When configuring Compliance Policies in ProvisionPoint, Rules are created and added to ruleset groups to define what checks will be run.
This article will explain what Privacy mismatch is and the available rules.
What does the Privacy setting do in O365 ?
Behind your Teams, Planners, Viva Engage Communities, SharePoint Sites are M365 Groups.
The Group that will be created can be set to either Public or Private.
The best use case for Public Groups is for an all company Team or Site.
When a workspace is requested via ProvisionPoint the Group privacy can be defined.
What is Privacy Mismatch?
When you configure a Service Definition in ProvisionPoint the Privacy setting default is set to public or private.
You can also allow your requestors to choose at the request stage or lock this down to force the setting.
A mismatch will compare the privacy in both O365 and ProvisionPoint to each other or to the values you define. If they do not match it will be flagged as non-compliant!
This rule is useful to check for unauthorised changes, or you want to run a report looking for workspaces that Public.
The privacy mismatch will look for mismatches based on the configuration you set. The rule you choose will determine if this is a report only, to notify an owner or admin to manually check and change or automatically align to a value.
Available rules:
|
Rule name
|
Description
|
|
Privacy Mismatch - Report
|
Report only on the mismatch that is configured, this will be stored in the policy queue or can be extracted via our API
|
|
Privacy Mismatch - Notify
| Send an email to configured people about the non-compliance, this email will include content define in the rule.
Additional configuration will be needed, read the Configure Notifications for Notify Rules article for more information |
|
Privacy Mismatch - Align
| Align to O365, ProvisionPoint instance, a defined value (Private) |
We always recommend starting with a report rule to ensure the policy brings back the results you expect before applying other rules
Mismatch Types
The mismatch you choose will set what is going to be flagged as non-compliant.
| Mismatch Type | Description |
| Instances | The O365 workspace does not match the service instance shown in ProvisionPoint Workspaces Directory info |
| Service Definition default | The O365 workspace or the service instance do not match the service definition default |
|
Transform Tag
|
The O365 workspace or service instance do not match a transform tag value. A transform tag would be defined in a lookup or as a request variable in ProvisionPoint Workspaces. This value would be used to set the Privacy setting at provisioning.
Add the name of the request variable or lookup to the Mismatch value
|
| Defined values | The O365 workspace or service instance do not match any of the selected values set to Yes |
Align Types
If non-compliance is found the align type will set what changes will be applied.
| Align Type | Description |
| O365 workspace | Will set service instance to match the O365 setting |
| Service Definition default | Will set the O365 workspace and the service instance to match the service definition default |
| Service Instance | Will set the O365 workspace to match the service instance setting shown in Info |
| Defined values | Will set the O365 workspace and service instance to match the Align value |
| Min value | Will set the least permissive value from the O365 workspace or service instance. |
| Max value | Will set the most permissive value from the O365 workspace or service instance |
| Transform Tag | Will set the O365 and service instance to match the value set by the transform tag set in Align value. This will be the name of the request variable or lookup. |
Check the Results:
Once a Compliance policy is run you can check the results in the Job Queue and in the Timeline if it is non-compliant.
Read the articles in the Job Queue section: