and synchronisation is controlled via Conditional Access, so this setting is not configured. Domain GUIDs to be provided by the Domain.
Block syncing of specific file type	Unchecked	File type synchronisation is not restricted. Office ATP and Defender ATP provides additional protection against malicious files.
Days to retain files after user account is marked for deletion	365 days	Must align with the Agency internal record keeping policies.
Limit OneDrive user Capacity	1024GB	Default setting.

Notifications

Notifications provide OneDrive users with information about how OneDrive is operating. The notification administration screen provides notification control to OneDrive owners.

The design considers notification and alerting of users for all shared documents in the organisation to ensure users are aware of the status of shared documents.

Users can be notified by email when:

• Other users invite additional users
• External users accept invitations
• An anonymous access link is created or changed

OneDrive for Business Notification Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
User notifications	Configured	Notifications will be configured to provide users with relevant information.

OneDrive for Business Notification Configuration applicable to all agencies and implementation types

Configuration	Value	Description
Display device notification to users when OneDrive files are shared with them	Checked	OneDrive will notify users when new files are shared with them
E-mail OneDrive owners when
Other users invite additional external users to shared files	Checked	OneDrive will notify users when a user re-shares a document to an external user (guest)
External users accept invitations to access files	Checked	OneDrive will notify users when external users accept an invitation to access files.
An anonymous access link is created	Checked	OneDrive will notify users when an anonymous access link is created

Content Migration

The implementation of OneDrive for Business can be coupled with a migration from an existing on-premises SharePoint farm infrastructure.

This migration can take the form of one of the following:

• OneDrive (SharePoint 2010/2013) – Administrators can move an existing OneDrive site hosted to SharePoint Online. Administrators can also leverage the capability of a Hybrid configuration to automatically redirect users to their OneDrive for Business post migration.
• Network and local file shares – Most users will have a personal drive or a designated location on the network to save work which may not have a function assigned. To free up network storage and extend the ability to access files in the cloud, administrators can move files from a specific network path to the user’s OneDrive for Business site.

If a migration is not required, the deployment is referred to as a greenfield deployment.

Access to OneDrive can be controlled to ensure Agency data is protected. This includes the configuration of:

• Only allowing access from specific IP address locations
• Only allowing access from applications that use modern authentication
• Only syncing to PCs joined to a specific domain

On deletion of a user’s account content will be deleted. The deletion period can be customised however it is recommended that the data be archived in an external system or migrated to a SharePoint Site.

Content Migration Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Deployment Type	Migration of data is out of scope for the blueprint however Microsoft provides vendor guidance on possible migration paths for the agency	Migration method is dependent on the outcome of an assessment of quantity and type of data to be migrated.

Microsoft Teams

A Team in Microsoft Teams is a grouping of users who are working together to achieve an outcome. It allows users to communicate together through chat and meeting functions as well as collaborate on documents. Within the Team, Channels can be used to breakdown the work into smaller more specific items. These channels can be extended using Bots, Tabs, and connectors.

Microsoft Teams leverages most of the functionality of the Office 365 components. When a Team is created the following artefacts are created out of the box:

• SharePoint Site - A new SharePoint site with the URL format of /sites/<SiteTitle>, with the SiteTitle’s spaces are stripped out.
• Office 365 Group - A new Office 365 Group, which is added into the Azure AD tenant. This is created with the site title as the Group Name.
• Teams email – A new email address per channel can be created. The email inbox is managed centrally by the Microsoft Team services. At the time of writing this document, the email address will have a domain of <custom email inbox>@apac.teams.ms.

Note: This email is not part of Microsoft Exchange Online.

Access

Access to a team is controlled using Office 365 groups located in Azure AD.

When a Team is created, an Office 365 group will be created. Owners of the group are delegated to perform administrative actions across the team, while members can participate in the team but not undertake any administrative actions.

The design considers permissions, roles and responsibility to administer, manage team owners and members within the team.

Microsoft Teams Access Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Team creation permission	Selected administrators	Teams will be created by select administrators to ensure that Teams are created using a documented approval workflow, avoiding Team proliferation. This setting is required as Azure AD group creation is restricted which only allows administrators to create 365 groups, and hence Teams.
Administrative action over Teams after creation	Team Owners	Team Owners will either be selected administrators (for Teams such as branches with many users) or managers and their delegates (such as in a section with relatively small user counts). Team owners will be assigned logically at creation time and updated as required.
Team membership allocation	Manual by administrators or Team Owners	Team membership will be allocated manually initially with dynamic group allocation investigated in a future project phase when the logic for group membership is developed.

Dynamic Security group

Dynamic Security Groups are Azure AD security groups that are populated based on device and/or user attributes.

Dynamic Security groups can be leveraged to control access to locations, services, and features.

