State & local government · Managed platform (Microsoft 365 GCC)

"Civic-Secure" Microsoft 365

Microsoft 365 in the Government Community Cloud, configured for CJIS and run by Moraph

Book a demonstration Request a technical briefing Factsheet

Overview

What you are buying

Moraph resells, deploys and manages Microsoft 365 in Microsoft's Government Community Cloud (GCC) for police departments, courts and other local agencies that handle criminal justice information. We configure identity, devices, labeling, data loss prevention, retention and logging to support the FBI CJIS Security Policy, document how each requirement is met, and keep the configuration in line as Microsoft changes the service. Your agency and your state's CJIS Systems Agency keep the policy decisions and the audit relationship.

The problem it solves

Local agencies want the same email, file sharing and chat tools everyone else uses, but criminal justice information comes with the FBI CJIS Security Policy attached. Microsoft 365 has the settings needed to support it, yet getting them right means working through multi-factor authentication, device controls, encryption, logging, retention and personnel requirements, then proving it all to the state CJIS auditor. Small IT teams rarely have the time to configure it, keep it configured as the service changes, and answer audit questions with evidence.

Officers and court staff share case material through personal email, unmanaged devices or consumer file sharing
Cloud settings that matter for CJIS are spread across many admin centers and change as Microsoft updates the service
Audit preparation means assembling screenshots and policy documents by hand
Small IT teams cannot watch sign-in risk, data loss alerts and access reviews every day

Who uses it

Police and sheriff's departments moving to cloud email and collaboration
Courts, prosecutors and probation offices that receive criminal justice information
City and county IT departments that support public safety agencies
Local Agency Security Officers responsible for CJIS compliance
Agency records and legal staff who manage retention and public records requests

Requirements it supports

FBI CJIS Security PolicyCJIS Security Addendum28 CFR Part 20 (Criminal Justice Information Systems)State public records and records retention laws, as they apply to your agencyADA Title II web and mobile accessibility rule (28 CFR Part 35, Subpart H)

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Microsoft provides Microsoft 365 GCC, Moraph configures and runs it for you, and your agency owns CJIS compliance and every decision about criminal justice information.

Area	Moraph	Microsoft	Your organization
Licensing	Resells Microsoft 365 GCC licences and helps confirm eligibility	Sets licence terms and GCC eligibility rules	Chooses licence types and user counts
Platform availability	Monitors service health and raises cases with Microsoft	Hosts and operates Microsoft 365 under its own service commitments	Communicates outages to staff
CJIS agreements	Supports the agency in confirming the CJIS Security Addendum position with its state	Provides its CJIS commitments where it has agreed them with the state	Works with the state CJIS Systems Agency on agreements and audits
Configuration	Builds and maintains the CJIS configuration baseline	Provides the configuration settings and features	Approves the baseline and any exceptions
Identity and access	Configures sign-in, conditional access and admin roles	Operates Microsoft Entra ID	Approves who has access and certifies access reviews
Monitoring	Watches security alerts, sign-in risk and configuration drift	Monitors its own infrastructure and services	Responds to alerts that need an agency decision
Incident response	Triages alerts, contains threats in the tenant as agreed, and coordinates with Microsoft	Responds to incidents in its service and notifies customers	Leads the agency's response and any reporting to the state
Changes	Applies approved changes and reviews Microsoft service changes for impact	Changes the service on its own schedule	Requests and approves configuration changes
Personnel screening	Ensures its staff with access complete required screening	Screens its own personnel under its commitments	Confirms screening with the CJIS Systems Agency
User support	Supports agency IT on platform questions	Supports Moraph through its support channels	Provides first-line support to agency staff

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of GCC itself, which belongs to its vendor.

Step 1

The onboarding tracker

Agency staff and Moraph follow one tracker through deployment, with owners and status for each workstream.

