Securing Your Office 365

Good morning or afternoon, I guess, depending on where you are located. And welcome to our webinar this afternoon of securing your office365 accounts in the modern enterprise today. I'm Mike Austin. I'm the founder and CEO of Metrics Data360. I'm one of the authorities on Microsoft licensing. You know, negotiate a lot of Microsoft contracts and really help passionate about helping clients ensure that they buy what they need. And I'm really excited today to be presenting with our partner from Solilon, Rija. Rija is the vice president of Microsoft Partner Solutions at Solilon. He's been in the IT world for over 22 years. And so today we're going to talk a little bit about, you know, how to secure Microsoft O365 and some of their security products. But before we start with that, I'm actually going to dive in and talk a little bit about how to procure Microsoft 365 because I think that's one of the most important things. And it really starts we surveyed about 100 or so IT and IT procurement professionals and basically we heard the following. And this kind of falls into three big buckets here is that when it comes to actually buying Microsoft licenses or actually this one was around cloud. But you can extrapolate this to Microsoft as well as it fell into three big categories. One is it's the cost. The costs are getting out of control. I actually had a conversation with one of my clients yesterday who is looking to do a large Microsoft purchase. And the CFO was at a CFO event and he's not sure whether he actually wants to sign off on it because all the CFOs that were at that event said they bought into Microsoft cloud. They're not getting any return. It's actually more expensive. And so we are hearing that costs are going up. You see these price increases. The second thing, biggest bundle bucket of areas around licensing. It's confusing. People don't understand how all the bundles work. And then the third area is really around data and the lack of data. And that data comes into two areas both of us are what we're going to talk about today. One is how do I use data to make intelligent purchasing decisions. And the other piece of it is how do I use data to actually secure my environment more effectively. And so, you know, what we're going to cover is how to collect data, how to purchase only what you need, how to negotiate with Microsoft and then how to, you know, then we're going to talk a little bit about the security piece and how you use this data to do that. And so I'm going to start and say like when it comes to using data to beat Microsoft at their own game, how do we know it works? A lot of people are like, if I go out and do the things that you're about to talk about, Mike, how do I know this is going to work? And there's a few key things here. One is a lot of times people say I really don't know what I'm buying. I don't understand the bundles, I don't understand if we're using what we're using, are we using what we're paying for? What's you know, is it the right license type? All of this sort of stuff. And when people work with us, they understand what they're using, they understand the decisions they're making, they understand the trade offs and it's in. They have a massive reduction in the amount of time that it takes to put these things together. And so one of the things when it comes to data that I tell people all the time, and this is one of the key things about, even when you're looking at the security piece that we're going to talk about, is you really have to understand what you're using. So a lot of times I'm going to talk about the strategy that Microsoft uses when it comes to negotiating. But most organizations go out and they just sort of buy more of what they had or increase. So like If I'm on Office365E3, I'm talking about moving to E5 and they sort of have an idea of their roadmap, but they really don't. And so one of the first pieces of information that we talk about is actually going out and understanding your Microsoft roadmap. And when we work with clients, we have over 15 actual surveys that we do with our clients to understand that roadmap. And you can kind of see a couple of them here on the screen. But you know, like if you look at like the Microsoft Security product, what are we looking at? What do we currently have in our environment? What third parties do we have? When do those expire? What's our value that we're paying for those on an annual basis so that we can look at if we were to buy the Microsoft Security products, is there even value in it or are we just going to be double paying? It doesn't matter if Microsoft discounts the cost completely out. If we've still got third party costs that we can't get Rid of. And so you want to pull all that together to get a view of where you're at. And so how does this actually come together? I want to kind of use this one client that we had as an example. They were buying O365E3s across the board for all of their users. And they really didn't have much data other than they kind of bought these. They thought that everybody was using them. And so when we went in and we analyzed their usage data and we did the surveys, what we actually found out is they had about 400 users in their environment that weren't using Office 365 at all. And they had no clue. And actually they didn't believe us until we showed them. We showed them the data and when we were, because we had access to their teams and we understood from the surveys sort of what was going on. What we found out were they had 400. This was an oil and gas company, they had 400 filed tax that were just being dispatched. So their entire job, they had an application on a tablet. They were dispatched to go out to some, you know, location, do some welding, input what they did, and then get dispatched to the next position. And so when we showed them they weren't using O365 at all, it was a shock to them and they didn't believe us. But when we looked at it and we saw this and then we went back and and supplemented some of the stuff we did with a conversation around the business owner of the that failed service tech. They found out, yeah, they don't use any of this stuff. So even though they thought they were using it, they really weren't. And so that's just one area where, you know, using data can really kind of dive in and help