Customer
Energy company operating across multiple countries with thousands of employees using Microsoft 365.
Problem
The organization faced several challenges in managing unstructured data across Microsoft 365 under its existing E3 license:
- Sensitive data was not consistently identified or protected, increasing the risk of unauthorized access and data breaches.
- Privacy data was stored indefinitely in personal and shared workspaces, violating GDPR principles of data minimization and storage limitation.
- Records critical to business continuity were not governed, risking loss of authenticity and reliability.
- Lack of lifecycle management led to uncontrolled SharePoint growth, rising storage costs, and search inefficiencies.
- The absence of Data Loss Prevention (DLP) and Insider Risk Management (IRM) exposed the organization to insider threats and shadow AI risks.
- Microsoft 365 Copilot was being piloted, but without proper controls, it risked exposing sensitive data and amplifying ROT (redundant, obsolete, trivial) content.
Assessment and Business Case
Infotechtion delivered a tailored Microsoft 365 data security and governance assessment. This included:
- Stakeholder workshops to identify data security risks and mitigation strategies.
- Technical analysis of the current state across SharePoint, OneDrive, Teams, and Exchange.
- Identification of sensitive data using Microsoft Purview's Sensitive Information Types (SITs).
- Evaluation of compliance gaps related to GDPR, NIS2, and internal policies.
- Mapping of risks associated with Microsoft 365 Copilot and shadow AI usage.
The assessment revealed that the current E3 license lacked the automation and advanced controls needed to address these risks effectively.
Infotechtion developed a business case for upgrading to Microsoft 365 E5, highlighting the benefits of automation, improved compliance, and AI governance.
Decision
Based on the findings and recommendations, the organization decided to procure Microsoft 365 E5 licenses and initiate the implementation of Microsoft Purview. The implementation roadmap included:
- Information Protection (MIP): Auto-classification and labeling of files and emails based on content and storage location.
- Data Loss Prevention (DLP): Policies to block or warn users when sharing sensitive data externally or with AI tools.
- Insider Risk Management (IRM): Detection of risky behaviors such as label downgrades, unusual access times, and data movement to unauthorized locations.
- Data Lifecycle Management (DLM): Record labels to retain business-critical content and deletion policies for ROT.
- AI Governance: Controls to ensure safe and compliant use of Microsoft 365 Copilot and to block unsanctioned AI tools.
Outcomes
- Improved data security through consistent classification and protection.
- Reduced compliance risks and GDPR exposure.
- Lower storage and eDiscovery costs by eliminating ROT.
- Enhanced readiness for AI tools like Microsoft 365 Copilot.
- A more efficient and secure digital workplace.
Next Steps
Please contact us for a free consultation or a demonstration.