M365 Workspace & Access Policy

Document Number: ISMS-POL-M365-01

Classification: L1 — Policy (Domain)

Version: 0.3.0

Effective Date: March 1, 2026

Author: Lucas Shin — Security Director

Approved By: Richard — CISO

Next Review Date: February 2027

Parent Policy: Information Security Policy (ISMS-POL-ISP-01)

1. Purpose

This policy defines the access control, data classification, and security control structure for Cybercraft within the Microsoft 365 environment.

It establishes how the M365 platform structure — specifically licence tiers, Teams team/channel membership, and Entra ID configuration — serves as the primary mechanism for implementing information security controls.

1.1 Design Principle: Platform = Policy

This policy is built on the principle established in the Information Security Policy (L1 Master):

2. Scope

2.1 Applicable Systems

• Microsoft 365 tenant operated by Cybercraft
• All Teams teams, channels, and SharePoint sites within the tenant
• Entra ID identity and access management
• Cross-tenant relationships with Techtype and HVT

2.2 Applicable Users

• All Cybercraft personnel (employees, contractors, trusted guests)
• All users with a Cybercraft Entra ID account, regardless of licence tier
• External collaboration partners (Level 3 — guest accounts)

2.3 Out of Scope

• Client tenant configurations (covered by consulting engagement deliverables)
• Non-M365 SaaS tools (covered under P5 Supplier & Third-Party Security Policy (ISMS-POL-STP-01))

3. Data Classification

3.1 Classification Scheme — Two Levels

Cybercraft adopts a two-level data classification scheme. This is a deliberate design decision based on the principle that classification must be enforceable by platform structure, not dependent on user judgement.

3.2 Classification Principles

1. "Where it is" = "What it is" — Data classification is determined by its location in the Teams channel structure. The applicable rule depends on team type (see §5.3): in Internal Only teams, all Standard Channel data may be Confidential; in Internal Mixed teams, Private Channel = Confidential, Standard Channel = General.
2. No user-level classification decisions — Users are not required to assess or label individual documents. The channel structure enforces classification automatically.
3. No Sensitivity Labels — Microsoft Purview Sensitivity Labels are not deployed. For a 3–5 person SMB, label-based classification creates user burden without proportionate benefit. This decision will be reviewed if Cybercraft exceeds 10 personnel or if client contracts require it.
4. Confidential data placement follows team type rules — In Internal Mixed or External Collaboration teams, Confidential data shall not be placed in Standard Channels. In Internal Only teams (all Level 1), Standard Channels may contain Confidential data. Violation of the applicable rule constitutes a security incident.

3.3 External Sharing

• General data: Can be shared externally via email attachment or by inviting the recipient as a Guest to a Teams channel (Security Director approval required for Guest invitation — see §5.4)
• Confidential data: External sharing requires the Confidential External Sharing Procedure (see §5.4 and M365 Operations Procedure ISMS-PROC-M365-01). Security Director approval mandatory
• No SPO sharing links: "Specific People" and "Anyone" sharing link types are disabled by the tenant-level external sharing setting. This eliminates the risk of uncontrolled external sharing link creation
• Review trigger: If business requirements change, this setting can be relaxed to "Existing guests only" with CISO approval and documented risk acceptance

4. Licence Tier Structure

4.1 Licence Tiers — Service Access Matrix

Six licence tiers are available (Exchange Only, Teams Essentials, Email+Teams, M365 Basic, M365 Standard, M365 Premium), each providing a different combination of Exchange, Teams, SharePoint/OneDrive, Office apps, and security controls (CA, Intune, Defender). Security-relevant features (CA, Intune, Defender) are Premium-only.

Full licence-service matrix: See ISMS-CONF-M365-01 §2.1. Note: Email+Teams ($8) is not recommended — use M365 Basic ($7) instead.

4.2 Prohibited SKU: Business Standard

Security rationale: Standard includes desktop Office app licences but does not include Entra ID P1 (Conditional Access). This means desktop app sign-in cannot be controlled by CA — creating an unmanaged access path that bypasses the "Platform = Policy" data control model.

Cost rationale: Standard ($14) + Entra ID P1 add-on ($7) = $21/user/month — only $1 less than Premium ($22), which additionally includes Intune, Defender for Business, and the full security stack.

Design principle: Users who do not need desktop apps → Business Basic + P1. Users who need desktop apps → Business Premium. Standard occupies a middle ground that only creates a security gap.

4.3 Licence Assignment Principle

Add-on guidance:

• Entra ID P1 add-on ($7/user) with Business Basic is the standard configuration for Level 2 users (Basic $7 + P1 $7 = $14/user/month). This is required for CA-based data control (see §6.3).
• Combining add-ons with Business Standard is not recommended: Standard ($14) + Intune ($8) = $22 vs Premium ($22) = identical cost, but Premium additionally includes Defender and the full security stack.
• If full technical controls are needed beyond CA, Premium is the only cost-effective option.

4.4 Teams File Access — Case-by-Case Definition

File access behaviour differs depending on access path and licence. The following matrix defines each case:

File access behaviour differs by access path (Teams Files tab, SharePoint direct access, Private Channel) and licence tier. Key distinctions: Teams Essentials/Email+Teams have limited edit capability; SharePoint licence features (full editing, OneDrive, DLP) require Basic or above; Private Channel access is member-controlled across all tiers.

Full file access case matrix: See ISMS-CONF-M365-01 §2.2

5. Teams Structure & Access Control

5.1 Access Control Tiers — Based on Trust Model

Cybercraft's Teams access control follows a three-tier trust model:

5.2 Channel Types and Guardrail Principles

Cybercraft adopts a guardrail approach to Teams channel governance: the policy defines channel type principles and data classification rules; specific channel structures are determined by Team Owners based on business need.

Channel Type Definitions

Shared Channels: Currently not in use at Cybercraft (B2B Direct Connect not configured). Reserved as a future option for cross-tenant collaboration without Guest account creation.

Channel Governance Principles

1. Channel type = data classification guardrail. The channel type determines what data classification is permitted within it. Users follow channel-type rules rather than making per-file classification decisions.
2. Team Owners control channel structure. Owners create channels based on business need within the guardrail framework. Security Director provides guidance; prescriptive channel lists are not mandated.
3. Team and channel creation restricted. Team creation requires Security Director approval. Channel creation is restricted to Team Owner role.
4. Guest invitation authority. Only Security Director holds the Guest Inviter role in Entra ID. General members cannot invite Guests.
5. File sync is prohibited by default. OneDrive sync to local devices is not permitted for unmanaged devices (enforced by CA-Restrict-SPO-Unmanaged Session Control). ADUE-managed devices (macOS Premium) may sync within the Managed Volume.

5.3 Team Operational Model

Channel type rules vary based on the team's composition and purpose:

Owner Structure

• Current Owners: Farah Herbert (CEO), Lucas Shin (Security Director), Richard Williams (CISO)
• SMB initial scale — 3-person Owner structure is appropriate. ISO 27001 A.5.3 segregation of duties compensated by audit logging.
• Expansion rules: External Guests = Member only (never Owner). General employees = Member by default. Owner promotion requires Security Director or CISO approval.

5.4 Guest Governance and External Sharing

Guest Access Principles

• Guest invitation: Security Director only (Entra ID Guest Inviter role). General members cannot invite Guests.
• Guest CA policy: CA-Permit-Guest-MFA — MFA required. Native app access permitted (Teams, Outlook). Access scoped to teams/channels where Guest is a member.
• Guest lifecycle: External collaboration teams are created per engagement or per client. Guests are removed and teams archived upon engagement completion. Quarterly Guest review mandatory.
• Guest deletion verification: Before deleting a Guest account, check Entra ID Assignments tab + SharePoint Admin Guest Access Report to confirm no residual access dependencies.

SPO/ODB External Sharing Policy

• This setting eliminates the risk of external sharing link creation by any user
• If business requirements change, this can be relaxed to "Existing guests only" with CISO approval
• Current 3-person team: no immediate operational impact. Setting takes effect when general members join

Confidential External Sharing

When Confidential data must be shared with external parties, the Confidential External Sharing Procedure (defined in M365 Operations Procedure ISMS-PROC-M365-01) must be followed. This involves creating a dedicated per-engagement team with controlled Guest access. Direct SPO link sharing is not available due to the "Only people in your organization" setting.

6. Security Controls by Licence Tier

Security Control Architecture — Quick Reference

Three approved SKU configurations map to specific security control sets across platforms. Business Standard is prohibited (see §4.2).

