Case study--Configure an offensive language policy
Overview
The Contoso Corporation is a fictional organization that needs to quickly configure a policy to monitor for offensive language. They have been using Microsoft 365 primarily for email and Microsoft Teams support for their employees but have new requirements to enforce company policy around workplace harassment. Contoso IT administrators and compliance specialists have developed a plan to create and enable a communication compliance policy that will monitor for offensive language for chats sent in Microsoft Teams and email messages sent in Exchange Online. This case study will cover the basics for quickly configuring a communication compliance policy to monitor communications for offensive language. This guidance includes:
- Step 1 - Planning for communication compliance
- Step 2 - Accessing Microsoft Purview Communication Compliance
- Step 3 - Configuring prerequisites and creating a communication compliance policy
- Step 4 - Investigation and remediation of alerts
Step 1 - Planning for communication compliance
Permissions
By default, global administrators do not have access to communication compliance features. Permissions must be configured so that Contoso IT administrators and compliance specialists have access to communication compliance.
Contoso IT administrators sign into the Microsoft Defender portal permissions page using credentials for a global administrator account and select the link to view and manage roles in Office 365.
After selecting Create, they give the new role group a friendly name of Communication compliance and select Next.
They select Choose roles and then select Add. They add the required roles by selecting the checkbox for Supervisory Review Administrator, Case Management, Compliance Administrator, and Review, then they select Add, Done, and Next.
Next, the IT administrators select Choose members then select Add. They select the checkbox for all the users and groups that they want to create policies and manage messages with policy matches. They add the IT administrators, compliance specialists, and other colleagues in Human Resources and Legal departments that they identified in the initial planning, then select Add, Done, and Next.
To finalize the permissions, the IT administrators select Create role group to finish. It will take about 30 minutes for the roles to be effective in Contoso's Microsoft 365 service.
Step 2 - Accessing Microsoft Purview Communication Compliance
After configuring the permissions for communication compliance, Contoso IT administrators and compliance specialists defined in the new role group can access the communication compliance solution in Microsoft Purview. An easy way for Contoso IT administrators and compliance specialists to access the communication compliance solution is to sign in directly to the Microsoft Purview compliance portal. After signing in, users simply need to select the Show all control to display all the compliance solutions and then select the Communication compliance solution to get started.
Step 3 - Configuring prerequisites and creating a communication compliance policy
To get started with a communication compliance policy, there are several prerequisites that Contoso IT administrators need to configure before setting up the new policy to monitor for offensive language. After these prerequisites have been completed, Contoso IT administrators and compliance specialists can configure the new policy and compliance specialists can start investigation and remediating any generated alerts.
Enabling auditing
Communication compliance requires audit logs to show alerts and track remediation actions taken by reviewers. The audit logs are a summary of all activities associated with a defined organizational policy or anytime there is a change to a communication compliance policy.
Contoso IT administrators review and complete the step-by-step instructions to turn on auditing. After they turn on auditing, a message is displayed that says the audit log is being prepared and that they can run a search in a couple of hours after the preparation is complete. The Contoso IT administrators only have to do this action once.
Setting up a group for in-scope users
Contoso compliance specialists want to add all employee to the communication policy that will monitor for offensive language. They could decide to add each employee user account to the policy separately, but they've decided it is much easier and saves a lot of time to use an All Employees distribution group for the users for this policy.
They need to create a new group to include all Contoso employees, so they take the following steps:
Contoso IT administrators sign in to the Microsoft 365 admin center and navigate to Microsoft 365 admin center> Groups> Groups.
They select Add a group and complete the wizard to create a new Microsoft 365 group or Distribution group.
After the new group is created, they need to add all Contoso users to the new group. They open the Exchange admin center and navigate to Exchange admin center> recipients> groups. The Contoso IT administrators select the Membership area and the new All Employees group they created and select the Edit control to add all Contoso employees to the new group in the wizard.
Creating the policy to monitor for offensive language
With all the prerequisites completed, the IT administrators and the compliance specialists for Contoso are ready to configure the communication compliance policy to monitor for offensive language. Using the new offensive language policy template, configuring this policy is simple and quick.
The Contoso IT administrators and compliance specialists sign into the Microsoft Purview compliance portal and select Communication compliance from the left navigation pane. This action opens the Overview dashboard that has quick links for communication compliance policy templates. They choose the Monitor for offensive language template by selecting Get started for the template.
On the policy template wizard, the Contoso IT administrators and compliance specialists work together to complete the three required fields: Policy name, Users or groups to supervise, and Reviewers.
Since the policy wizard has already suggested a name for the policy, the IT administrators and compliance specialists decide to keep the suggested name and focus on the remaining fields. They select the All employees group for the Users or groups to supervise field and select the compliance specialists that should investigate and remediate policy alerts for the Reviewers field. The last step to configure the policy and start gathering alert information is to select Create policy.
For more information about getting started with communication compliance policies, see Configure Microsoft Purview Communication Compliance.
Step 4 – Investigate and remediate alerts
Now that the communication compliance policy to monitor for offensive language is configured, the next step for the Contoso compliance specialists will be to investigate and remediate any alerts generated by the policy. It will take up to 24 hours for the policy to fully process communications in all the communication source channels and for alerts to show up in the Alert dashboard.
After alerts are generated, Contoso compliance specialists will be able to investigate and remediate offensive language issues.