You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- fix typos & grammar
- always refer to Microsoft Graph by it's full name
- Markdown fixes
- always include code formatting lexicon
- bullets...
- numbered: don't use explit numbers for bullets, always use `1.` & let rendering engine generate numbers
- list: always use `-`
- correctly indent code & images in bullets
- should always start left aligned
- always add blank links above & below group of bullets
- never bullet headings
- replace absolute links to learn.microsoft.com targets
Copy file name to clipboardExpand all lines: docs/embedded/concepts/security-and-compliance.md
+51-62Lines changed: 51 additions & 62 deletions
Original file line number
Diff line number
Diff line change
@@ -8,132 +8,121 @@ ms.localizationpriority: high
8
8
9
9
# Security and Compliance
10
10
11
-
12
11
Microsoft's SharePoint Embedded provides a faster way to create secure and compliant documents stored in various applications. SharePoint Embedded leverages Microsoft’s comprehensive compliance and data governance solutions to help organizations manage risks, protect, and govern sensitive data, and respond to regulatory requirements. Security and compliance solutions will work in a similar manner in the SharePoint Embedded platform as they do today on the Microsoft 365 (M365) platform so that data is stored in a secure, protected way that meets customers’ business and compliance policies while making it easy for Compliance and SharePoint Administrators to enforce critical security and compliance policies on the content.
13
12
14
-
In this article, we describe the security and compliance policies that are supported today on content that reside in the SharePoint Embedded platform, and their capabilities and limitations.
13
+
In this article, we describe the security and compliance policies that are supported today on content that resides in the SharePoint Embedded platform, and their capabilities and limitations.
15
14
16
-
Since SharePoint Embedded by design doesn’t have any user interface, some Compliance scenarios necessitating user interaction aren't natively supported. The owning application that governs the Container can choose to support these scenarios and provide optimum experience to end user by leveraging existing Graph API.
15
+
Since SharePoint Embedded by design doesn’t have any user interface, some Compliance scenarios necessitating user interaction aren't natively supported. The owning application that governs the Container can choose to support these scenarios and provide the optimal experience to end-users by leveraging existing Microsoft Graph API.
17
16
18
17
## Compliance Policies using Microsoft Purview
19
18
20
19
Currently, SharePoint Embedded supports the following Compliance features under Microsoft Purview. You can follow the below steps to retrieve the details of a container that the policy needs to be applied to.
21
20
22
-
1. View list of registered SharePoint Embedded applications registered in the specified tenant:
23
-
```
24
-
Get-SPOApplication
25
-
```
26
-
2. Retrieve list of Containers in a SharePoint Embedded application by providing the ApplicationID returned in Step #1
For information on how to retrieve ContainerSiteURL to set the various Compliance policies described below at a Container level, please visit [Get-SPOContainer](/powershell/module/sharepoint-online/get-spocontainer).
21
+
1. View a list of registered SharePoint Embedded applications registered in the specified tenant:
35
22
23
+
```powershell
24
+
Get-SPOApplication
25
+
```
36
26
37
-
*### Audit
38
-
The Audit capabilities provided by SharePoint Embedded mirror the existing Audit functionalities currently supported within SharePoint Online. All user and admin operations performed in various applications hosted in SharePoint Embedded are captured, recorded, and retained in your organization's unified audit log. For more information on Audit, please visit [Auditing solutions in Microsoft Purview](https://learn.microsoft.com/purview/audit-solutions-overview).
27
+
1. Retrieve a list of Containers in a SharePoint Embedded application by providing the ApplicationID returned in Step #1
39
28
40
-
In addition to existing file properties, Audit events related to SharePoint Embedded are logged with the following additional data to help filter the Audit search results to isolate the relevant SharePoint Embedded content –
For information on how to retrieve the `ContainerSiteURL` to set the various compliance policies described below at a Container level, please visit [Get-SPOContainer](/powershell/module/sharepoint-online/get-spocontainer).
40
+
41
+
### Audit
46
42
43
+
The Audit capabilities provided by SharePoint Embedded mirror the existing Audit functionalities currently supported within SharePoint Online. All user and admin operations performed in various applications hosted in SharePoint Embedded are captured, recorded, and retained in your organization's unified audit log. For more information on Audit, please visit [Auditing solutions in Microsoft Purview](/purview/audit-solutions-overview).