Workstream	Owner	Agency contact	Status
GCC eligibility and licences	Moraph	IT director	Complete
Directory synchronization	Moraph	Agency IT	Complete
CJIS baseline review	Moraph	LASO	In review
Device enrollment	Agency IT	Fleet coordinator	42 devices outstanding
Mailbox migration wave 1	Moraph	Records division	Scheduled

Step 2
A baseline setting under review
Each baseline policy is recorded with what it does and the requirement it supports, and reviewed with the LASO.
"Civic-Secure" Microsoft 365 · Configuration baselineSample data
Conditional access · Require compliant device
Applies to
All users with CJI access
Enforced by
Microsoft Entra ID
Requirement area
Access control; mobile devices
Exceptions
None approved
Last reviewed
Example review date
Review notes
- Policy matches baseline version 2.1 (fictional)
- No users excluded
- !Report-only test for new device type pending
Approve baselineRaise change request
Each baseline policy is recorded with what it does and the requirement it supports, and reviewed with the LASO.
Step 3
A change request
Changes to CJIS-relevant settings are approved by the LASO before Moraph applies them.
"Civic-Secure" Microsoft 365 · Change CHG-2207Sample data
CHG-2207 · Allow sharing with Example County Court
1. Change requestedAgency IT
2. Impact on baseline assessedMoraph engineer
3. Change approvedLASO
4. Guest access configured for approved court groupMoraph engineer
5. Test share confirmedAgency IT
6. Change log and mapping updatedMoraph engineer
Changes to CJIS-relevant settings are approved by the LASO before Moraph applies them.

Step 4

Alert triage

Moraph's operations team triages alerts and brings any decision about a user or information to the agency.

Alert	User	Raised	Handled by	Status
Risky sign-in from unfamiliar location	User 1182	02:14	Moraph	Session revoked, awaiting agency
DLP match: labeled file to external address	User 2045	09:40	Moraph, then LASO	Blocked, confirmed by LASO
Device fell out of compliance	Device MDC-07	10:05	Agency IT	Resolved
Admin role assigned outside change	User 0931	11:30	Moraph	Reverted, raised to LASO

Step 5
The monthly service review
Each month Moraph and the agency review alerts, changes, drift and upcoming Microsoft changes.
"Civic-Secure" Microsoft 365 · Service reviewSample data
Monthly service review · Example City Police Department (fictional)
Alerts triaged
37
Escalated to agency
4
Changes applied
6
Drift items found
2, both corrected
Microsoft changes reviewed
9
Open items
- !Two Microsoft changes affect the baseline and need a decision
- Access review due next month
- Mailbox migration wave 3 to schedule
Approve minutesExport PDF
Each month Moraph and the agency review alerts, changes, drift and upcoming Microsoft changes.

Step 6

Access review

The LASO certifies administrators, guests and users with access to labeled content on the agency's schedule.

Account	Access	Type	Last sign-in	Decision
User 0931	Exchange administrator	Internal	Today	Keep
Guest 0417	Court case sharing site	Partner agency	67 days ago	Remove
User 1520	Labeled CJI content	Internal	2 days ago	Keep
Moraph engineer 03	Security administrator	Moraph	Yesterday	Keep, screening on file

Workflows

The principal workflows

Deploy
Moraph sets up your Microsoft 365 GCC tenant with a CJIS-oriented baseline, connects your directory and moves mail and files across.
- Confirm GCC eligibility with Microsoft and arrange licences
- Connect your on-premises directory or set up cloud identities
- Apply the baseline for sign-in, devices, labeling, logging and retention
- Migrate mailboxes and file shares in planned waves
- Train staff on handling criminal justice information in the new tools
Protect
The configured tenant applies the agency's rules every time someone signs in, opens a file or shares information. Microsoft 365 enforces them; Moraph keeps them set correctly.
- Microsoft Entra ID requires multi-factor authentication and checks device compliance at sign-in
- Sensitivity labels mark documents and email that contain criminal justice information
- Data loss prevention policies warn or block when labeled content is shared outside allowed recipients
- External sharing and guest access are limited to the partners the agency approves
Operate
Moraph watches the tenant day to day, triages security alerts with your staff, handles your change requests and checks the configuration against the agreed baseline.
- Risky sign-in and data loss alerts arrive in Moraph's operations queue
- Moraph triages and contacts the agency for any decision about a user or a release of information
- Configuration is compared with the baseline and drift is corrected or raised
- Microsoft service changes are reviewed for their effect on the baseline
- Agency change requests are approved by the agency before they are applied
Evidence
When your state CJIS Systems Agency audits, the agency has a current record of how each requirement is met in the tenant, with logs and access reviews to back it.
- Requirement-by-requirement mapping kept current as settings change
- Periodic access reviews certified by the Local Agency Security Officer
- Audit logs retained for the period agency policy sets
- Evidence package prepared for the audit on request
- Findings tracked to closure with the agency

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Agency user

Patrol officer, detective, court clerk, dispatcher, probation officer

Uses email, Teams, SharePoint and OneDrive for daily work, including handling criminal justice information under the agency's rules.