The membership of a Dynamic Security group is updated whenever an attribute of a device or user is modified. If the user/device no longer matches the group rule, then that user/device is removed. Conversely if a user/device now matches the group rule they are added. When a user is added the group can be configured so that the added user receives an email notifying them of the addition.

Naming of Dynamic Security groups can be streamlined using a Naming Policy. The Naming Policy ensures that the groups within the environment conform to a standard and their purpose can be easily identified.

Dynamic Security Groups Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Naming Policy	grp-<Agency>-<GroupName>	Assists in MOGs and standardisation of Agency configuration.
Welcome Email	Disabled	The welcome email will be disabled to reduce the amount of generic correspondence being sent to users.

Organisation Wide Configuration

Microsoft Teams is a collaboration platform that enable the Agency to work collaboratively with external agencies. This allows Agency users to collaborate internally, with trusted guest users and set up meetings with external users.

The design will consider the following configurations

• External Access - configures allowable domains to connect to the Agency instance of Microsoft Teams. This also configures Skype for Business integration.
• Guest Access – is when an external user is invited to be a member of the team. Once a team owner has granted someone guest access, they can access that team’s resources, share files, and join a group chat with other team members.
• Teams Settings – configures the default behaviour of all users in the Teams application.

Organisation Wide Configuration Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
External Access	Configured: (Example) Allow dta.gov.au	Allow only dta.gov.au and deny sharing to external users. This will prevent users from setting up meetings with users that are not setup as a Guest of the Agency.
Guest Access	Configured: Guest Access: Enabled	Allows people outside of the agency to access teams and channels.
Teams Setting	Configured Disable all third-party file storage	This is to ensure departmental users do not save file outside of the Office 365 tenant.

Policies & Settings

Microsoft Teams provides ability to create policies around messaging, meetings, calling, video, and guest access. These settings can be configured in policies and assigned to individual users within the organisation.

The list below highlights the policies that can be configured with in teams:

• Teams Policies – Teams policies defines the policy for users to discover private teams and create private channels.
• Meeting Policies – Meeting policies define creations of meetings, audio and video, content sharing, and participant and guest permissions to meetings in Teams
• Live events Policies – Live events policies is used to globally broadcast departmental meeting via teams.
• Messaging Policies – Messaging policies defines behaviour of messages in Teams. The policy defines user capability in sending, editing, deleting, voice messages, and using giphy, stickers, URL preview and translator.
• Teams App – Teams apps policy defines the list of apps that can be used in Teams. Microsoft Teams provides Microsoft published apps and third-party apps that can be used in Microsoft Teams. Agency can control creation of custom apps in Teams.

Policies and Settings Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Team Policy	Configured Disable private channels	Team policy will be left as default settings. Discovered private teams Create private channels
Meeting Policies	Configured Global policy: Disable Whiteboard Automatically admit people – Everyone in your organisation	Meeting policy dictates how audio, videos and applications that are used in a team meeting. Whiteboard will be disable as the application does not meet application residency requirements.
Live events Policies	Configured Who can join live events: Everyone in Organisation	Live events is configured to prevent users outside of the organisation (guest and external users) cannot attend these meeting.
Messaging Policy	Configured	Messaging policy dictates how messaging is used in Teams. These includes usage of Giphy, Memes and stickers in messages.
Teams app	Configured Global Policy: Block specific app from Microsoft Apps * Forms * Yammer Block all Third-Party Apps Block all Tenant Apps	Microsoft Forms and Yammer are hosted in United States. This will cause data sovereignty issue for the Agency All Third-Party Apps are blocked. These Third-Party apps needs to be evaluated individually. Tenant Apps are custom developed applications created by the Agency. This should be enabled if it is required.

Unified Communication

Teams provides a Unified Communication (UC) capability which allows users to participate in audio-visual conferencing in meetings and on-demand.

Teams can integrate with third-party UC products and provide configurable levels of functionality when integrated. Third party UC products will be the responsibility of the agency.

Microsoft Teams can natively provide the following UC features:

• Individual and group voice calls
• Individual and group video calls
• Individual and group chat

Unified Collaboration Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Individual and group voice calls	Configured	Default functionality
Individual and group video calls	Configured	Default functionality
Individual and group chat	Configured	Default functionality

Voice Calling

Enables agencies to make calls to landlines or mobiles within Microsoft Teams.

Telstra Calling for Office 365 avoids the complexity of separate collaboration systems.

The following image describes how connectivity is achieved between Microsoft Teams and Telstra.

Voice Calling Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Telstra calling for Office 365	Not configured	Agencies may require dial in and dial out functionality. This arrangement will need to be organised, paid for and configured by agencies that require this functionality. The configuration will not be covered in this blueprint.
Telstra calling for Office 365	Security Assessment	Agencies wishing to use Telstra Calling for Office 365 or another similar services should undertake a security assessment to ensure that the product addresses their security requirements.

