Control your frontline managers permissions in Microsoft Shifts

by Contributed | Mar 7, 2024 | Technology

This article is contributed. See the original author and article here.

If your organization was  already using Shifts prior to our launch (and consequent use) of the deployment of Shifts through Teams Admin Center, this article is for you. 

Frontline managers have control, on a team-level, over the capabilities offered in Microsoft Shifts. However, until now, Admins couldn’t determine which capabilities could be modified in Microsoft Shifts by frontline managers.

With our latest Graph API release, now in Public Preview (beta version), Admins will be able to choose whether frontline managers can modify the following capabilities for their teams in Shifts:

• Open shifts,


• Swap shifts,


• Offer shifts,


• Time-off requests,


• Time-off reasons,


• Time clock,


• Time clock geolocation, and


• Management of schedule groups.

In the example below, the frontline managers at Contoso East don’t have permissions to modify the value of the following settings:

• Open shifts,


• Swap shift requests,


• Offer shift requests,


• Time-off requests,


• Time-off reasons, and


• Time clock.

Scenario

At Contoso Ltd, Microsoft Shifts is being used across their stores. As part of an on-going project to manage time-off reasons in Shifts centrally and in a way that complies with Contoso’s HR policies, the IT department is:

1. Updating time-off reasons and provide associated codes on every frontline team using Shifts to ensure an identical match with their HR system; and,


2. Seeking a way to prevent any type of frontline manager (i.e., managers with either team or schedule owner roles) from changing their team’s time-off reasons.

What is new?

Contoso’s Admin can now remove frontline manager’s capability of adding, editing and deleting time-off reasons across the entire frontline teams using the newly released ShiftsRoleDefinition Graph API.

An Admin requires to:

1. Get the team IDs for the Microsoft Teams using Shifts; and,


2. Remove the CanModifyTimeOffReasons parameter from the allowedResourceActions list for both team and schedule owner roles on every team using Shifts.  

Once this is completed, your frontline managers in Shifts settings page will go from seeing this:

To the following:

More helpful resources

Manage frontline managers permissions in Shifts:

• Manage Shifts permissions for frontline managers – Microsoft 365 for frontline workers | Microsoft Learn


• shiftsRoleDefinition resource type – Microsoft Graph beta | Microsoft Learn

Understand the different roles available in Shifts:

• Use roles to define your frontline managers and workers in Shifts – Microsoft 365 for frontline workers | Microsoft Learn

Windows 365 Customer Lockbox generally available

by Contributed | Mar 6, 2024 | Technology

This article is contributed. See the original author and article here.

Windows 365 Customer Lockbox is now generally available for all organizations with a Microsoft 365 E5 or Office 365 E5 subscription. This security feature ensures that Microsoft cannot access content in your Cloud PCs to do service operations without your explicit approval.

What is Customer Lockbox?

In some cases, Microsoft support engineers may need to access your content to determine the root cause of an issue and address it. Windows 365 Customer Lockbox requires the engineer to request access from you as a final step in the approval workflow.

With Customer Lockbox, you have the option to approve or deny the request for your organization, and provide direct-access control to your content.

Customer Lockbox is included in the Microsoft 365 or Office 365 E5 subscriptions and can be added to other plans that have an Information Protection and Compliance or an Advanced Compliance add-on subscription. See Plans and pricing for more information.

How to use Windows 365 Customer Lockbox

Turn Customer Lockbox requests on or off

You can turn on Customer Lockbox controls in the Microsoft 365 admin center. When you turn on Customer Lockbox, Microsoft must obtain your organization’s approval before accessing any of your tenants’ content.

1. Using a work or school account that has the global administrator role, go to https://admin.microsoft.com/ and sign in.


2. Choose Settings > Org Settings > Security & Privacy


3. In Security & Privacy, select Customer Lockbox.
   
   
   

    

   
   Once you select Customer Lockbox, a right-hand column will appear. Check the “Require approval for all data access request” checkbox and press the Save button on the bottom of the column to turn on the feature.
   
   

Approve or deny a Customer Lockbox request

1. Using a work or school account that has either the Global Administrator or the Customer Lockbox access role assigned, go to https://admin.microsoft.com/ and sign in.


2. Choose Support > Customer Lockbox Requests
   
   
   
   


3. A list of Customer Lockbox requests is displayed.
   
   
   
   


4. Select the Customer Lockbox request, then choose Approve or Deny.
   
   


5. A green confirmation message about the approval of the Customer Lockbox request will be displayed.
   
   
   
   

Auditing access

Once just-in-time (JIT) access expires, the troubleshooting ticket is marked as complete. You can then visit compliance.microsoft.com and select Audit under the Solutions category to see what was done during the session. For Windows 365 specific records, under Record types, select Windows365CustomerLockbox.  

Retention policies can be updated based on your organization’s needs. For more information, explore Manage audit log retention policies and Audit log activities for Microsoft 365 services,

Learn more about Customer Lockbox and Windows 365 security

For more information about Customer Lockbox as a feature in general, see the documentation on Microsoft Purview Customer Lockbox. We also invite you to learn more about Customer Lockbox requests and security concepts in Windows 365.

To learn about submitting support tickets in the Microsoft Intune admin center, please see Get support in the Microsoft Intune admin center.

Continue the conversation. Find best practices. Bookmark the Windows 365 Tech Community, then follow us @MSWindowsITPro on X/Twitter and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.