you. Right. Also, when you understand what's going on, you can actually correlate this stuff to licensing. So this is a good example of a client that was on premise with teams or Skype, I guess, and a little bit of team stuff in the cloud. And Microsoft was just saying, go buy a bunch of licenses for O365E5s and these teams plus licenses and things like that. And they really didn't know what the requirements were until we pulled this together for them. Because with the screen, screenshot is out of our survey report, we're able to tell them like, look, these are all your users, so I'm not going to go into all the details of how this works from licensing perspective, but we can tell them based on what we see here. Here's exactly the licenses you need. It's not E5 for all your users, it's E5 for this subset of your users. This and this for this subset of your users, and this and this for this subset of your users. So instead of being $2 million, you actually only need a million and a half dollars worth of licenses to support this or whatever, whatever it worked out to be. And they were able to do that based on data, right? And so kind of one of the things that people will say is like, how do I purchase only what I need to, right? And because they'll tell me all the time, I'm not an expert on licensing and I'm not a professional negotiator, at least that's what it people will tell me. And I, I like to use this story. I was actually on a plane one time and I was flying home and we were pretty much on the ground. Like we were coming in and we were, you know, probably about 10 seconds to landing and the pilot pulled straight up and I think we must have almost gone up at a 90 degree angle. And he came on, you know, a minute or two later once we got up in the air and he's like, you know, sorry folks, we, we came in a little bit close to another plane. So I pulled up for safety and didn't think much of it until I got home and saw the pilot on an interview on the news. And we were literally something like five seconds from a mid air collision. And the thing that stood out for me for that is the reporter asked the pilot, were you concerned at all? Were you scared? And the pilot's response was no, I had all the data that I needed. The lights were blinking. We practiced this in the simulators. I knew exactly what to do in this situation because all the data was in front of me and I didn't have to think, I just reacted and did what needed to be done. And in some ways it's very similar to how you should be working with Microsoft because a lot of the times people actually don't have the data and then they're reacting and if you react wrong, you know, you have consequences which in this case could have been a midair collision, right? And so when you make the wrong decisions because you're reacting to bad data and things like that, you're going to buy contracts and things like that that you don't, you know, you shouldn't be. And so I like to use case studies and at level, here's another one that we had where we had a organization they were a manufacturer, 2500 users. This was right in the heat of COVID They were having supply chain issues. Everybody knows they couldn't get chips like everybody else. Cash flow was being hurt and they needed to find cost savings. And they expected they were over licensed, but they didn't know where. And so one of the things that we did is we went in and we're going to talk about our tooling and I'm going to show you that here in a couple of seconds around what they were doing. And so this is an example of where they thought they were using E5 for everybody. We were able to show them that they weren't. We reduced a bunch of their F3 licenses so they were buying F3 licenses for contractors and things like that that weren't even using technology, weren't actually even in their active directory. And through that survey process, we actually identified $700,000 in vendor duplication where they had Microsoft technologies that they were paying for third party to do the same thing. And so again, it's just an example of how using data can give you great results. Right? But you might think, okay, I'm not a business analyst, I'm not technical. You know, we hear things like I don't have the ability to access systems. I don't have all the time to do the work. Will I get any better results? And so the reality is if you get the right data, you don't need to be a license expert or even negotiate. You don't even need to understand the security products or how all the bundling works. It's going to be done for you. And so I like to use this chart to sort of talk this through. And I'm going to make this stuff from the high level and get down and to get this real before I hand off to Reja here in a second. Right? But this here, it's at m365maps.com It's a Microsoft person, Aaron Dinwich, that keeps us up to date. One of the first questions I get all the time, quite honestly is what's the difference between O365 and M365? And this chart actually illustrates that. So Office 365, this is for E3 on, on the site you can get charts for E5 for the F SKUs, you know, all of that. But this is just the E3 one. What, what you see here is in the, I guess it's kind of red color on the right. This is Office 365E3. And so one of the things that people get mistaken with is they think Office365 is a product or that M365 is a product. It's not. It's a marketing bundle. The products are the products and services that are in this Bundle that's called Office 365 E3, that are all these little red boxes. Now, some of these little red boxes you can buy as a product and others are services that include it with products. Okay, so for instance, alert policies and audit logging is not something that you buy. That's just a service that comes when you buy some of these O365 products. Things like Exchange Online and the Microsoft Business Apps, or the Office product or SharePoint Online, et cetera. Those are actual products. But if you look at this O365E3 bundle, it's made up of approximately 35 different products or services. Then in the middle is what Microsoft calls the Enterprise Mobility Suite, or the acronym is ems. And EMS is again, a bundle of products. So in the dotted blue line here, you have Azure Active Directory Premium. So if I wanted to just buy MFA from Microsoft, I can't. It's included in this Azure ad.