Power Platform

Power Platform combines the power of PowerApps, Power BI, and Microsoft Flow into one business application platform. This enables quick and easy app building and data insights.

Power Apps and Power Automate

Power App and Power Automate are Office 365 tools to develop and create cross platform applications with minimal amount of coding. These tools enable an organisation to create forms, capture information, automate business process and present it in a report to the Agency.

Power Apps and Power Automate is built with an underlying connector that allows application to consume to be displayed and business process to act on this information. These connectors provide ability to consume or leverage on existing business tools. Power Apps and Power Automate connectors can be categorised as:

• Office 365 Connectors – Office 365 Connectors provides data access to Office 365 applications (e.g. SharePoint, Teams)
• Azure Services Connectors – Azure services connector provides Power Apps and Power Automate access to consume Azure Services (e.g. Azure Cosmos DB, Azure Computer Vision).
• Third Party Connectors – Third Party Connectors allows external vendors to provide a service to Power Apps and Power Automate (e.g. Adobe Reader Sign).
• On-premises data connectors – On-premises data connectors allows Power Apps and Power Automate to consume data from a variety of sources.

The following image shows consideration required for authentication process and requirements for each generalised group of connectors. The cloud services connector is required to be registered in Azure platform before it can be consumed in Power App and Power Automate. On-premises data access requires a service account for network access and a database service account access for Power Apps and Power Automate to consume its data.

Power Apps and Power Automate Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Data Policies for Power Automate and Power Apps	Configured Access only to SharePoint, OneDrive for Business, Office 365 Users, Planner, Outlook for 365, and Teams	Data Lost Prevention configures the connectors that can be used in Power Apps and Power Automate The Agency should evaluate the connectors to ensure it fits to the Agency’s requirement.
Environment Administrator	Configured Access to Environment Administrator is assigned to a security group for Power App and Power Automate	Security group should be used to be assigned as Environment Administrator for PowerApps and Power Automate. Environment Administrator will be allowed to create additional environment and configure the connector policies.

Power BI

Power BI is a data visualisation tool which can be leveraged to provide interactive dashboards and reports. It integrates with a variety of data sources to enable the creation of dashboards and reports.

Power BI consists of five components:

• Power BI Desktop - Power BI desktop is a Windows desktop application which allows for the manipulation of data and the creation of reports and dashboards.
• Power BI Service - The Power BI service is a SaaS offering which allows the creation, modification, and sharing of reports and dashboards.
• Power BI Mobile - Power BI mobile is a mobile application which allows for the consumption of reports and dashboards.
• Power BI Report Server - The Power BI report server is an on-premises tool which enables reports to be distributed as required.
• Power BI Embedded – Power BI embedded allows organisation to publish Power BI report to be consumed in a public website.

Inside the Power BI Service, the creation of workspaces, content packs, custom visualisations, and data flows can be controlled both on an enterprise level and a group level. This simplifies management of the service.

Power BI also allows administrators to control the sharing of datasets, content, report publishing, and template apps. This ensures that the sharing of the Agency information is controlled.

Power BI Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Power BI Information Protection	Enabled	Power BI Information Protection leverages sensitive labels to label Power BI Reports
External Sharing	Disabled	External Sharing is disabled to reduce the risk of data spills.
Data Export	Disabled	Export of data is disabled to prevent unauthorised access to the underlying report information.
Third Party integration	Disable	Disable third party integration, such as ArcGIS. This should be evaluated by the Agency to ensure that the data stays within Australia.

Security and Compliance

Office 365 provides Security and Compliance tools which can be utilised to implement an organisation’s Information Management Policy and to assist with information governance. The Office 365 Security and Compliance tools provides the ability to govern and monitor the following components:

• SharePoint Online
• OneDrive for Business
• Teams
• Exchange Online

Alerts

Office 365 contains various out-of-the-box Alert Policies, some of which are dependent on the available Office 365 licence. Alert Policies can be configured to track administrative activities, malware threats, user actions and/or data loss incidents.

Each alert can be configured with the following settings:

• Tracked Activity - The activity that will cause the alert to be generated. For example, sharing a file with an external user, assigning access permissions, or creating an anonymous link
• Activity Conditions - When a tracked activity triggers, additional conditions can be applied to filter out unnecessary alerts. For example, an alert can be triggered only if a certain user performs a task
• When to Trigger - When the above conditions are met, further filtering can be applied to only alert when a certain threshold is met. For example, an alert is only raised if the activity has been performed more than five times
• Alert Category - An alert category is assigned to assist with tracking and managing the alerts generated
• Alert Severity - An alert severity is assigned to assist with tracking and managing the alerts generated. The severity is displayed in the subject line of the alert email
• Alert Notification - An alert can be configured with a list of email addresses that should receive the alert notifications. Daily notification limits can also be configured to ensure an alert receiver is not bombarded with alert emails for the same event. Triggered alerts can also be viewed in the Security & Compliance Center

Alert Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Alert Policies Status	Default Alert Policies enabled	Custom alert policies are not required for the initial phase. Custom alert policies will be considered in a future project phase.

Classification Labels

Classification labels which is located under the Office 365 Security & Compliance Center offers the ability to both control the data flow of sensitive information and control the retention of data. Classifications labels consists of the following:

• Sensitivity Labels – Allow label specific protection policy settings to be enforced
• Retention Labels – Allow label specific retention policy settings to be enforced

Sensitivity labels can be applied in the supported Office applications either in Office 365 ProPlus, Office Online or using the Azure Information Protection (AIP) unified labelling client.

Classification labels are published to users using Label Policies. Label Policies define the users who can utilise the label and the locations within Office 365 where it can be used. Classification labels can be applied in the following ways:

• Manually - The label is applied manually by the end-user
• Automatically applied based on the location of the document - Labels can be configured to automatically apply based on the location of the document. For example, SharePoint
• Automatically applied based on detected Sensitive Information Type - Labels can be configured to automatically apply based on the type of sensitive information found. For example, documents containing Australia driver’s license numbers

At the time of writing, Sensitivity labels cannot be configured to satisfy some specific requirements listed in the Protective Security Policy Framework (PSPF). The PSPF requires the protective marking to be applied to email messages via either:

• Appending the protective marking to the Subject field using a specified syntax (Subject Field Marking)
• Including the protective marking in an Internet Message Header Extension using a specified syntax (Internet Message Header Extension)

Sensitivity labels create a protective marking within the message header and when combined with Exchange mail flow rules the subject can be modified to prepend text in the subject according to the sensitivity.

Email gateway rules are available in the Network Configuration ABAC document. These rules are based on regular expressions and are easily adaptable to vendor specific email gateways.

Classification Label Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Sensitivity Labels	Enabled	Labels will be applied in accordance with the latest guidance from the PSPF.
Retention Labels	Enabled	Labels are recommended to be applied to automate retention configuration and compliance, but the development of specific retention labels is out of scope for this project
Labelling Policy	Enabled	Users will apply labels manually initially. Automatic labelling will be developed in a future project stage after considering potential impacts on backups and productivity changes
Subject line modification	Configured	Exchange mail flow rules are configured to modify the subject line in accordance with PSPF guidance

Retention Policies

Business information is required to be managed in order to comply with industry and government regulations and internal policies that require data to be retained for a certain period.

Office 365 retention policies assist with meeting these requirements by providing the following features:

• Configure policies to proactively decide whether to retain content, delete content, or both retain and then delete the content
• Apply a single policy to the entire organisation or just to specific locations or users
• Apply a policy to all content or just content meeting certain conditions, such as content containing specific keywords or specific types of sensitive information

When information is subject to a retention policy, end-users can continue to edit and work with the content as if nothing has changed because the content is retained in place, in its original location. But if someone edits or deletes content that is subject to the policy, a copy is saved to a secure location where it’s retained while the policy is in effect.

Retention policy Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Retention Policies	Configured	To ensure that legislative data retention requirements are met. This is to ensure that the Agency holds the data for fraud detection.

Retention Policies configuration applicable to agencies leveraging a cloud native implementation.

Configuration	Value	Description
Name: Exchange Indefinite Hold
Retention configuration	Retain the data “Forever”	How long the data is to be held by the policy.
Location	Exchange email – All users included	The Office 365 location where the policy applies.
Name: SharePoint Indefinite Hold
Retention configuration	Retain the data “Forever”	How long the data is to be held by the policy.
Location	SharePoint Sites – All Sites	The Office 365 location where the policy applies.
Name: OneDrive Indefinite Hold
Retention configuration	Retain the data “Forever”	How long the data is to be held by the policy.
Location	OneDrive Accounts – All Accounts	The Office 365 location where the policy applies.
Name: Office 365 Groups Indefinite Hold
Retention configuration	Retain the data “Forever”	How long the data is to be held by the policy.
Location	Office 365 Groups – All Groups	The Office 365 location where the policy applies.
Name: Teams Channel Messages Indefinite Hold
Retention configuration	Retain the data “Forever”	How long the data is to be held by the policy.
Location	Teams channel messages – All teams included	The Office 365 location where the policy applies.
Name: Teams chats Indefinite Hold
Retention configuration	Retain the data “Forever”	How long the data is to be held by the policy.
Location	Teams chats messages – All users included	The Office 365 location where the policy applies.