Sees

Their own mailbox, files and the Teams and sites they belong to
Labels and policy tips that tell them when content is restricted
Content shared with them by colleagues and approved partners

Does

Signs in with multi-factor authentication from a compliant device
Labels documents and email that contain criminal justice information
Shares content with colleagues and approved partner agencies
Reports suspicious email and lost devices

Cannot

Share labeled content with recipients the policy does not allow
Sign in from unmanaged devices where conditional access blocks it
Remove a label applied by policy without justification

Approvals: Overriding a data loss prevention warning, where the policy allows it, requires a business justification that is logged.
Notified about: Policy tips when content is restricted, sign-in prompts, and messages from the agency about security.

Local Agency Security Officer

LASO, CJIS coordinator, terminal agency coordinator

Is responsible for the agency's CJIS compliance and is the agency's contact with the state CJIS Systems Agency.

Sees

The configuration baseline and how each requirement is met
Security alerts and how they were handled
Access reviews, administrator lists and audit logs
Monthly service review reports

Does

Approves changes that affect CJIS-relevant settings
Certifies access reviews
Decides on alerts involving a possible release of criminal justice information
Coordinates audits with the state CJIS Systems Agency
Confirms personnel screening is complete before access is granted

Cannot

Edit or delete audit logs
Apply configuration changes directly unless also given an admin role
Waive requirements set by the CJIS Security Policy

Approvals: Approves CJIS-relevant configuration changes, privileged access and closure of security findings.
Notified about: Security alerts needing an agency decision, changes awaiting approval, access reviews due and audit dates.

Agency IT administrator

City or county IT staff, agency systems administrator

Supports users and devices day to day within the limits the baseline sets.

Sees

Users, groups and licences
Device inventory and compliance status
Service health and support tickets with Moraph

Does

Creates and disables user accounts
Enrolls and retires devices in Intune
Resets authentication methods after identity is confirmed
Raises change requests and support tickets with Moraph

Cannot

Change conditional access, labeling or data loss prevention policies without approval
Grant global administrator rights
Turn off audit logging

Approvals: Changes to security policies go through the change process and LASO approval.
Notified about: Non-compliant devices, accounts not used for the period policy sets, and updates on their tickets.

Records and legal staff

Records manager, public records officer, city attorney's office staff

Manages retention, legal holds and searches for litigation and public records requests.

Sees

Retention policies and labels
eDiscovery cases and holds they are assigned
Search results within the scope of each case

Does

Requests retention policy changes in line with the records schedule
Places and releases legal holds
Runs searches and exports results for review
Records the basis for each search

Cannot

Change security policies
Search outside the cases they are assigned
Delete content under hold

Approvals: eDiscovery case access is approved by the agency's designated legal or records lead.
Notified about: Holds placed or released, and searches completed.

Moraph M365 engineer

Moraph Microsoft 365 administrator, security operations analyst, service manager

Configures and monitors the tenant for the agency, keeps it aligned with the baseline and supports the agency's audit.

Sees

Tenant configuration, service health and security alerts
Configuration drift and Microsoft service change notices
Audit logs needed to investigate an alert, as the agency authorizes

Does

Applies approved configuration changes
Triages security alerts and escalates decisions to the agency
Corrects configuration drift or raises it for approval
Raises support cases with Microsoft
Prepares the monthly service review and audit evidence

Cannot

Access mailbox or file content without explicit, time-bound agency authorization
Apply changes to CJIS-relevant settings without LASO approval
Release or disclose criminal justice information

Approvals: Changes are approved by the agency; Moraph's administrative access is approved by the LASO after personnel screening is confirmed.
Notified about: Security alerts, drift detected, Microsoft service changes and approved changes ready to apply.

Auditor (read-only)

State CJIS Systems Agency auditor, internal auditor, city auditor

Reviews how the tenant meets requirements, without changing anything.

Sees

The configuration baseline and requirement mapping
Audit log extracts and access review results
Security findings and how they were closed

Does

Reviews evidence provided for the audit
Requests additional evidence through the LASO
Records findings for the agency

Cannot

Change any configuration or access
See mailbox or file content unless the agency grants it for a specific review
Keep access after the audit ends

Approvals: Any direct access is approved by the LASO with a scope and end date.
Notified about: Nothing by default; evidence is provided through the LASO.

Permissions at a glance

Action	User	LASO	Agency IT	Records/legal	Moraph eng.	Auditor
Use email, Teams and files	Own work only	Own work only	Own work only	Own work only	No access	No access
Apply sensitivity labels	Own work only	Own work only	Own work only	Own work only	No access	No access
Create and disable user accounts	No access	View only	Full	No access	Full	No access
Enroll and retire devices	No access	View only	Full	No access	Full	No access
Change conditional access and DLP policies	No access	Approves	No access	No access	Full	No access
Change retention policies	No access	Approves	No access	Own work only	Full	No access
Place legal holds and run eDiscovery	No access	No access	No access	Full	No access	No access
Triage security alerts	No access	Approves	View only	No access	Full	No access
Grant administrator roles	No access	Approves	No access	No access	Full	No access
View audit logs	No access	View only	View only	View only	View only	View only
Certify access reviews	No access	Approves	View only	No access	View only	View only

Full
Own work only
Approves
View only
No access

How access is controlled

Security-relevant changes are proposed by Moraph or agency IT and approved by the Local Agency Security Officer before they are applied, and the record of each approval is kept.
Moraph engineers manage configuration, not content. They do not open mailboxes or files without explicit, time-bound authorization from the agency, and they never release criminal justice information.
Moraph staff who need administrative access complete the personnel screening and security awareness training that your CJIS Systems Agency requires before access is granted.
Roles are mapped to groups in Microsoft Entra ID and reviewed periodically. Auditors receive evidence through the LASO, or temporary read-only access with a scope and end date.

Features

What it does

CJIS configuration baseline

A documented set of Microsoft 365 GCC settings chosen to support the CJIS Security Policy, applied at deployment and maintained by Moraph.

Multi-factor sign-in

Microsoft Entra ID requires multi-factor authentication for every user, with methods chosen to meet the CJIS Security Policy's authentication requirements.

Conditional access

Entra ID Conditional Access allows access only from managed, compliant devices and locations the agency approves.

Device compliance

Microsoft Intune checks that laptops, phones and in-car computers meet the agency's device rules before they reach agency data.

Sensitivity labels

Microsoft Purview labels identify documents and email containing criminal justice information and apply protection that travels with them.

Data loss prevention

Purview data loss prevention policies detect labeled or sensitive content being shared outside allowed recipients and warn or block.

Retention and legal hold

Retention policies set to the agency's records schedule, with holds and eDiscovery for litigation and public records requests.

Audit logging

Microsoft 365 audit logging enabled and retained, so access to criminal justice information can be reviewed.

Controlled external sharing

Teams and SharePoint sharing limited to approved partner agencies and guests, reviewed periodically.

Least-privilege administration

Administrator roles split by task and kept to the people who need them, with Moraph's own access approved by the agency.

Configuration drift checks

Moraph compares the live tenant with the baseline and reviews Microsoft service changes that could affect it.

Audit evidence package

A requirement-by-requirement record of how the tenant is configured, with logs and access review results, ready for your CJIS auditor.

Integrations

How it connects to your systems

Connects to	How	What flows
On-premises Active Directory	Users and groups synchronized to Microsoft Entra ID, or moved to cloud-only identities where the agency prefers.	In: users, groups and attributes.
Existing email system	Mailboxes migrated from on-premises Exchange or another email system in planned waves.	In: mailboxes, calendars and contacts, once per wave.
File shares	Departmental file shares migrated to SharePoint and Teams, with permissions reviewed as they move.	In: files and folder permissions, once per wave.
Mobile and in-car devices	Laptops, phones and mobile data computers enrolled in Microsoft Intune for compliance checks.	In: device enrollment and compliance status.
Partner agencies	Approved partner agencies and courts set up for controlled sharing in Teams and SharePoint.	Out: shared content to approved guests only.
Agency security monitoring	Microsoft 365 audit and alert data forwarded to the agency's or county's security monitoring tool where one exists.	Out: audit events and alerts.
Records management	Retention labels aligned with the agency's records schedule, with exports for public records responses.	Out: search results and exports for approved cases.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Multi-factor sign-in

Every user signs in through Microsoft Entra ID with multi-factor authentication, under conditional access rules the agency approves.

Role-based administration

Administrator rights are split by task and limited to named people, and Moraph's access is approved by the agency.

Encryption and keys

Data is encrypted by Microsoft 365, and Moraph staff cannot access agency content without explicit, time-bound authorization from the agency.

Complete audit trail

Microsoft 365 audit logging is enabled and retained, and every Moraph administrative action is logged.

US-only hosting

Microsoft 365 GCC keeps customer data in the United States, and Moraph's operations for US government clients stay in the United States.

Screened personnel

Moraph staff with administrative access complete the screening and training your CJIS Systems Agency requires before access is granted.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Security operations

Security alerts and outcomes

For lASO and agency IT

Risky sign-ins, data loss prevention matches and other alerts, with how each was handled and who decided.

Break down by: Alert type, User group, Outcome, Period
Delivered as: Live view; monthly summary
Used for: Seeing what was caught and confirming each alert was closed properly.

Device compliance

For agency IT and LASO

Enrolled devices, their compliance status and devices blocked from agency data.

Break down by: Device type, Department, Compliance state
Delivered as: Live dashboard; CSV export
Used for: Fixing non-compliant devices before they affect officers in the field.

Multi-factor coverage

For lASO

Users and their registered authentication methods, and any accounts excluded from policies with the reason.

Break down by: Department, Method, Exception reason
Delivered as: Monthly; CSV export
Used for: Confirming every user meets the authentication requirement.

Compliance and audit

CJIS requirement mapping

For lASO and CJIS auditors

Each CJIS Security Policy area, how the tenant supports it, the settings involved and the date last reviewed.

Break down by: Policy area, Responsible party, Last review
Delivered as: PDF and spreadsheet; on request
Used for: Preparing for the state CJIS audit.

Configuration drift

For lASO and Moraph engineers

Differences between the live tenant and the baseline, and how each was resolved.

Break down by: Area, Cause, Resolution
Delivered as: Monthly PDF
Used for: Showing the configuration stays as documented.

Access review

For lASO

Administrators, guests and users with access to labeled content, with last sign-in and the reviewer's decision.

Break down by: Role, Department, Guest or internal, Decision
Delivered as: Periodic; CSV and PDF export
Used for: Certifying access as the CJIS Security Policy expects.

Audit log extract

For lASO, auditors, investigators

Who accessed or changed what, and when, for a selected user, item or period.

Break down by: User, Workload, Action, Date range
Delivered as: On request; CSV export
Used for: Answering audit and investigation questions.

Managed service

Monthly service review

For agency IT leadership and LASO

Alerts handled, changes made, drift found, Microsoft service changes and open risks for the month.

Break down by: Month, Change type, Risk status
Delivered as: PDF; review meeting
Used for: Governing the managed service and agreeing priorities.

Change request log

For agency IT and LASO

Each change request with approval, date applied and any rollback.

Break down by: Status, Requester, Area
Delivered as: Live view; CSV export
Used for: Evidencing change control.

Records

Holds and searches

For records and legal staff

Active legal holds, eDiscovery cases and searches run, with who ran them.

Break down by: Case, Custodian count, Status, Period
Delivered as: Live view
Used for: Tracking public records and litigation work.

Exports, access and evidence

Reports draw on Microsoft 365's own reporting, audit and compliance data, assembled by Moraph for the agency.
Summary reports are delivered as PDF and detail as CSV, and the agency keeps its own copies.
Audit and alert data can be forwarded to the agency's or county's security monitoring tool for reporting alongside other systems.
The CJIS requirement mapping is reviewed when the baseline changes and before each scheduled audit.
Reports that include user activity are shared only with the people the agency names.

Deployment

Where and how it runs

Microsoft 365 GCC

Tenant in Microsoft's Government Community Cloud, which keeps customer data in the United States.

Hybrid identity

Users synchronized from on-premises Active Directory while the agency keeps its existing directory.

Existing GCC tenant

Where the agency already has a GCC tenant, Moraph assesses it against the baseline and takes over management after agreed remediation.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Assessment

We review your current email, files, devices and identity setup, and how criminal justice information flows through them. We need your LASO and IT lead involved.

Tenant and licensing

Moraph helps confirm GCC eligibility with Microsoft, arranges licences and sets up the tenant.

Baseline configuration

Identity, conditional access, devices, labels, data loss prevention, logging and retention are configured to the baseline and reviewed with your LASO.

Migration

Mailboxes and file shares move in planned waves, with permissions reviewed as content moves.

Training

Staff learn how to label and share criminal justice information, and agency IT learns its admin tasks.

Audit readiness and handover to operations

The CJIS requirement mapping is completed, and the tenant moves into Moraph's managed service.

Limitations

What it does not do

Worth knowing before you evaluate it.

Moraph is not Microsoft. Microsoft's own service commitments, roadmap, service changes and outages apply to Microsoft 365.
Licences are subject to Microsoft's terms, and GCC eligibility is decided by Microsoft.
Configuring Microsoft 365 does not make an agency CJIS compliant on its own. Compliance depends on the agency's policies, personnel, physical security and audits by its state CJIS Systems Agency.
Moraph does not hold a CJIS certification, because none exists; audits are between the agency and its state CJIS Systems Agency.
Moraph does not decide whether to release criminal justice information or respond to public records requests. Those decisions stay with the agency.
Devices must be enrolled and kept compliant by the agency; unmanaged devices are blocked rather than secured.
This service covers Microsoft 365. Records management systems, computer-aided dispatch and evidence systems are separate.
Higher Microsoft government clouds such as GCC High are not covered by this offering.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

Review the configuration baseline and requirement mapping with your LASO
Sign in from a managed device and an unmanaged one and confirm what each can reach
Try sharing a labeled document with an outside address and check the result and the log
Walk through a change request from agency request to LASO approval
Review a sample monthly service review and the responsibilities table
Ask your CJIS Systems Agency what evidence it will expect, and check it against the evidence package

Questions

Frequently asked questions

Does this make our agency CJIS compliant?

No product does on its own. The configuration supports the CJIS Security Policy, and Moraph documents how; compliance also depends on your policies, people and physical security, and is assessed by your state CJIS Systems Agency.

Has Microsoft signed the CJIS Security Addendum for our state?

Microsoft has agreements with many states. We help you confirm the position for your state with your CJIS Systems Agency during the assessment.

Can Moraph staff read our email?

Moraph engineers manage configuration and do not open mailboxes or files without explicit, time-bound authorization from the agency, which is logged.

Do we contract with Moraph or Microsoft?

With Moraph, which resells Microsoft 365 GCC licences and provides implementation and the managed service. Microsoft's licence terms apply.

How is it priced?

Microsoft licences are priced per user. Implementation is charged separately, and the managed service is a recurring fee scoped to your users and devices. See Working with Moraph for what drives a quotation.

We already have Microsoft 365. Can you take it over?

Yes. We assess the existing tenant against the baseline, agree remediation, and then take over management.

Next steps

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: "Civic-Secure" Microsoft 365 guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: "Civic-Secure" Microsoft 365 support guide.

"Civic-Secure" Microsoft 365

What you are buying

The problem it solves

Who uses it

Requirements it supports

Who is responsible for what

A short walkthrough

The onboarding tracker

A baseline setting under review

A change request

Alert triage

The monthly service review

Access review

The principal workflows

Deploy

Protect

Operate

Evidence

Who does what in the product

Agency user

Sees

Does

Cannot

Local Agency Security Officer

Sees

Does

Cannot

Agency IT administrator

Sees

Does

Cannot

Records and legal staff

Sees

Does

Cannot

Moraph M365 engineer

Sees

Does

Cannot

Auditor (read-only)

Sees

Does

Cannot

Permissions at a glance

How access is controlled

What it does

CJIS configuration baseline

Multi-factor sign-in

Conditional access

Device compliance

Sensitivity labels

Data loss prevention

Retention and legal hold

Audit logging

Controlled external sharing

Least-privilege administration

Configuration drift checks

Audit evidence package

How it connects to your systems

How your data is protected

Multi-factor sign-in

Role-based administration

Encryption and keys

Complete audit trail

US-only hosting

Screened personnel

What you can report on

Security operations

Security alerts and outcomes

Device compliance

Multi-factor coverage

Compliance and audit

CJIS requirement mapping

Configuration drift

Access review

Audit log extract

Managed service

Monthly service review

Change request log

Records