Microsoft 365: Organizational Data Service is now available in GCC-High

🚨 The Signal: Microsoft 365 Organizational Data Service is now available in GCC-High. This service ingests HR data to power Copilot and M365 apps, centralizing organizational data for enhanced features and data quality checks.

The Impact

Security teams and data privacy officers are affected by the new ingestion of sensitive HR data, increasing data exposure risk.

• Security Teams: Increased attack surface due to new data ingestion points.
• Data Privacy Officers: New considerations for sensitive HR data handling and compliance.
• Compliance Teams: Need to validate data residency and access controls for HR data.
• IT Administrators: Responsible for securing the new data connectors and service.

The Action

1. Review Microsoft documentation for Organizational Data Service data flow and storage.
2. Implement strict access controls for who can configure and manage HR data connectors.
3. Conduct a privacy impact assessment (PIA) for HR data ingested into M365.
4. Monitor audit logs for data ingestion activities and access to organizational data.
5. Ensure data retention policies align with regulatory requirements for HR data.

Domain: Other · Impact: high · Workload: Other