Retention Policy Configuration applicable to agencies leveraging a hybrid implementation

Configuration	Value	Description
Name: Exchange 3 Years Hold
Retention configuration	Retain the data for 3 years	How long the data is to be held by the policy.
Location	Exchange email – All users included	The Office 365 location where the policy applies.
Name: SharePoint 3 Years Hold
Retention configuration	Retain the data for 3 years	How long the data is to be held by the policy.
Location	SharePoint Sites – All Sites	The Office 365 location where the policy applies.
Name: OneDrive 3 Years Hold
Retention configuration	Retain the data for 3 years	How long the data is to be held by the policy.
Location	OneDrive Accounts – All Accounts	The Office 365 location where the policy applies.
Name: Office 365 Groups 3 Years Hold
Retention configuration	Retain the data for 3 years	How long the data is to be held by the policy.
Location	Office 365 Groups – All Groups	The Office 365 location where the policy applies.
Name: Teams Channel Messages 3 Years Hold
Retention configuration	Retain the data for 3 years	How long the data is to be held by the policy.
Location	Teams channel messages – All teams included	The Office 365 location where the policy applies.
Name: Teams chats 3 Years Hold
Retention configuration	Retain the data for 3 years.	How long the data is to be held by the policy.
Location	Teams chats messages – All users included	The Office 365 location where the policy applies.

Data Loss Prevention

Data Loss Prevention (DLP) policies enable an organisation to identify, monitor, and automatically protect sensitive information across Office 365. DLP policies can be targeted to one or more products within the Office 365 suite.

A DLP policy can be configured to:

• Identify sensitive information, documents in a specific site (for SharePoint only) or specific labels contained in Exchange Online, SharePoint Online, and OneDrive for Business.
• Prevent end-users from accidentally sharing sensitive information
• Prevent end-users from accidentally deleting a document
• Educate end-users by presenting messages them on how to stay compliant when relevant. This is done without interrupting their workflow

At the time of writing Office 365 has 100 prebuilt sensitive information types (Australian Passport Numbers etc.). In addition to the prebuilt sensitive information types custom types can be created. These custom types look for strings, patterns, or key words.

Data Loss Prevention Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Data Lost Prevention Policies	Configured	To provide insights into the movement of potentially sensitive information.

Data Loss Prevention Configuration applicable to all agencies and implementation types

Configuration	Value	Description
Name: Australian Privacy Act
Locations	Protect content in Exchange email, Teams chats, channel messages, OneDrive and SharePoint documents.	The locations where the policy will apply.
Content type	Australian Driver’s Licence number Australian Passport number	The types of sensitive information being detected.
Sharing detection	With people outside my organisation	When the policy is applied.
Notify users	Enabled	Users are notified when the policy is triggered. They are also provided policy tips for managing sensitive information.
Amount of instances	5	The amount of sensitive information required to trigger the policy (10 is the default).
Send incident reports	Enabled	User and nominated administrator are notified when the policy is triggered.
Restrict access or encrypt the content	Disabled	Access to the content that triggers the policy can be encrypted or and access limited.
Name: Australian Personally Identifiable Information (PII) data
Locations	Protect content in Exchange email, Teams chats, channel messages, OneDrive and SharePoint documents.	The locations where the policy will apply.
Content type	Australia Tax File Number Australia Driver’s Licence Number	The types of sensitive information being detected.
Sharing detection	With people outside my organisation	When the policy is applied.
Notify users	Enabled	Users are notified when the policy is triggered. They are also provided policy tips for managing sensitive information.
Amount of instances	5	The amount of sensitive information required to trigger the policy (10 is the default).
Send incident reports	Enabled	User and nominated administrator are notified when the policy is triggered.
Restrict access or encrypt the content	Disabled	Access to the content that triggers the policy can be encrypted or and access limited.
Name: Australian Health Records Act (HRIP Act)
Locations	Protect content in Exchange email, Teams chats, channel messages, OneDrive and SharePoint documents.	The locations where the policy will apply.
Content type	Australia Tax File Number Australia Medical Account Number	The types of sensitive information being detected.
Sharing detection	With people outside my organisation	When the policy is applied.
Notify users	Enabled	Users are notified when the policy is triggered. They are also provided policy tips for managing sensitive information.
Amount of instances	5	The amount of sensitive information required to trigger the policy (10 is the default).
Send incident reports	Enabled	User and nominated administrator are notified when the policy is triggered.
Restrict access or encrypt the content	Disabled	Access to the content that triggers the policy can be encrypted or and access limited.
Name: Australian Financial Data
Locations	Protect content in Exchange email, Teams chats, channel messages, OneDrive and SharePoint documents.	The locations where the policy will apply.
Content type	SWIFT Code Australia Tax File Number Australia Bank Account Number Credit Card Number	The types of sensitive information being detected.
Sharing detection	With people outside my organisation	When the policy is applied.
Notify users	Enabled	Users are notified when the policy is triggered. They are also provided policy tips for managing sensitive information.
Number of instances	10	The amount of sensitive information required to trigger the policy (10 is the default).
Send incident reports	Enabled	User and nominated administrator are notified when the policy is triggered.
Restrict access or encrypt the content	Disabled	Access to the content that triggers the policy can be encrypted or and access limited.

Audit and Logging

The Office 365 Security & Compliance Center provides the ability to monitor and review user and administrator activities across the Office 365 applications from the past 90 days.

Audit logs are kept by default for 90 days but are configurable up to one year by default for E5 licensing.

When an event occurs for the respective application it will take anywhere from 30 minutes up to 24 hours before it can be viewed in the audit log search.

The Office 365 Management Activity API enables third-party applications to consume audit logs from Office 365. If audit logging is disabled, third-party applications can still consume audit logs from the Office 365 Management Activity API.

A list of Office 365 applications, their auditing capabilities and duration wait time once an event occurs.

Application	User Activity	Admin Activity	Duration wait time
Exchange Online	x	x	30 minutes
OneDrive for Business	x		30 minutes
SharePoint Online	x	x	30 minutes
Sway	x	x	24 hours
Power Bi	x	x	30 minutes
Workplace Analytics		x	30 minutes
Dynamics 365	x	x	24 hours
Yammer	x	x	24 hours
Microsoft Power Apps	x	x	24 hours
Microsoft Power Automate	x	x	24 hours
Microsoft Steam	x	x	30 minutes
Microsoft Teams	x	x	30 minutes
Microsoft Forms	x	x	30 minutes
Azure Active Directory		x	24 hours
eDiscovery activities in Office 365 Security & Compliance Center	x	x	30 minutes

At the time of writing, audit logging is not enabled by default and must be turned on first in the Office 365 Security & Compliance Center before user or administrator activities can be audited.

Auditing and Logging Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Unified Audit Logging	Enabled One-year retention	To provide visibility into the actions being undertaken within the Office 365 environment.

Exchange Online Protection

Exchange Online Protection has a feature known as Connection filtering which verifies the identity of the sender using SPF, DKIM, DMARC and Microsoft intelligence.

Connection Filtering

Connection filtering within Exchange Online Protection refers to the verification of the sender using SPF, DKIM, DMARC and Microsoft intelligence.

Exchange Online Protection Connection Filtering is always enabled however it can, to a degree, be configured. A connection filter can be implemented to always allow or always block traffic based upon an IP list.

Connection Filtering Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Configure Connection Filter	Configured	Agencies are to provide IP addresses considered as safe.

Connection Filter Configuration applicable to all agencies and implementation types

Configuration	Value	Description
Connection filter policy name	Default	This policy is the default policy configured when Exchange Online is enabled and is consistent with best practice.
Scoped to	All Domains	This is the default setting configured when Exchange Online is enabled.
IP Allow list	Not Configured	This is the default setting configured when Exchange Online is enabled.
IP Block list	Not Configured	This is the default setting configured when Exchange Online is enabled.
Safe list	Disabled	This is the default setting configured when Exchange Online is enabled.

Anti-malware

Anti-malware within Exchange Online Protection refers to the default anti-malware scanning which is completed on all emails routing through the service.

In addition to the default scanning, anti-malware policies can be configured. These polices allow for the customisation of a response if malware is detected and the restriction of attachment file types.

Anti-malware Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Configure Anti-malware Policy	Configured	Configuring the anti-malware policy to allow for the customisation of a response if malware is detected and the restriction of attachment file types.

Anti-malware Policy Configuration applicable to all agencies and implementation types

Configuration	Value	Description
Anti-malware policy name	Default	Editing the default policy ensures it applies to all incoming and outgoing mail and is consistent with best practice.
Malware detection response	Notify recipients that the message has been quarantined with the default notification text	This will send a notification to recipients when a message is quarantined.
Sender notifications	Notify internal senders	This will send notification to senders when their message is quarantined.
Administrator notifications	Notify administrators about undelivered messages from internal senders
Notify administrators about undelivered messages from external senders	Administrators will be notified when messages are undelivered.
Allowed File type filtering	Disabled	This is the default setting configured when Exchange Online is enabled and is Microsoft best practice. This ensures that all file types are inspected for malware with no exceptions.

Policy Filtering

Policy filtering within Office 365 Exchange Online Protection refers to the enforcement of Transport Rules.

Transport Rules are a set of rules enforced on mail transiting through the Exchange Organisation. Transport rules can be leveraged by Administrators to complete a number of actions on all mail or a subsection of the mail transiting through the Exchange Organisation. These items include:

• Block mail with certain headers
• Apply disclaimers to emails
• Apply Office 365 message encryption

Transport Rules follow the following basic structure:

• Conditions – Conditions identify which mail the transport rule applies to. These conditions largely target either information gained from message headers (e.g. the ‘to’, ‘from’ or ‘CC’ fields) or message properties (e.g., size, attachments, subject, body, message classification). A single rule can have multiple conditions apply
• Exceptions – Exceptions are an optional component of a Transport Rule and define the mail exempt from the rule
• Actions – Actions are used to define what actions to undertake on the messages matching the conditions and which do not match any exemption. These actions include rejecting, deleting, redirecting the emails, and adding recipients, prefixes, and disclaimers. A single rule can have multiple actions applied however some actions are incompatible with others
• Properties – Properties are used to define anything which do not fall into another category. This includes enforcing or testing the rule

Policy Filtering Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Mail flow rules	Configured	Mail flow rules within the environment are required to enforce business rules and process.

