The challenge
- Copilot within a quarter, without data leaks. Management wanted Copilot rolled out fast. The worry was that it would surface sensitive data stored in SharePoint and OneDrive, or that this data would leave the organization.
- A cloud move under time pressure. Mail ran on an on-premises server, and the team wanted to start moving mailboxes as soon as possible.
- Regulatory guidelines. The company has to meet the National Cyber Directorate’s guidelines for protecting Office 365.
- Restricted access. At first, access to mail from outside the organization had to be restricted.
What we did together
1Hardening before the first mailbox moved
Before any mail moved to the cloud, we set who can sign in, from where and with which authentication. Legacy authentication, which bypasses MFA, was blocked. Risky sign-ins are blocked automatically. Mail is scanned before it reaches employees.
The benefit: A stolen password is no longer enough to get in, and phishing and malicious attachments are stopped before the inbox. Every mailbox moved into a protected tenant, with no exposed in-between period.
2Admin rights only when needed
Powerful admin rights are no longer always on. Admins activate them when they need them, for a limited time.
The benefit: Even if an admin account is compromised, the attacker doesn’t get control of the tenant.
3A continuous view with Griffin31
Griffin31 checks every Microsoft 365 setting. For each finding it shows the risk, the impact on users and how to fix it.
The benefit: The team sees what’s open and what’s urgent, fixes the riskiest items first with our help, and notices when a setting slips back.
4Copilot, opened with control
Copilot sees whatever the employee can see, so we hardened SharePoint and OneDrive and set up DLP rules first. Uploading files to Copilot is blocked until data classification is complete. Every change was tested in a lab first, so work wasn’t disrupted.
The benefit: Employees get Copilot, with less risk of sensitive data leaving the organization through it.
5Checked against every new attack
When we published an alert about a new attack campaign targeting Israeli organizations, we used Griffin31 to check the tenant against every stage of it. Most of the controls that block it were already in place, with one gap left to close.
The benefit: No waiting for an incident. The team knows in advance what already stops the attack and what still needs fixing.
What changed
- Fewer ways in. A stolen password, legacy authentication or a risky sign-in is no longer enough to get into the tenant.
- Less damage if something is breached. Admin rights are active only when needed, so a compromised account is worth less to an attacker.
- Copilot without a leak path. The data was hardened before employees got Copilot.
- A clear picture, all the time. Griffin31 always shows what’s open, and we help the team fix things in order of priority, instead of a manual review every few months.
- Ready for the next attack. Every new threat is checked against the tenant, so the team knows whether it’s protected.
Want to open Copilot in your organization and know your data is protected? Start with a free two-week, read-only pilot.