Foundation & Governance

Why It Matters: In a university environment, "one size fits all" fails. A simple corporate "Confidential" label is insufficient when you must distinguish between student records (FERPA), health data (HIPAA), and export-controlled research (ITAR). This decision defines the "Digital Price Tags" for your data, directly impacting how research is shared and protected.

Best Practice / Recommendation: Adopt a Higher Education Model that balances openness for fundamental research with strict controls for regulated data.

The Decision to be Made: Choose a classification taxonomy.

Why It Matters: Universities are collaborative by nature, but "Open by Default" creates massive liability. With the rise of AI (Copilot) and ransomware, a permissive environment allows threats to spread laterally. This decision determines if new SharePoint sites and Teams are "fortresses" or "public squares."

Best Practice / Recommendation: Adopt a Balanced Default. While "Secure by Default" is ideal for corporate, it can stifle academic collaboration. A balanced approach protects identity but allows controlled collaboration.

The Decision to be Made: Define your baseline security settings.

Why It Matters: Faculty often share large datasets. If a DLP policy blocks a legitimate grant proposal because it "looks like" PII, IT becomes the enemy. Conversely, failing to block SSN exfiltration is negligence.

Best Practice / Recommendation: Warn with Override. This approach respects the user's intent while creating an immutable audit trail.

The Decision to be Made: Choose an enforcement model.

Why It Matters: As a state entity, Texas A&M is subject to the Texas Public Information Act (FOIA) and State Records Retention schedules. Keeping everything forever ("Digital Hoarding") makes FOIA requests expensive and exposes the university to liability. Deleting too soon violates state law.

Best Practice / Recommendation: Automated Lifecycle. Differentiate between "transient" communication and "official" records.

The Decision to be Made: Choose a lifecycle strategy.

Why It Matters: Microsoft Copilot respects user permissions too well. If a sensitive HR document is shared with "Everyone" (a common error), Copilot will summarize it for any student worker who asks. We must "sanitize" the environment before unleashing AI.

Best Practice / Recommendation: Restricted Content Discovery (RCD). Identify high-risk sites (HR, Legal, Dean's Offices) and strictly hide them from AI indexing.

The Decision to be Made: Choose an AI readiness posture.

Why It Matters: Microsoft Purview includes powerful tools to detect insider threats (Insider Risk Management) and monitor communications for policy violations (Communication Compliance). However, these tools raise significant privacy concerns that must be addressed by leadership before deployment.

Best Practice / Recommendation: Targeted Deployment with Privacy Controls. Start with high-risk scenarios (departing employees, export-controlled research) and enable pseudonymization to protect user privacy during investigations.

The Decision to be Made: Define the monitoring scope and privacy posture.

Why It Matters: Microsoft Purview has its own Role-Based Access Control (RBAC) system that is separate from Entra ID administrative roles. These Purview-specific roles control who can configure policies, investigate cases, view sensitive content, and manage compliance features.

Best Practice / Recommendation: Adopt a Functional Role Separation model where roles align to job functions. Use Privileged Identity Management (PIM) for just-in-time access to high-privilege roles.

The Decision to be Made: Define your Purview RBAC strategy and identify role holders.

Critical Considerations:

• Content Explorer Content Viewer grants the ability to see the actual sensitive content discovered by Purview—assign this role only to personnel with a demonstrated need
• eDiscovery Administrator can access ALL cases across the organization—typically limit to 1-2 people with documented justification
• Consider Privileged Identity Management (PIM) for just-in-time activation of high-privilege roles

Goal: Ensure the admin account and pilot users have the A5 license required to test advanced features.

Click-Ops (Microsoft 365 Admin Center):

1. Navigate to https://admin.microsoft.com
2. Go to Users > Active users
3. Select your admin account
4. Click the Licenses and apps tab
5. Verify Microsoft 365 A5 for Faculty (or Student) is checked

PowerShell (Bulk Verification):

Connect-MgGraph -Scopes User.Read.All

# Check License for a specific user
$User = Get-MgUser -UserId "admin@tamu.edu" -Property AssignedLicenses
$User.AssignedLicenses | Select-Object SkuId

# Use Get-MgSubscribedSku to map IDs to Names

Goal: Turn on the "Black Box" recorder and enable Audit (Premium) features for 1-year retention.