Content Filtering

Content Filtering within Exchange Online Protection refers to SPAM management and SPAM policies.

Content Filtering polices allow for:

• The customisation of response on SPAM detection
• Marking emails as SPAM based on language detected
• Marking emails as SPAM based on the sender or sender’s domain
• Increasing the SPAM score if certain content is present in the email
• Marking emails as SPAM if certain content is present in the email

The use of these policies allows greater management control over SPAM emails.

Content Filtering Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Configure SPAM policy	Default configuration	Exchange Online Protection will complete SPAM evaluation.

Office 365 Advanced Threat Protection

Office 365 Advanced Threat Protection (ATP) extends the native security features in Office 365. The protections provided by Office 365 ATP are designed to defend against attacks from multiple threat vectors including email, websites and documents stored in online libraries, such as SharePoint Online. Each of the Office 365 ATP capabilities is enabled and managed via policies configured from the Office 365 Security and Compliance Center.

Office 365 ATP provides the following capabilities:

• Safe Links - Office 365 ATP Safe Links provides inspection of links included in emails and Office 365 documents to determine if it is malicious, redirecting the user if it is.
• Safe Attachments - Office 365 ATP Safe Attachments provides sandbox execution of attachments to detect and delete malicious content.
• Anti-Phishing - Office 365 ATP Anti-Phishing provides machine learning capabilities to detect advanced phishing campaigns.

Safe Links

ATP Safe Links can help protect an organisation by providing time-of-click verification of web addresses (URLs) in email messages and Office documents. Protection is defined through ATP Safe Links policies that are configured by an organisation.

Administrators can redirect URLs in order to avoid being sent to the original link. In addition, administrators can obfuscate the original link preventing users from copying and pasting the link into a web browser.

Real-time scanning of URLs provides an additional layer of protection by scanning links during transit and hold an email message from being delivered until the links have been scanned and considered safe.

Safe Links can be configured at an organisation level or on a per recipient basis. These policies then be applied to either Exchange Online, Office 365 applications or both.

ATP Safe Links protection works as outlined below for URLs in emails that are hosted in Office 365:

• All incoming email goes through Exchange Online Protection, where IP and envelope filters, signature-based malware protection, anti-spam and anti-malware filters are applied
• An end-user signs into Office 365 and accesses their Exchange Online mailbox
• An end-user opens an email message containing a URL, and then clicks on the URL in the email message
• The ATP Safe Links feature immediately checks the URL before opening the website. The URL is identified as blocked, malicious, or safe
• If the URL sends an end-user to a website that is included in a custom “Do not rewrite” URLs list for a policy that applies to the user, the website opens
• If the URL sends an end-user to a website that is included in the organisation’s custom blocked URLs list, a warning page opens
• If the URL sends an end-user to a website that has been determined to be malicious, a warning page opens
• If the URL goes to a downloadable file and the ATP Safe Links policies are configured to scan such content, the downloadable file is checked
• If the URL is considered safe, the end-user is taken to the website

ATP Safe Links protection works as outlined below for URLs in Office 365 ProPlus applications:

• A user opens a Word, Excel, PowerPoint, or Visio, and is signed in using their Office 365 security credentials. The document contains URLs
• When a user clicks on a URL in the document, the link is checked by the ATP Safe Links service
• If the URL sends an end-user to a website that is included in a custom “Do not rewrite” URLs list for a policy that applies to the user, that user is taken to the website
• If the URL sends an end-user to a website that is included in the organisation’s custom blocked URLs list, the user is taken to a warning page
• If the URL sends an end-user to a website that has been determined to be malicious, the user is taken to a warning page
• If the URL goes to a downloadable file and the ATP Safe Links policies are configured to scan such downloads, the downloadable file is checked
• If the URL is considered safe, the end-user is taken to the website

Safe Links Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Office 365 ATP Safe Links	Configured	Configured to align with ACSC - PROTECT - Malicious Email Mitigation Strategies (June 2020) and Microsoft guidance.

Safe Links Configuration applicable to all agencies and implementation types

Configuration	Value	Description
Settings that apply to content across Office 365
Block the following URL’s	No URLs defined	Managing the Blocked URL list is an ongoing administrative task. Agencies will need to consider the resourcing requirements of maintaining a blocked URL list.
Settings that apply to content except mail
Use safe links in Office 365 ProPlus, Office for iOS and Android	Checked	Safe links will be checked by default within these Office 365 applications.
For the locations selected above: Do not track when users click safe links	Unchecked	Information about when end-users click safe links in the Office 365 documents will be tracked.
For the locations selected above: Do not let users click through safe links to original URL	Checked	If end-users click on safe links in Office 365 documents, then they will be directed to a warning page and will not be presented with an option to continue to the original link.

Safe Attachments

The ATP Safe Attachments feature checks email attachments after the email is received but before it is delivered to the user mailbox.

When an ATP Safe Attachments policy is in place and an end-user who is covered by that policy views their email in Office 365, their email attachments are checked, and appropriate actions are taken, based on the configured policies. To deploy this feature, an Office 365 E5 subscription or an Advanced Threat Protection licence is required.

Safe Attachments Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Office 365 ATP Safe Attachments	Configured	Configured in accordance with PROTECT - Malicious Email Mitigation Strategies (June 2020)

ATP Safe Attachments Configuration applicable to all agencies and implementation types

Configuration	Value	Description
Protect files in SharePoint, OneDrive, and Microsoft Teams	Ticked	If a file in any SharePoint, OneDrive, or Microsoft Teams library is identified as malicious, ATP will prevent users from opening and downloading the file.
Turn on Safe Documents for Office clients	Ticked	Before a user is allowed to trust a file opened in Office 365 ProPlus, the file will be verified by Microsoft Defender Advanced Threat Protection.
Warning	Dynamic Delivery	Dynamic Delivery ensures attachments are scanned and detected malware is quarantined. It also includes attachment previewing capabilities for most PDFs and Office files during scanning.
Redirect attachment on detection. Send the blocked, monitored or replaced attachment to an email address	Enable Redirect - Ticked	This will send blocked or replaced email messages with an attachment that is identified as malicious to a selected email address.
Apply the above selection of malware scanning for attachments times out or error occurs	Ticked	Will redirect an end-user’s email messages to a selected email address even if a time out or error occurs when malware scanning an attachment. This allows legitimate emails to be recovered and malware to be investigated.
Applied to	Configured	All Agency domains (e.g., dta.gov.au).

Anti-Phishing

ATP anti-phishing protects users by checking incoming messages for indicators that the message may be spoofed by impersonator or part of a phishing campaign. Most phishing emails involves a malicious actor disguising oneself (spoofing) as an individual who is known to the recipient. The messaged is crafted in a such a way which can trick the user into clicking a link, downloading malware, or stealing user credentials.

Anti-phishing uses mailbox intelligence to build a profile of communication habits between each user and maps out these relationship patterns. In an event of a phishing campaign ATP will analyse the message behaviour against the user profiles to determine if the sender is legitimate or an impersonator.

Anti-spoof specifically analyses the senders address to determine if it is legitimate or forged. Administrators can allow our block specific users from spoofing an internal domain. i.e. An external organisation to send out advertising or products on behalf of the agency.

Anti-phishing Design Decisions for all agencies and implementation types.

Decision Point	Design Decision	Justification
Office 365 ATP Anti-Phishing	Configured	Configured to meet ACSC - PROTECT - Malicious Email Mitigation Strategies (June 2020)

Anti-Phishing Configuration applicable to all agencies and implementation types

Configuration	Value	Description
Impersonation Policy
Add users to protect	Off	Add up to 60 internal and external users you want to protect from being impersonated by attackers.
Add domains to protect	Automatically include the domains I own: On Include custom domains: Off	Specify domains which you want to protect from being impersonated by attackers.
Actions	If email is sent by an impersonated user: Quarantine the message If email is sent by an impersonated domain: Quarantine the message	Specify an action in an event an attacker impersonates the users or domains you have specified.
Mailbox Intelligence	Enable mailbox intelligence: On Enable mailbox intelligence based on impersonated protection: On If an email is sent by an impersonate user: Quarantine the message	This feature uses machine learning to determine a user’s email patterns with their contacts. With this information, the artificial intelligence can better distinguish between genuine and phishing emails. Impersonated protection allows Office 365 to customize user impersonation detection and better handle false positives. When user impersonation is detected, based on mailbox intelligence, you can define what action to take on the message.
Add trust senders and domains	Not configured	When users interact with domains or users that trigger impersonation but are considered to be safe. i.e. if a partner has the same/similar display name or domain name as a user defined on the list.
Spoofing Policy
Spoofing filter settings	Enable antispoofing protection: On	Allows the Agency to filter email from senders who are spoofing domains.
Enable Unauthenticated Sender Feature	Enable Unauthenticated Sender: On	Displays a notification to users in Outlook when a sender fails authentication checks.
Actions	If email is sent by someone who’s not allowed to spoof your domain: Quarantine the message	Specify an action in an event an unauthorised user spoofs a domain.