service and Customer client devices. Lockbox for For some Office 365, organizations, eDiscovery this level of features in protection Office 365, meets the and SQL minimum Server Always standard. Encrypted for partner Additional Capabilities solutions that data and such as interact with identity Office 365. protection authentication Use auditing applied (MFA), mobile features to broadly device ensure management, compliance to and Exchange policies and Online prescribed Advanced configurations. Threat Not all Protection organizations increase require the protection and highest level substantially of protection. raise the minimum standard for protecting Protecting data on devices devices, accounts, and Many organizations start by implementing controls to protect data. Many data on devices. Office 365 includes some built-in capabilities. organizations will require Intune and Azure Active Directory Premium include additional one or more configurable capabilities for implementing conditional access of these and other access controls. For more information, see . features to This table summarizes the capabilities. meet a minimum Office 365 Intune standard. BYOD Basic Enforce PIN 2 Sophisticated Capabilities (not and protection such as Azure enrolled) authentication encryption applied to Rights capabilities requirements, specific data Management for Office 365. as well as sets (RMS) and other policy Data Loss settings, for Protection applications (DLP) across accessing Office 365 can Office 365. be used to Restrict enforce permissions actions like copy, cut, and other paste, and policies that protect save as, to only apps sensitive data. managed by 3 Strongest You can Intune. protection achieve the Enable secure and highest levels web separation of protection browsing with using the capabilities Intune such as
service and client devices. For some organizations, this level of protection meets the minimum standard. Additional data and identity protection applied broadly Capabilities such as authentication (MFA), mobile device management, and Exchange Online Advanced Threat Protection increase protection and substantially raise the minimum standard for protecting devices, accounts, and data. Many organizations will require one or more of these features to meet a minimum standard. 2 Sophisticated protection applied to specific data sets Capabilities such as Azure Rights Management (RMS) and Data Loss Protection (DLP) across Office 365 can be used to enforce permissions and other policies that protect sensitive data. 3 Strongest protection and separation You can achieve the highest levels of protection with capabilities such as Customer Lockbox for Office 365, eDiscovery features in Office 365, and SQL Server Always Encrypted for partner solutions that interact with Office 365. Use auditing features to ensure compliance to policies and prescribed configurations. Not all organizations require the highest level of protection. Protecting data on devices Many organizations start by implementing controls to protect data on devices. Office 365 includes some built-in capabilities. Intune and Azure Active Directory Premium include additional configurable capabilities for implementing conditional access and other access controls. For more information, see . This table summarizes the capabilities. Office 365 Intune BYOD (not enrolled) Basic authentication capabilities for Office 365. Enforce PIN and encryption requirements, as well as other policy settings, for applications accessing Office 365. Restrict actions like copy, cut, paste, and save as, to only apps managed by Intune. Enable secure web browsing using the Intune