This is the second article in a series of typical customers questions around Office 365. These questions were part of presentation I did with two other resellers at the Australian Microsoft Partner Conference in 2016. You’ll find the first part of the series here:

Answering common questions with Office 365 Part 1

The question for this article is:

Customer Question – There is a lot of talk about online privacy and governments spying on data. Although my business doesn’t have anything to hide how does Office 365 keep my data private and secure from unwanted ‘prying eyes’? I also have a legal responsibility to ensure my clients data remains secure and private. Can this be achieved with Office 365 to ensure I am compliant with any legislation?

In Australia, if you run up an Office 365 tenant today the data will be located in the Australian data centers. An administrator can easily see where their Office 365 data is located using this process:

Office 365 Data location

The E5 license provides functionality known as ‘Customer Lockbox’. This allows the customer to control who accesses their data by basically have requests for access come directly to the customer. I have written an article about this here:

Enabling Customer Lockbox

and you’ll also find some good information about Customer Lockbox in this video:

Information that is sent to and from Office 365 is encrypted:

Encryption in transit

Information saved in Office 365 is also encrypted at rest as detailed in this video:

Depending on the Office 365 license you have (typically E3 or above) you can enable and configure additional security measures to keep your data safe. One of these is Data Loss Prevention or DLP and I have previous detailed how to set this up for SharePoint:

Enabling DLP for SharePoint and OneDrive for Business

Office 365 also includes the ability to enable multi factor authentication. This means that not only do you need a login and password but you’ll also need something like a unique code sent via text message to login. You can read more about this here:

Set up multi factor authentication for Office 365

I’ve also previously covered how Office 365 includes basic Mobile Device Management (MDM) that allows you to protect which mobile devices connect to your environment as well as allowing you to set policies to ensure they are secure. You can read more about how to set that up here:

Office 365 Mobile Device Management

With plans from E5 and above you also get the ability to place information on ‘Legal Hold’ to preserve it for long periods of time. More information on those abilities is at:

Legal Hold

These plans also allow you to use advanced eDiscovery to search across all the data sources inside Office 365 for information that matches your pre-defined query. Here is an article I have written about eDiscovery with SharePoint Online:

SharePoint Online eDiscovery

here is a FAQ on eDiscovery:

eDiscovery FAQ

as well as as an overview article on eDiscovery in Office 365:

eDiscovery in Office 365

As I have written about previously, many users of E3 licenses and above don’t appreciate that they have the ability to use Rights Management to protect their documents no matter where they are located. My article explaining all this is here:

Office 365 E3 and above includes Rights Management

I also have an article on using Rights Management with SharePoint Online here:

Using Office 365 Rights Management with SharePoint Online

and here’s more information on Rights Management in Office 365:

Information Rights Management 

and how you use email message encryption:

Office 365 message encryption

As I have said before, the security features of Office 365 are one of the real differentiation points when it comes to online services. There are lots and lots more features I could dig into here but I’ll point you to a presentation I gave a while back on Office 365 security which is a good overall summary of what’s available: