Working securely: Use of apps within Microsoft Teams
What’s the background?
MS Teams is part of Warwick's approved Microsoft Office 365 system. Since March, the use of Teams has grown rapidly as a key collaborative working space while many of us work remotely (there are now more than 9K Teams sites at Warwick).
Teams can be customised by the addition of applications (from an app store) that add different bits of functionality - like simple poll functions, video conference tools, note taking tools etc. These tools can be very useful, but we need to be aware of how they work.
What’s the problem?
- Some apps are developed by Microsoft, but some, by 3rd Party suppliers - the latter group may not fall under Microsoft's approved Terms & Conditions of use.
- When adding an app, a Team owner accepts terms and conditions for all users of the Teams site and in most cases, data sharing can include personally identifiable information like names and email addresses.
- MS Teams applications are similar to other cloud-delivered services; they are available free or at modest cost and will process Warwick personally identifiable data. Users could agree to Terms and Conditions they assume have already been vetted by the University.
- Currently there is no institutional review of the Terms & Conditions of individual applications.
What are we going to do?
- MS Teams offers a range of governance tools to restrict and control the installation of applications, so a paper outlining this issue was presented to the University Information Management Committee (UIMC) and the following decisions were made:
- Two lists of Teams apps will be compiled: those that don’t need to be assessed or removed because they fall under Microsoft’s Terms & Conditions; and those from 3rd Parties that are being used and do require retrospective assessment.
- Apps from third parties will remain if they were already available to staff, but they’ll be assessed retrospectively and if they cannot be approved, they will be switched off.
- Third party apps that are not in use will be turned off but, if requested, could be assessed for future use.