"Civic-Secure" Microsoft 365

Principal workflows

• Deploy: Moraph sets up your Microsoft 365 GCC tenant with a CJIS-oriented baseline, connects your directory and moves mail and files across.
• Protect: The configured tenant applies the agency's rules every time someone signs in, opens a file or shares information. Microsoft 365 enforces them; Moraph keeps them set correctly.
• Operate: Moraph watches the tenant day to day, triages security alerts with your staff, handles your change requests and checks the configuration against the agreed baseline.
• Evidence: When your state CJIS Systems Agency audits, the agency has a current record of how each requirement is met in the tenant, with logs and access reviews to back it.

Who uses it

• Police and sheriff's departments moving to cloud email and collaboration
• Courts, prosecutors and probation offices that receive criminal justice information
• City and county IT departments that support public safety agencies
• Local Agency Security Officers responsible for CJIS compliance
• Agency records and legal staff who manage retention and public records requests

Reporting

• Security alerts and how each was resolved
• Device compliance and multi-factor coverage
• CJIS requirement mapping for audits
• Configuration drift against the baseline
• Access reviews for administrators and guests
• Changes requested, approved and applied

Features

• CJIS configuration baseline: A documented set of Microsoft 365 GCC settings chosen to support the CJIS Security Policy, applied at deployment and maintained by Moraph.
• Multi-factor sign-in: Microsoft Entra ID requires multi-factor authentication for every user, with methods chosen to meet the CJIS Security Policy's authentication requirements.
• Conditional access: Entra ID Conditional Access allows access only from managed, compliant devices and locations the agency approves.
• Device compliance: Microsoft Intune checks that laptops, phones and in-car computers meet the agency's device rules before they reach agency data.
• Sensitivity labels: Microsoft Purview labels identify documents and email containing criminal justice information and apply protection that travels with them.
• Data loss prevention: Purview data loss prevention policies detect labeled or sensitive content being shared outside allowed recipients and warn or block.
• Retention and legal hold: Retention policies set to the agency's records schedule, with holds and eDiscovery for litigation and public records requests.
• Audit logging: Microsoft 365 audit logging enabled and retained, so access to criminal justice information can be reviewed.
• Controlled external sharing: Teams and SharePoint sharing limited to approved partner agencies and guests, reviewed periodically.
• Least-privilege administration: Administrator roles split by task and kept to the people who need them, with Moraph's own access approved by the agency.
• Configuration drift checks: Moraph compares the live tenant with the baseline and reviews Microsoft service changes that could affect it.
• Audit evidence package: A requirement-by-requirement record of how the tenant is configured, with logs and access review results, ready for your CJIS auditor.

Integrations

• On-premises Active Directory: Users and groups synchronized to Microsoft Entra ID, or moved to cloud-only identities where the agency prefers.
• Existing email system: Mailboxes migrated from on-premises Exchange or another email system in planned waves.
• File shares: Departmental file shares migrated to SharePoint and Teams, with permissions reviewed as they move.
• Mobile and in-car devices: Laptops, phones and mobile data computers enrolled in Microsoft Intune for compliance checks.
• Partner agencies: Approved partner agencies and courts set up for controlled sharing in Teams and SharePoint.
• Agency security monitoring: Microsoft 365 audit and alert data forwarded to the agency's or county's security monitoring tool where one exists.
• Records management: Retention labels aligned with the agency's records schedule, with exports for public records responses.

Deployment

• Microsoft 365 GCC: Tenant in Microsoft's Government Community Cloud, which keeps customer data in the United States.
• Hybrid identity: Users synchronized from on-premises Active Directory while the agency keeps its existing directory.
• Existing GCC tenant: Where the agency already has a GCC tenant, Moraph assesses it against the baseline and takes over management after agreed remediation.

Security and privacy

• Multi-factor sign-in: Every user signs in through Microsoft Entra ID with multi-factor authentication, under conditional access rules the agency approves.
• Role-based administration: Administrator rights are split by task and limited to named people, and Moraph's access is approved by the agency.
• Encryption and keys: Data is encrypted by Microsoft 365, and Moraph staff cannot access agency content without explicit, time-bound authorization from the agency.
• Complete audit trail: Microsoft 365 audit logging is enabled and retained, and every Moraph administrative action is logged.
• US-only hosting: Microsoft 365 GCC keeps customer data in the United States, and Moraph's operations for US government clients stay in the United States.
• Screened personnel: Moraph staff with administrative access complete the screening and training your CJIS Systems Agency requires before access is granted.

Limitations

• Moraph is not Microsoft. Microsoft's own service commitments, roadmap, service changes and outages apply to Microsoft 365.
• Licences are subject to Microsoft's terms, and GCC eligibility is decided by Microsoft.
• Configuring Microsoft 365 does not make an agency CJIS compliant on its own. Compliance depends on the agency's policies, personnel, physical security and audits by its state CJIS Systems Agency.
• Moraph does not hold a CJIS certification, because none exists; audits are between the agency and its state CJIS Systems Agency.
• Moraph does not decide whether to release criminal justice information or respond to public records requests. Those decisions stay with the agency.
• Devices must be enrolled and kept compliant by the agency; unmanaged devices are blocked rather than secured.
• This service covers Microsoft 365. Records management systems, computer-aided dispatch and evidence systems are separate.
• Higher Microsoft government clouds such as GCC High are not covered by this offering.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/civic-secure-microsoft-365. Purchasing routes and company information: www.moraph.com/how-to-buy.