Click-Ops (Purview Portal):

1. Navigate to https://purview.microsoft.com
2. Select Audit in the left navigation
3. If you see a banner: "Start recording user and admin activity", click Start recording

PowerShell (Enable & Configure Premium):

Connect-ExchangeOnline

# Enable Root Log Ingestion
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

# Enable Audit Premium for all users (1-year retention)
$HighValueUsers = Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"}

foreach ($User in $HighValueUsers) {
    Set-Mailbox -Identity $User.Identity -AuditEnabled $true -AuditLogAgeLimit 365.00:00:00
}

Write-Host " Audit Log Enabled with 1-Year Retention" -ForegroundColor Green

Goal: Stop using Global Admin. Assign dedicated Purview Administrator or Compliance Administrator roles.

Click-Ops (Purview Portal):

1. Go to Settings > Roles & scopes > Role groups
2. Search for Purview Administrator
3. Click Edit > Choose users > Add
4. Select your admin account

PowerShell (Microsoft Graph):

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

$RoleName = "Compliance Administrator"
$UserUPN = "admin_compliance@tamu.edu"

$Role = Get-MgRoleManagementDirectoryRoleDefinition -Filter "DisplayName eq '$RoleName'"
$User = Get-MgUser -UserId $UserUPN

New-MgRoleManagementDirectoryRoleAssignment -PrincipalId $User.Id -RoleDefinitionId $Role.Id -DirectoryScopeId "/"

Write-Host " User $UserUPN assigned to $RoleName" -ForegroundColor Green

Goal: Ensure Microsoft engineers cannot access your tenant data during support requests without explicit approval.

Why It Matters for Higher Ed: When Microsoft support troubleshoots an issue, they may need to access your tenant data. Customer Lockbox ensures you maintain control—critical for FERPA and HIPAA compliance.

Click-Ops (Microsoft 365 Admin Center):

1. Navigate to https://admin.microsoft.com
2. Go to Settings > Org settings > Security & privacy
3. Select Customer Lockbox
4. Toggle Require approval for all data access requests to On
5. Designate approvers (senior IT staff or Compliance Officers)

Goal: Implement just-in-time, just-enough access for high-risk administrative tasks.

Higher Ed Tasks to Protect with PAM:

Click-Ops:

1. Navigate to https://admin.microsoft.com
2. Go to Settings > Org settings > Security & privacy
3. Select Privileged access
4. Click Create policy and enable privileged access
5. Configure Default Approval Group (e.g., PAM-Approvers@tamu.edu)

PowerShell:

Connect-ExchangeOnline

# Enable PAM at the organization level
Enable-ElevatedAccessControl -AdminGroup "PAM-Approvers@tamu.edu" -SystemAccounts @()

# Create policy for eDiscovery role
New-ElevatedAccessApprovalPolicy -Name "eDiscovery Access" `
    -Type RoleGroup `
    -RoleGroupName "eDiscovery Manager" `
    -ApprovalType AutoApproval `
    -ApproverGroup "PAM-Approvers@tamu.edu" `
    -MaxElapsedAccessTime 04:00:00

Goal: Access Compliance Manager and understand your current baseline score.

Click-Ops:

1. Navigate to Compliance Manager from the Purview portal home
2. Review your Compliance Score (shown prominently at top)
3. Note the score breakdown (Microsoft-managed vs. Customer-managed)
4. Click on the score to drill into contributing assessments

Goal: Add regulatory assessment templates relevant to higher education.

Recommended Templates for Higher Education:

Click-Ops:

1. Navigate to Compliance Manager > Assessments
2. Click + Add assessment
3. Select Template (e.g., "FERPA Baseline")
4. Select Group (create a group like "Higher Education Compliance")
5. Review and Create assessment

Goal: Assign improvement actions to appropriate team members.

Click-Ops:

1. Navigate to Compliance Manager > Improvement actions
2. Filter by Status: Not started and Your actions (Customer-managed)
3. For each high-impact action, click Assign and select appropriate user
4. Set Implementation status and add target completion date

Common Action Assignments:

Goal: Enable continuous testing so Compliance Manager automatically detects implemented controls.

What Gets Auto-Tested: