Kurt Shintaku's Blog

Interested in what is being patched by each monthly update?  Here are the links that break this down, down to the CVE & whether the vulnerability has been exploited in the wild.

• Deployments – Security Update Guide
  (This is the list of update packages released for each product & version – including if the package is an Extended Security Update, and where to download the update from the Microsoft Update Catalog)
• Vulnerabilities – Security Update Guide
  (This is a view of all vulnerabilities patched across a given time period & what severity they were)
• Release Notes – Security Update Guide
  (This is where you look up all the vulnerability fixes patched for each monthly security update release)

For example, for Windows Server 2012, here are the most recent Extended Security Update rollups that ESU subscribers have received for their end-of-life Windows Server 2012 instances:

• November 14, 2023—KB5032249 (Monthly Rollup)
  https://support.microsoft.com/en-us/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041#Take%20action
  Vulnerabilities: https://msrc.microsoft.com/update-guide/releaseNote/2023-Nov
  63 vulnerabilities, 1 known vulnerability exploit, 15 vulnerability more likely to be exploited
  (8.8 Windows Scripting, 7.1 Windows Storage, 7.8 Windows Common Log File System Driver)
• December 12, 2023—KB5033420 (Monthly Rollup)
  https://support.microsoft.com/en-us/topic/december-12-2023-kb5033420-monthly-rollup-fcb2ed87-527d-4313-ae01-0c43af80c545
  Vulnerabilities: https://msrc.microsoft.com/update-guide/releaseNote/2023-Dec
  37 vulnerabilities, 16 more likely to be exploited
  (7.8 Windows Win32K, 7.8 Windows Kernel, 7.8 Windows Kernel-Mode Drivers, 7.5 Windows Defender, 7.8 Windows Win32K, 7.8 Windows Local Security Authority Subsystem Service (LSASS), 7.8 Windows Cloud Files Mini Filter Driver)
• January 9, 2024—KB5034171 (Monthly Rollup)
  https://support.microsoft.com/en-us/topic/january-9-2024-kb5034171-monthly-rollup-377e3b9c-c5e0-420b-bc00-179b90c82ea4
  Vulnerabilities: https://msrc.microsoft.com/update-guide/releaseNote/2024-Jan
  56 vulnerabilities, 14 more likely to be exploited
  (7.5 Windows Scripting, 7.8 Windows Common Log File System Driver, 8.8 Windows Authentication Methods, 7.8 Windows Win32K, 7.8 Windows Win32K Kernel Subsystem, 7.8 Windows Win32K, 7.8 Windows Cloud Files Mini Filter Driver)
• February 13, 2024—KB5034819 (Monthly Rollup)
  https://support.microsoft.com/en-us/topic/february-13-2024-kb5034819-monthly-rollup-67ea3009-44fe-4781-8235-ef8ca210f5b5
  Vulnerabilities: https://msrc.microsoft.com/update-guide/releaseNote/2024-Feb
  73 vulnerabilities, 2 known exploits, 13 more likely to be exploited
  (7.8 Windows Kernel, 7.8 Windows Kernel, 7.8 Windows Win32K – ICOMP, 7.0 Windows Kernel)

Is your legal organization sniffing around your org for details around the use of Microsoft artificial intelligence? 

If you have an Enterprise Agreement, here’s the Terms of Use for various Microsoft Artificial Intelligence solutions I found as of February 18, 2024:

• Online Services (All)
• Microsoft Generative AI Service
  https://www.microsoft.com/licensing/terms/product/ForOnlineServices/EAEAS
• Windows & Edge
• Copilot in Windows (PREVIEW) SUPPLEMENTAL TERMS
  https://learn.microsoft.com/en-us/windows/privacy/copilot-supplemental-terms
• Copilot in Windows: Your data and privacy
  https://support.microsoft.com/en-us/windows/copilot-in-windows-your-data-and-privacy-3e265e82-fc76-4d0a-afc0-4a0de528b73a
• Microsoft 365
• Microsoft Product Terms for Microsoft 365
  https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/EAEAS
• Data, Privacy, and Security for Microsoft Copilot for Microsoft 365
  https://learn.microsoft.com/en-us/microsoft-365-copilot/microsoft-365-copilot-privacy
• Azure
• Microsoft Product Terms for Azure
  Azure AI Content Safety
  Azure Machine Learning service
  Azure AI Services
    Azure OpenAI Service
  https://www.microsoft.com/licensing/terms/productoffering/MicrosoftAzure/EAEAS
• Azure Previews (Supplemental Terms of Use)
  Azure Machine Learning (Preview Features)
  Azure AI Content Safety
  Microsoft Generative AI Services Previews
  Azure AI Video Indexer Edge (previews)
  Azure AI Video Indexer Video Redaction (Preview)
  Microsoft Copilot for Azure
  Azure AI Studio
  https://azure.microsoft.com/en-us/support/legal/preview-supplemental-terms/
• Azure OpenAI Service
• Customer Copyright Commitment Required Mitigations for Azure OpenAI Service
  https://learn.microsoft.com/en-us/legal/cognitive-services/openai/customer-copyright-commitment
• Code of conduct for Azure OpenAI Service
  https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct
• Data, privacy, and security for Azure OpenAI Service
  https://learn.microsoft.com/en-us/legal/cognitive-services/openai/data-privacy
• GitHub Copilot (EA)
  Data & Defense of Third-Party Claims
  https://www.microsoft.com/licensing/terms/productoffering/GitHubOfferings/EAEAS
• Dynamics (EA)
• Data Use and Access for Abuse Monitoring
  https://www.microsoft.com/licensing/terms/productoffering/MicrosoftDynamics365Services/EAEAS
• Microsoft Copilot for Sales
  https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/EAEAS

So we recently rolled out a new customer facing readiness initiative called the Azure Enablement Series that features some of the hottest topics and technologies coming out of Microsoft and Azure, presented by our top-notch Technical Specialist team members.

• 2/17/24: Latest in Azure AI Services (55min)
• 1/17/24: Increase your developer productivity with Azure (46min)
• 12/13/23: Everything you need to know about Azure Cosmos DB in 45 minutes (50min)
• 12/06/23 Microsoft Ignite 2023 Announcements Recap (50min)
• 11/29/23: Observability in Azure (53min)
• 01/10/24 Unlock the potential of AI with ease using Semantic Kernel (56min)

You can view our most recent recordings at our new Azure Enablement Series YouTube channel, so please subscribe!

• Azure Enablement Series – A YouTube Channel
  https://www.youtube.com/@WMWAzureEnablementSeries

Learn about Microsoft Copilot for Security, an AI-powered, cloud-based security analysis tool that enables security analyst and IT admins to process security signals and protect at the speed and scale of AI.

Join us for this live learning experience where you will be guided by subject matter experts through the Learn modules below in real time along with developers around the globe. Earn badges, prepare for certifications and Learn Live with a great community! See you there 🙂

DATES/SESSIONS

• February 27, 2024 12:00PM – 1:30PM (Pacific)
  ”Fundamentals of Generative AI”
  
• March 5, 2024 12:00PM – 1:30PM (Pacific)
  ”Fundamentals of Responsible Generative AI”
  
• March 19, 2024 12:00PM – 1:30PM (Pacific)
  “Describe Microsoft Copilot for Security”
  
• March 27, 2024 12:00PM – 1:30PM (Pacific)
  ”Describe the core and embedded features of Microsoft Copilot for Security”

REGISTRATION

• Learn Live: Get started with Microsoft Copilot for Security (All 4 episodes)
  https://learn.microsoft.com/en-us/shows/learn-live/microsoft-copilot-for-security/

Join Microsoft President, Collaborative Platforms, Jeff Teper and other product leaders from Microsoft as they highlight the value and benefit of Microsoft 365 innovation.

You’ll hear and see AI innovation, advances in employee experiences, and content services that help automate the flow of work. We are on the cusp of the new leap in productivity – to help you better understand, create, analyze, and collaborate faster than ever. And we’re excited to share all.

The keynote will be a packed with news and demos across Teams, SharePoint, Syntex, OneDrive, and security and compliance across Microsoft. Kick off the Microsoft 365 Conference to understand the strategy and vision – clarity on where Microsoft is taking productivity into the future.

Oh.  And there’s 150 sessions to attend including:

• Be Your Own Copilot: How to Create Your Own Generative AI Assistant
• Battle of the Forms: Microsoft Forms vs. Power Apps vs. SharePoint Forms
• Beyond eDiscovery – Exploring Additional Use Cases for M365 Purview
• Boosting Employee Development with Viva Goals and Copilot
• Bring Together All Your Tasks and Plans with the New Microsoft Planner App for Teams
• Data Recovery Options for SharePoint/OneDrive
• Data Lifecycle and Records Management – Tales from the Trenches
• Data Security Breach in Microsoft 365, Now What?
• …

…and 18 workshops to participate in:

• AI & Copilot: Preparing, Piloting, Paths To Success/Scale, & Plugins 
• Guard and Protect: Microsoft 365 Security Unleashed
• Power Apps Fundamentals: Extending SharePoint into Low-Code Apps and Forms (2024 edition)
• Governance for Microsoft 365, the Power Platform and Your Copilots
• Build and Extend Your Own Copilot Using Microsoft Copilot Studio
• Deep Dive into Data Protection with Microsoft Purview
• Power Automate Cloud Flows Hands-on Workshop for Microsoft 365 Power Users
• SharePoint Premium Fundamentals Workshop: Realizing AI Content Management in Your Daily Work Life
• …

Register today!

• Dates
  April 30, May 1 & 2, 2024
  (Workshops: April 28, 29 & May 3)
• Location
  Walt Disney World Swan & Dolphin Resort
  1500 Epcot Resorts Blvd
  Orlando, FL 32830
• Registration:
  https://m365conf.com/

(p.s. Ping me if you’re a customer of mine for a discount code!)

Open Microsoft Edge & try hitting CTRL-SHIFT-. (Control-Shift- Period) You’ll start “Copilot for Edge”

One of the benefits of Copilot in Edge is it’s ability to summarize the things you browse to by using promps like, "Summarize this document" or "What does this page say about…".

The following is a summary of what content CAN be summarized by Copilot for Edge:

✅ Intranet Sites (Internal) such as SharePoint

✅ Internet Sites (External) such as Wikipedia

✅ Outlook Web App

✅ Adobe Acrobat PDF files

The following CANNOT be summarized by Copilot for Edge:

❌ Office Documents

❌ Sites protected by Purview DLP policies

❌ Sites protected by MAM policies

❌ Sites protected by MDA poloicies

Read the source at:

• Copilot in Edge webpage summarization behavior
  https://learn.microsoft.com/en-us/DeployEdge/edge-learnmore-copilot-page-summary-results
• Documentation for Copilot for Edge
  https://learn.microsoft.com/en-us/copilot/edge

Join us for two days of insights, demos, and deep dives on Copilot for Microsoft 365!

We’ll have breakout sessions and live Q&A with Microsoft experts—all so you can learn more about how Copilot works, how you can prepare your tenant, strategies to help skill your users and drive adoption, and how you can measure and maximize the impact of Copilot for your organization!

Agenda: February 28, 2024

• 7:00 a.m. PT
  Introduction to Copilot for Microsoft 365
• 7:30 a.m. PT
  Prepare your organization for Copilot for Microsoft 365
• 8:00 a.m. PT
  Deploy Copilot for Microsoft 365: setup, admin controls, and more
• 8:30 a.m. PT
  How to drive Copilot for Microsoft 365 usage and satisfaction
• 9:00 a.m. PT
  Tips and tricks for IT pros deploying Copilot for Microsoft 365
• 9:30 a.m. PT
  Get your small business ready for Copilot for Microsoft 365
• 10:00 a.m. PT
  Copilot for Microsoft 365 AMA: Tech Accelerator edition (Day 1)

Agenda: February 29, 2024

• 7:00 a.m. PT
  How Copilot for Microsoft 365 works: A deep dive
• 7:30 a.m. PT
  Building user skills in the world of AI: Prompting fundamentals
• 8:00 a.m. PT
  Measuring usage, adoption, and the impact of Microsoft Copilot
• 8:30 a.m. PT
  Extending Copilot: Building with Copilot Studio
• 9:00 a.m. PT
  Extending Copilot: Expanding knowledge with Graph connectors
• 9:30 a.m. PT
  Copilot for Microsoft 365 AMA: Tech Accelerator edition (Day 2)

Register for the event at:

• Copilot for Microsoft 365 Tech Accelerator | February 28-29, 2024
  https://techcommunity.microsoft.com/t5/tech-community-live/copilot-for-microsoft-365-tech-accelerator/ec-p/4028578

[UPDATE December 21, 2024]
Copilot – We just published a blog article that lists the differences between Microsoft 365 Copilot Commercial & GCC. Here’s a general overview:

• Microsoft 365 Copilot GCC is built on the secure foundation of Microsoft 365 Government GCC
  • Microsoft 365 Copilot GCC operates within your Microsoft 365 GCC tenant compliance boundary
  • Microsoft 365 Copilot GCC is in compliance with FedRAMP, CJIS, IRS 1075 and other key regulatory frameworks
• Microsoft 365 Copilot GCC will be delivered with web grounding OFF by default
• Microsoft 365 Copilot GCC functionality is delivered in 2 phases & not all at once (see article for details)

[UPDATE October 25, 2024]
Purview – It looks like we published a document that lists many if not all of the differences between Commercial & GCC cloud instances of Microsoft 365 for Microsoft Purview Compliance.

[ORIGINAL February 16, 2024]
I’m frequently asked for the differences between Microsoft 365 Government Community Cloud & Microsoft 365 Commercial.

The differences are documented generally on the service description for each service or product.  Here’s a list of those services descriptions for GCC:

DIFFERENCES BETWEEN GCC/COMMERCIAL MICROSOFT 365

1. Microsoft 365
   1. Microsoft 365 Apps – Office application and feature availability in Government plans
   2. Forms – Microsoft Forms features for U.S. Government Community Cloud (GCC) (aka Features missing from Microsoft Forms)
   3. Microsoft Teams – Microsoft Teams service description – Service Descriptions
   4. OneDrive for Business – OneDrive for US government environments – Service Description
   5. SharePoint Online – SharePoint service description – Service Descriptions | Microsoft Learn
   6. Exchange Online – Exchange Online for US government environments – Service Descriptions
   7. Bookings – Microsoft Bookings service description – Service Descriptions
   8. Planner – Microsoft Planner service description – Service Descriptions | Microsoft Learn
   9. Project
      1. 1. Project for the Web – Microsoft Project for the web service description – Service Descriptions | Microsoft Learn
         2. Project Online Desktop – Microsoft Project Online desktop client service description – Service Descriptions | Microsoft Learn
         3. Project Online Service – Microsoft Project Online service description – Service Descriptions | Microsoft Learn
   10. SharePoint Syntex – SharePoint Syntex service description – Service Descriptions | Microsoft Learn
   11. Stream – Microsoft Stream service description – Service Descriptions | Microsoft Learn
   12. Purview – Plan for Microsoft Purview Compliance and Risk Management Solutions – GCC Deployments
2. Windows 365
   1. 1. Windows 365 service description – Service Descriptions | Microsoft Learn
      2. Windows 365 Government – how to buy – Service Descriptions | Microsoft Learn
3. Power Platform
   1. 1. Power BI – Power BI for US government customers
      2. Power Apps – Power Apps US Government
      3. Power Automate – Power Automate US Government
4. Dynamics 365
   1. 1. Dynamics 365 – Dynamics 365 US Government
      2. Dynamics 365 Customer Voice (Forms Pro) – Get started | Microsoft Learn
5. Azure Information Protection, Defender for Cloud, Microsoft Sentinel, Defender for IoT, Azure Attestation – Cloud feature availability for commercial and US Government customers

Office 365 GCC Additional Details

1. GCC Compliance – https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc#us-government-community-compliance
2. Viva Engage – https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc#office-365-government-gcc-and-viva-engage
3. Customer Support – https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc#office-365-government-gcc-customer-support

(You can download a full government plan comparison table for Office 365 GCC here.)

Here’s a summary of what exactly Office 365 Government Community Cloud (GCC) is:

• ONLY ELIGIBLE CUSTOMERS: GCC cloud instances require passing a qualification process & are only available to eligible customers which include United States Federal, State, Local, and Tribal governments, as well as contractors holding or processing data on behalf of the US Government.

• FEDRAMP: Designed to support Federal Risk & Authorization Management Program (FedRAMP) “High” accreditation

• Some US organizations are required to comply with FedRAMP for government community compliance)

• SCREENED PERSONNEL: Anyone needing temporary permissions elevation to access must pass a dizzying array of background checks as illustrated in the table to the right.
• NO VIVA ENGAGE: By default, Viva Engage is not available to GCC customer.  They can obtain Viva Engage (with a contract addendum) but must understand & “sign off” that Viva Engage is not operated in the GCC enclave & is not FedRAMP compliant.
• SUPPORT: Office 365 support personnel are not included in the service accreditation boundary for FedRAMP, IRS 1075 or CJIS data handling compliance assurances.

KEY REFERENCES FOR OFFICE 365 GCC:

• Office 365 GCC – Service Descriptions
• Download a full government plan comparison table for Office 365 GCC here

Discover the latest updates and best practices for a seamless transition to the new Microsoft Teams.

Join us for an informative webinar with Teams Engineering, designed to provide you with firsthand knowledge. Ensure a successful migration as we approach the upcoming deadlines:

• 3.31.2024 (for Desktop, Web)
• 6.30.2024 (for VDI)

Session Agenda:

• New Teams App Considerations for GCC  (Mac/Web/Windows/VDI)
• Migration Approaches
• Known Limitations
• Recent Service Updates
• Q&A – extended for an additional 30 minutes (attending during this extra time is optional)

On-demand:
(These are recordings from the earlier this month)

• Option #1
  When: February 07, 2024 9:00 AM-10:30 AM EST
  Duration: 90 minutes
  Registration URL:  New Teams in GCC Registration Page (eventbuilder.com)
• Option #2
  When: February 12, 2024 2:30 PM-4:00 PM PST
  Duration: 90 minutes
  Registration URL: New Teams in GCC (West Coast friendly) Registration Page (eventbuilder.com)

Don’t miss this opportunity to stay informed and make the transition to the new Teams smooth. Reserve your spot now by viewing the on-demand webinar. We look forward to your participation and addressing any questions you have, ensuring a successful migration process.

• New Teams for US Government (GCC) Webinars
  https://techcommunity.microsoft.com/t5/public-sector-blog/new-teams-for-us-government-gcc-webinars/ba-p/4049612