Full SKU-to-control mapping table: See ISMS-CONF-M365-01 §3.1

Key principle: No desktop apps needed → Basic + P1. Desktop apps needed → Premium. There is no middle ground (Standard prohibited).

SKU decision flowchart: See Annex A, Figure 1.

CA Access Control Overview

The 3-policy CA structure evaluates access requests in the following logical flow — see Annex A, Figure 2.

상세 흐름도 (플랫폼별 분기, 기술적 조건 포함)는 Access Control & Data Protection Procedure (ISMS-PROC-BYOD-03) §2.3 참조.

6.1 Premium Users — Technical Controls

Premium licence includes Entra ID P1 (Conditional Access) + Intune + Defender as a bundle.

Conditional Access (CA) — 3-Policy Structure:

• CA-Require-AllApps-CompliantOrAPP — Require Compliant Device OR Require APP (macOS: ADUE compliant; Windows: Edge APP)
• CA-Restrict-SPO-Unmanaged — Session Control for SPO/ODB: download/sync/print blocked on unmanaged devices
• CA-Permit-Guest-MFA — External Guests (#EXT#): MFA required, access scoped to channel membership

Application Protection — by Platform: iOS/Android (MAM APP — full DLP including copy/paste block), Windows (MAM Edge only — org data protection), macOS (ADUE — OS-level Managed Volume isolation, no APP).

Defender for Business: Endpoint threat protection, anti-malware, web filtering, vulnerability management on enrolled devices.

Detailed platform protection matrix: See ISMS-CONF-M365-01 §3.2

6.2 Level 2 — Trusted Guest Controls (Basic + P1)

Level 2 users are assigned Business Basic + Entra ID P1 add-on ($14/user/month). This provides Conditional Access for data control but does not include Intune, MAM, ADUE, or Defender.

Technical control — Conditional Access (via P1 add-on):

• CA-Require-AllApps-CompliantOrAPP — Level 2 users without Intune enrolment or APP cannot satisfy the compliant/APP grant → access restricted to basic browser sessions
• CA-Restrict-SPO-Unmanaged — Session Control blocks download/sync/print on unmanaged devices → browser-only viewing
• SPO site permissions (= Teams membership) — automatically limits which SharePoint sites a user can access; non-members denied even with direct URL
• Security Defaults — MFA enforced for all sign-ins
• CA is the sole technical enforcement mechanism for Level 2; without it, the "Platform = Policy" data control model cannot function for these users

No device-level technical controls:

• No MAM (App Protection Policy) — no app-level data isolation on any platform
• No ADUE — no managed volume separation on macOS
• No Intune enrolment — no device compliance enforcement
• No Defender for Business — no endpoint threat protection

Compensating policy controls:

Level 2 security relies on CA (Compliant/APP requirement + Session Control) + SPO site permissions (= Teams membership) + policy controls. There is no device-level work/personal separation or app-level data leakage prevention. Teams membership scope, CA-enforced session restrictions, and policy obligations are the primary controls.

Exchange Online Plan 1 accounts ($4/user/month): Email-only accounts with no Teams, SharePoint, or OneDrive access. These fall outside the scope of Teams-based data controls. Security Defaults (MFA) apply. No CA, as these accounts do not access data subject to the "Platform = Policy" model.

6.3 Conditional Access — Prerequisite for "Platform = Policy"

The "Platform = Policy" model (Section 1.1) relies on the following enforcement layers:

1. Data resides in SharePoint/OneDrive — Teams channel files are stored in SharePoint behind the scenes
2. SPO site permissions = Teams membership — users can only access SharePoint sites for teams they are a member of, even via direct URL navigation (sharepoint.com). Non-members are denied access regardless of authentication. This is the primary access scope limiter
3. CA enforces device/app compliance — CA-Require-AllApps-CompliantOrAPP ensures only compliant (ADUE) or APP-protected (Edge) sessions access M365 services. Unmanaged/non-compliant sessions are blocked
4. Session Control restricts unmanaged devices — CA-Restrict-SPO-Unmanaged blocks download/sync/print for non-compliant devices, limiting unmanaged sessions to browser-only viewing
5. CA requires Entra ID P1 — therefore, even Level 2 users (Basic) need P1 to be subject to CA policies

Why Level 2 users need P1 (Business Basic + P1):

• Business Basic alone includes Entra ID Free, which has no Conditional Access
• Without CA: (1) Session Control cannot operate → unmanaged devices can download/sync SPO files freely, (2) Windows BYOD Teams Desktop app login is not blocked → bypasses the Edge-only restriction
• P1 enables two critical controls: Session Control for SPO/ODB action restriction + CA app compliance requirement for Windows BYOD Edge-only enforcement

CA Architecture — 3-Policy Structure:

6.4 Why No Middle Ground

Combining security add-ons with Business Standard is not cost-effective:

• CA alone ($7/user): While CA is mandatory for the data control model (see §6.3), purchasing it as a standalone add-on only makes sense with Business Basic ($7 + $7 = $14). Pairing it with Standard is irrational (see §4.2).
• Intune alone ($8/user): M365 Standard + Intune = $22 vs Premium = $22 — identical cost but Premium includes Defender and the full security stack
• Conclusion: Non-Premium → Basic + P1 (CA for data control). Full technical controls → Premium. No other combination is justified.

7. Administration & Roles

7.1 Administrative Roles

7.2 Admin Account Separation

• Administrative actions on M365 console must use a dedicated admin account, not the user's standard account
• Admin account requires a separate licence (minimum Standard)
• Admin sessions should be performed in an isolated environment (e.g., separate browser profile, VM, or secondary device) to avoid disrupting the user's active sessions

7.3 Teams Governance

• Team creation: Restricted to Systems Administrator only (all other users' team creation rights are disabled in Teams policy)
• Channel creation: Restricted to Team Owner role (assigned by Systems Administrator)
• Guest invitations: Security Director holds Entra ID Guest Inviter role — Level 3 external guests are invited via Entra ID and assigned to a dedicated external collaboration team (see §5.4)

8. Monitoring & Audit Evidence

All structures defined in this policy must be demonstrably operational for audit purposes.

8.1 Ongoing Monitoring

8.2 Audit Evidence Mapping

When an auditor asks:

9. Compliance Mapping

10. Document Control

Review Schedule

• Quarterly: Teams membership review, licence assignment check
• Annually: Full policy review, trust model reassessment, licence tier pricing update
• Ad-hoc: Upon personnel changes, new client engagements, Microsoft licensing changes, or security incidents

Annex A — Diagrams

Figure 1 — SKU Decision Flowchart

flowchart TD
    Start["Does the user need\nOffice desktop apps?"] -->|No| Basic["Business Basic + P1\n\$14/user/month"]
    Start -->|Yes| NeedMAM["Is BYOD sufficient?\n(Edge web apps only on Windows)"]
    NeedMAM -->|"Yes (macOS or web-only)"| Premium["Business Premium\n\$22/user/month"]
    NeedMAM -->|"Need Windows desktop apps"| Join["Business Premium\n+ Entra Join + Full MDM"]
    
    Basic --> BasicControl["SPO site permissions scope\n+ Session Control\nNo MAM/Intune"]
    Premium --> PremiumControl["macOS: ADUE + VPP + CA\nWindows: Edge APP + CA"]
    Join --> JoinControl["Full MDM + Compliance\n= BYOD Full MDM Exception"]

    style Start fill:#f9f,stroke:#333
    style Basic fill:#4CAF50,color:#fff
    style Premium fill:#2196F3,color:#fff
    style Join fill:#FF9800,color:#fff

Figure 2 — CA Access Control Overview

flowchart LR
    A["사용자 접근 시도"] --> B{"Assignment<br>누구인가?"}
    B -->|"Break-glass"| C["✅ Exclude<br>무제한"]
    B -->|"Guest"| D["MFA 요구<br>(CA-Permit-Guest-MFA)"]
    B -->|"내부 사용자"| E{"Grant 평가<br>Compliant OR APP?"}
    E -->|"충족"| F{"SPO/ODB?"}
    E -->|"미충족"| G["❌ 차단"]
    F -->|"No"| H["✅ 접근 허용"]
    F -->|"Yes"| I{"Session Control<br>디바이스 상태?"}
    I -->|"Managed"| J["✅ 전체 기능"]
    I -->|"Unmanaged"| K["⚠️ 제한 접근"]
    style C fill:#51cf66,color:#fff
    style D fill:#74c0fc,color:#fff
    style G fill:#ff6b6b,color:#fff
    style H fill:#51cf66,color:#fff
    style J fill:#51cf66,color:#fff
    style K fill:#ffd43b,color:#333

[End of Policy Document]