SharePoint now serves up search results personalized to your previous activity and permissions.

In SharePoint Online and on office.com, search is personal, and the search results are even easier to explore. Another user will see different results than you, even when you both search for the same words.

You’ll only see results that you already have access to, and other users can’t find your private documents.

Even before you start typing, you’ll see results based on your previous activity in Office 365. The results update as you start typing.

If these results aren’t what you’re looking for, click the link to see more results or press Enter to open the search results page and see and explore all the results. Here’s an example of search results from SharePoint:

Explore the search results to see more details about the people and files you’ve found, or refine your search to get other results. Here’s an expert tip to quickly see more, or less, details of a result – you can actually click anywhere in the empty space of the result.

You can navigate to locations that you want to explore further and, if you’ve searched in SharePoint Online, you can change where the results come from. For example, if you searched from a site, but really meant to search all of SharePoint, then you’re just one click away. Or, if the site you searched from is associated with another site, but you want to search all the associated sites.

When you exit a search results page, you return to the page where you started your search.

Admins can send simulated phishing and attack emails to find security and training weaknesses.

A few weeks ago, Microsoft released a public preview for Attack Simulator for Office 365 Threat Intelligence. On April 17th Microsoft announced that Attack Simulator is now generally available. Attack Simulator for Office 365 Threat Intelligence is available to all Office 365 E5 or Office 365 Threat Intelligence customers.

With Attack Simulator, customers can launch simulated attacks on their end users, determine how end users behave in the event of an attack, and update policies and ensure that appropriate security tools are in place to protect the organization from threats.  The GA of Attack Simulator adds a new HTML editor so realistic looking HTML emails can be sent in simulations of spear-phishing.  Also, two spear-phishing templates are available for immediate use in the spear phishing simulation.

Attack Simulator includes the three attack scenarios from our public preview.

Display Name Spear Phishing Attack: Phishing is the generic term for socially engineered attacks designed to harvest credentials or personally identifiable information (PII). Spear phishing is a subset of this phishing and is more targeted, often aimed at a specific group, individual, or organization.  These attacks are customized and tend to leverage a sender name that generates trust with the recipient.

Password Spray Attack: To prevent bad actors from constantly guessing the passwords of user accounts, often there are account lockout policies.  For example, an account will lockout after a certain number of bad passwords are guessed for a user.  However, if you were to take a single password and try it against every single account in an organization, it would not trigger any lockouts.  The password spray attack leverages commonly used passwords and targets many accounts in an organization with the hope that one of the account holder uses a common password that allows a hacker to enter the account and take control of it.  From this compromised account, a hacker can launch more attacks by assuming the identity of account holder.

Brute Force Password Attack: This type of attack consists of a hacker trying many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and passphrases until the correct one is found.

This video demonstrates how Attack Simulator can help organizations educate users to become more secure from cyber threats.  With Attack Simulator, admins can train all their end users, and especially those who are attacked most often.  This proactive training is a powerful way to ensure that your organization can prevent the impact from advanced threats.  Over the coming months, more threat simulations will be added to Attack Simulator so organizations can simulate the most prevalent threat types from the modern threat landscape.

Experience the benefits of Attack Simulator for Office 365 Threat Intelligence by beginning an Office 365 E5 trial today.  Also, learn more about how Microsoft leverages threat intelligence and the value of threat intelligence.

Compliance Manager is now available

Compliance Manager is a cross-Microsoft-cloud services feature designed to help organizations meet complex compliance obligations, including GDPR, ISO 27001, ISO 27018, NIST 800-53, and HIPAA. Compliance Manger is rolling out and has been moved from Public Preview to General Availability.

How to access Compliance Manager?

Users can access Compliance Manager by signing into their Office 365, Dynamics 365, or Azure user account via the Service Trust Portal. This new compliance solution is designed to help organizations meet their data protection and regulatory requirements while using Microsoft cloud services. Compliance Manager enables users to perform on-going risk assessments, gain actionable insights to improve data protection capabilities, and simplifies compliance processes through its built-in control management and audit-ready reporting tools.

Compliance Manager is now generally available for Azure, Dynamics 365, and Office 365 Business and Enterprise subscribers in public clouds. Note that Office 365 GCC customers can access Compliance Manager, however, you should evaluate whether to use the document upload feature of compliance manager, as the storage for document upload is currently compliant with Office 365 Tier C only.

What do I need to do to prepare for this change?

By default, everyone in your organization with an Office 365, Dynamics 365 or Azure user account has access to Compliance Manager and can perform any action in Compliance Manager. To change the default permissions, at least one user must be added to each Compliance Manager role (see the instructions on our support page linked from Additional Information below). After a user is added to a role, the default permissions are removed and only users that have been added to a role will be able to access Compliance Manager and perform the actions allowed by that role.

Once you log into Compliance Manager you will see a number of assessments and what Microsoft has completed for the various assessments.  You will also see what controls your organization are responsible for.  You can export the assessment to excel if you need to provide it for an auditor or wish to save it for retention purposes.

Once in an assessment, you can update what your organization is doing to meet the requirements for the various supported standards.  This gives you the ability to track your compliance activities.  Some organization may already have GRC tracking software but they will find this tool useful if for no other reason to see the results of Microsoft Managed controls.

If Microsoft allowed you to have an assessment for your on-premises systems.  Like a blank questionnaire, clients could use it might be able to replace a GRC app for some companies.

When updating the Customer Managed Controls you have the ability to upload documents, lookup the related controls, assign an assessor, a test date and document the test results.

Microsoft provides you with detailed guidance for customer actions and allows you to document your control implementation details along with a test plan and any response to the assessment.

There is a Compliance Score that, “is a new intelligent scoring feature that is calculated based on an analysis of industry standard control components. Compliance Manager analyzes controls for their the impact to the confidentiality, availability, and integrity of protected data, as well as external drivers in order to weigh controls based on their impact.”

We think this is a great tool especially for small to medium businesses and local governments.  Most often these smaller organizations don’t have formal governance practices or necessary skills in-house.  This tool could help them develop those processes. We also see this as a great tool or internal auditors to use. It gives businesses a place to document the testing methods and results.