47
44
48
-
*### eDiscovery
45
+
In addition to existing file properties, Audit events related to SharePoint Embedded are logged with the following additional data to help filter the Audit search results to isolate the relevant SharePoint Embedded content:
46
+
47
+
- `ContainerInstanceId`
48
+
- `ContainerTypeId`
49
+
50
+
51
+
52
+
### eDiscovery
49
53
50
54
Compliance Admins can use eDiscovery tools in Microsoft Purview to search/hold/export content hosted in the SharePoint Embedded platform. For more information on eDiscovery, please visit [Microsoft Purview eDiscovery solutions](https://learn.microsoft.com/purview/ediscovery).
51
55
52
56
To perform an eDiscovery Search on all SharePoint Embedded content, Admins should click on ‘All’ SharePoint Sites when configuring the eDiscovery Search in Microsoft Purview. This enables the Search for content stored in all SharePoint Online Sites and all SharePoint Embedded Containers.
53
57
54
-
55
58
56
59
57
-
58
60
To limit the eDiscovery Search to one/few SharePoint Embedded Containers, Admins can ‘Choose sites’ under the ‘SharePoint sites’ workload and provide the desired Container URL –
59
61
60
62
61
63
62
-
63
-
*### Data Lifecycle Management (DLM)
64
+
### Data Lifecycle Management (DLM)
64
65
65
-
SharePoint Embedded supports retention and holds policies on content stored in its applications using the Microsoft Purview portal. For more information on DLM, please visit [Learn about Microsoft Purview Data Lifecycle Management](https://learn.microsoft.com/purview/data-lifecycle-management).
66
+
SharePoint Embedded supports retention and holds policies on content stored in its applications using the Microsoft Purview portal. For more information on DLM, please visit [Learn about Microsoft Purview Data Lifecycle Management](/purview/data-lifecycle-management).
66
67
67
-
Existing retention policy will automatically apply to all SharePoint Embedded Containers if policy is configured for ‘All sites’. Similarly, creating a new retention/hold policy on ‘All’ SharePoint Sites workload will automatically enforce the policy on all SharePoint Online Sites as well as all Containers within SharePoint Embedded.
68
+
The existing retention policy will automatically apply to all SharePoint Embedded Containers if the policy is configured for ‘All sites’. Similarly, creating a new retention/hold policy on ‘All’ SharePoint Sites workload will automatically enforce the policy on all SharePoint Online Sites as well as all Containers within SharePoint Embedded.
68
69
69
70
70
71
71
72
To selectively enforce the policy on one/few SharePoint Embedded Containers, copy the Container URL and configure the policy to be selectively enforced only on those Container(s).
72
73
73
74
74
75
75
-
Since SharePoint Embedded do not have any inbuilt user interface, DLM scenarios requiring user interaction are not natively supported. For instance, if an end user attempts to apply a retention label on a Container using a SharePoint Embedded application (app), the app governing the access to the Container must furnish that functionality. In such cases, Graph APIs for DLM functionalities can be leveraged.
76
+
Since SharePoint Embedded does not have a built-in user interface, DLM scenarios requiring user interaction are not natively supported. For instance, if an end user attempts to apply a retention label on a Container using a SharePoint Embedded application (app), the app governing the access to the Container must furnish that functionality. In such cases, Graph APIs for DLM functionalities can be leveraged.
76
77
77
-
*### Data Loss Protection (DLP) - Coming soon
78
+
### Data Loss Protection (DLP) - Coming soon
78
79
79
-
Using Microsoft Purview, Admins can identify, monitor, and automatically protect sensitive items stored in applications using SharePoint Embedded. For more information on DLP, please visit [Learn about data loss prevention](https://learn.microsoft.com/purview/dlp-learn-about-dlp).
80
+
Using Microsoft Purview, Admins can identify, monitor, and automatically protect sensitive items stored in applications using SharePoint Embedded. For more information on DLP, please visit [Learn about data loss prevention](/purview/dlp-learn-about-dlp).
80
81
81
82
Like retention policies, DLP policies can be enforced on all SharePoint Online Sites and SharePoint Embedded Containers by choosing to configure the policy on ‘All sites’.
82
83
83
-
84
-
85
84
86
85
87
-
88
-
89
86
Admins can also restrict the enforcement of a DLP policy to specific SharePoint Embedded Containers by specifying the relevant Container URL(s) during policy configuration.
90
87
91
-
92
-
93
88
94
89
95
-
96
-
97
-
Several scenarios supported by DLP today need user interaction which aren’t natively supported by SharePoint Embedded. For instance, based on its configuration, a DLP policy that prevents external sharing may allow end users to provide a business justification to override the policy. The client app which renders this DLP flagged file item will need to support such user interactions.
90
+
Several scenarios supported by DLP today need user interaction that isn’t natively supported by SharePoint Embedded. For instance, based on its configuration, a DLP policy that prevents external sharing may allow end users to provide a business justification to override the policy. The client app that renders this DLP-flagged file item will need to support such user interactions.
98
91
99
92
Policy tips are shown today for files hosted in SharePoint Online so that users are kept informed about DLP-flagged file items and corresponding restrictions. Similarly, for policy tips to be displayed for files hosted in SharePoint Embedded, the client app can opt to provide additional support by utilizing the existing Graph APIs for this purpose.
100
93
101
-
102
94
## Security Features
103
-
*### Sensitivity labels on Containers
104
-
Global Administrators and SharePoint Administrators can set and remove sensitivity labels on a SharePoint Embedded Container by using the newly created SharePoint PowerShell cmdlet –
105
95
96
+
### Sensitivity labels on Containers
97
+
Global Administrators and SharePoint Administrators can set and remove sensitivity labels on a SharePoint Embedded Container by using the newly created SharePoint PowerShell cmdlet:
106
98
107
-
```
99
+
```powershell
108
100
Set -SPOContainer -Identity <ContainerID/ContainerSiteURL> -SensitivityLabel <SensitivityLabelGUID>
109
101
```
110
102
111
-
To learn more about setting sensitivity labels, please visit [Learn about sensitivity labels](https://learn.microsoft.com/purview/sensitivity-labels).
112
-
103
+
To learn more about setting sensitivity labels, please visit [Learn about sensitivity labels](/purview/sensitivity-labels).
113
104
114
-
*### Block Download policy (Coming Soon)
115
-
Block Download policy allows SharePoint Administrator or Global Administrator to block download of files from SharePoint Embedded Containers using the below SharePoint PowerShell cmdlet –
105
+
### Block Download policy (Coming Soon)
106
+
Block Download policy allows SharePoint Administrator or Global Administrator to block the download of files from SharePoint Embedded Containers using the below SharePoint PowerShell cmdlet –
Please note that a SharePoint Advanced Management (SAM) license is needed to enforce this policy. Read the full documentation for advanced capabilities at [Block download policy for SharePoint sites and OneDrive](https://learn.microsoft.com/sharepoint/block-download-from-sites).
112
+
Please note that a SharePoint Advanced Management (SAM) license is needed to enforce this policy. Read the full documentation for advanced capabilities at [Block download policy for SharePoint sites and OneDrive](/sharepoint/block-download-from-sites).
123
113
114
+
### Conditional Access policy (Coming Soon)
124
115
125
-
*### Conditional Access policy (Coming Soon)
126
-
SharePoint Embedded supports basic Conditional Access policy configurations such as
116
+
SharePoint Embedded supports basic Conditional Access policy configurations such as:
127
117
128
-
* AllowFullAccess: Allows full access from desktop apps, mobile apps, and the web
118
+
-`AllowFullAccess`: Allows full access from desktop apps, mobile apps, and the web
To learn more about Conditional Access Policy, please visit [Control access from unmanaged devices](https://learn.microsoft.com/sharepoint/control-access-from-unmanaged-devices).
128
+
To learn more about Conditional Access Policy, please visit [Control access from unmanaged devices](/sharepoint/control-access-from-unmanaged-devices).
0 commit comments