CSE: QSE
Quantum Secure Encryption Corp.
Book an assessment

QAuth · Microsoft 365 (formerly Office 365)

QAuth for Microsoft 365

Your share of Microsoft 365 security, from one console.

Microsoft secures the platform. What your people do with the data is your responsibility. QAuth adds access control, DLP for OneDrive, SharePoint and Outlook, single sign-on and Shadow IT visibility, with admin alerts, automatic blocking and coaching messages for users.

Talk to the QAuth team See the controls

Shared responsibility

Where Microsoft’s job ends, QAuth picks up.

Microsoft secures

The platform.

  • Data centres, networks and the Microsoft 365 services themselves

You control, with QAuth

How your people use it.

  • Who signs in, from which network, device and browser, and when
  • What gets uploaded, downloaded, shared or emailed outside the company
  • Which unsanctioned cloud apps hold company data

Access control

Conditional access for the whole suite.

Conditional policies decide which devices, networks and browsers can reach Microsoft 365, and when. When a policy is broken, QAuth can alert an admin, stop the action, change access permissions or show the user a coaching message.

Every control explained

Browser restriction

Define the browsers Microsoft 365 can be used in.

IP restriction

Block sign-in from any IP address your policies don’t list.

Login time restriction

Set the days and hours people can sign in.

Device restriction

Block devices your policies don’t list.

Geo-fencing

Draw a virtual boundary and raise an alert when access comes from outside it.

OneDrive DLP

Keep confidential files inside the company.

Out-of-the-box compliance checks cover PII, PCI and more. Choose an agent for inline control, the agentless mode through the OneDrive API, or both, with policies for each group of users. Set-up takes hours.

Agent-based

Inline control on company devices.

  • DLTrack or block uploads and downloads, so files don’t land on unapproved devices.
  • DELTrack or block deleting documents.
  • EXTTrack or block sharing with blacklisted domains, such as personal or competitor domains.
  • MAILBlock personal webmail on the company network and devices, while company email keeps working.

Agentless

Nothing to install, action in near real time.

  • ORGSpot sharing outside the organisation, for example with a competitor.
  • PERSpot sharing with personal addresses such as outlook.com.
  • KEYSpot documents that contain your keywords or regular expressions.
  • REVThen revoke every permission except the owner’s.
  • MGRNotify the user’s reporting manager.
  • ADMNotify the super admin.

SharePoint DLP

Govern sharing on SharePoint sites.

SharePoint control uses the QAuth agent. It acts as a web proxy for the applications you monitor only, and stores nothing it inspects.

  • Stop documents being shared across departments, such as Finance to Operations
  • Track or block sharing with blacklisted domains
  • Track or block deleting documents
  • Policies for each group of users, based on business and compliance requirements

Outlook email DLP

An outbound gateway for company mail.

QAuth becomes the gateway for outgoing mail from the users you choose. It is configured on your Microsoft 365 domain within hours, with different policies for different groups.

Detects mail…

  • To personal domains such as outlook.com or aol.com
  • To domains your people shouldn’t be writing to
  • Containing keywords, using PII and PHI policies or your own regular expressions
  • Carrying attachment types you’ve marked restricted

Then…

  • Rejects it and tells the sender
  • Tracks the conversation
  • Notifies the sender’s reporting manager
  • Notifies the super admin

Single sign-on and identity

One identity, governed from your directory.

Single sign-on uses SAML to give people one secure way into every application in the suite, and into on-premises apps from mobile devices. Provisioning and de-provisioning are built in, so leavers lose access at once.

Passwords
Password policies you define, and self-service password management
Authentication
Multi-factor and biometric authentication
Identity provider
On-premises Active Directory, or Azure AD (now Microsoft Entra ID)
Complex directories
Multiple forests, with each location’s users bound to their own domain controller. People outside AD, such as vendors, can use QAuth as their identity provider
Password sync
A password changed in Active Directory is synchronised to Microsoft 365

Shadow IT

See the cloud apps around Microsoft 365.

Blocking every unsanctioned app is rarely practical. QAuth shows what is in use so you can balance what people need with what the company must protect.

  • Sanctioned and unsanctioned cloud apps in use across the company
  • The devices that are reaching company data
  • Control over threats such as data leaving through apps IT hasn’t approved

Looking for Microsoft 365 references? The published QAuth case studies are all Google Workspace deployments. Ask the QAuth team about Microsoft 365 customers in your industry.

Get started

Add QAuth to your Microsoft 365 tenant.

The QAuth team will help you with:

  • Choosing agent-based, agentless or both for OneDrive
  • Mapping access and DLP policies to your groups
  • Connecting Active Directory or Entra ID
Talk to the QAuth team