Request support

IRAP PROTECTED Configuration

Before you start

This guide sets out the tenancy settings we recommend for a DekkoCORE tenancy that holds PROTECTED information. Apply these settings before you invite your team, so that every account is created under the same controls.

This guide helps you configure your tenancy in a way that aligns with the ISM PROTECTED controls. It does not certify your tenancy or replace your own assessment. Check your obligations with your security team and your assessor. See Compliance and Certification for more information.

Settings are changed in the Tenancy Manager:

  • Policies covers sign-in, sharing, content and retention settings. Changes on this page take effect when you select Update policies.
  • Integrations covers Single Sign-On and logging.

To open these pages, open your profile menu, select Tenancy Manager, then select the page you need. For more about policies, see Tenancy Policies.

Area Setting Recommended value
Sign-in Enforce passkey On
Sign-in Enforce hardware attestation for passkeys On
Sign-in Enforce 2FA On, while passkeys are being rolled out
Sign-in Minimum password length 14 or more
Sign-in Session timeout 15 minutes
Sign-in Trusted Tenant Off
Sign-in Admins create accounts Off, unless you need it
Access Region protection Only the countries you work from
Access Invite-only onboarding On
Access Disable Public Hub On
Access Limit users who can create hubs Named people, or your own domain
Sharing Allow guest links on folders Off
Sharing Allow public submissions on folders Off, unless you need it
Content Malware scanning On
Content File size upload limit A set limit, not 0
Content Enforce classification On, with the PROTECTED label set
Content Information banner On, with your handling notice
Retention Recycle bin On, with an expiry that matches your records policy
Monitoring Log Analytics (Microsoft Sentinel) logging Connected

Configure sign-in and accounts

Set up passkeys and two-factor authentication

  1. Open your profile menu and select Tenancy Manager.
  2. Select Policies.
  3. Turn on Enforce passkey. Everyone sets up a passkey at their next sign-in, and their account then uses the passkey only.
  4. Turn on Enforce hardware attestation for passkeys. New passkeys must be device-bound hardware authenticators, such as a security key or a computer's or phone's built-in secure hardware. Synced and cloud passkeys are refused.
  5. Turn on Enforce 2FA. Keep it on while passkeys are being rolled out, so that no account relies on a password alone.
  6. Select Update policies.

Enforce hardware attestation for passkeys refuses synced passkeys, such as those stored in iCloud Keychain or Google Password Manager. Tell your team this before you turn it on, so they set up a supported authenticator at their next sign-in.

Set password and session controls

  1. On the Policies page, set Minimum password length to 14 or more.
  2. Set Session timeout (minutes) to 15.
  3. Select Update policies.

Limit administrator control over accounts

  1. On the Policies page, turn off Trusted Tenant. This keeps password recovery with the account holder. Trusted Tenant is on by default in a new tenancy.
  2. Leave Admins create accounts off, unless your workforce has no email addresses of its own. If you turn it on, treat administrator accounts as able to read those users' content.
  3. Select Update policies.

For more about passkeys and recovery, see Enable passkeys on your account and Account access recovery for passkeys.

Connect Entra ID Single Sign-On (if you use Entra ID)

  1. Open your profile menu and select Tenancy Manager.
  2. Select Integrations.
  3. Connect Entra ID single sign-on. Staff then sign in with their corporate accounts, so your multi-factor and conditional-access rules apply.
  4. Confirm that Entra ID requires phishing-resistant multi-factor authentication. Corporate accounts are exempt from Enforce passkey.

For setup details, see Entra ID SSO Integration.

Control who can reach your Hubs

  1. On the Policies page, set Region protection to the countries you work from. People outside those countries can sign in but cannot open Hubs.

    Region protection is based on the network address, so a VPN or proxy can get around it. Tenancy administrators and Dekko administrators are not restricted by it, so test it with a regular account.

  2. Turn on Invite-only onboarding. New users must register through an invitation and join a Hub in your tenancy before files can be shared with them.

  3. Turn on Disable Public Hub. This removes access to the Public Hub for everyone in your tenancy.

  4. Set Limit users who can create hubs to named people, or to your own domain using a wildcard such as *@yourdomain.com.

  5. Select Update policies.

For more about invitations, see Core Hubs: Invite Users.

Restrict sharing outside your organisation

  1. On the Policies page, turn off Allow guest links on folders. Guest links let anyone with the link browse, view, download and upload without an account.
  2. Turn off Allow public submissions on folders, unless you need anonymous file submissions. If you turn it on, also turn on malware scanning and remove submission links when they are no longer needed.
  3. Set De-identified sharing to on if external viewers must not see your staff's identities. Use an alias email domain that cannot receive mail. For more, see De-identified Hubs for External Sharing.
  4. Leave Fusion HUBs off, unless you need them. If you turn them on, review group membership regularly, because a group grants access to everything it is given. See Core Hubs vs Fusion Hubs.
  5. Select Update policies.

Protect content

  1. On the Policies page, turn on Malware scanning.

    Malware scanning is a separately priced add-on. Ask your account manager to set it up for your tenancy, then turn this setting on.

  2. Set File size upload limit (MBs) to the largest size you need. Do not leave it at 0, which means unlimited.

  3. Turn on Enforce classification. Every upload and message must carry a classification label.

  4. Select the AU Protective Marking Standard – PROTECTED label set. This set includes UNOFFICIAL, OFFICIAL, OFFICIAL: Sensitive, PROTECTED and CLASSIFICATION UNKNOWN.

  5. Turn on Information banner. Enter your handling notice in the banner text, for example the highest classification the tenancy is approved for.

  6. Turn on Disable deletion via DekkoDrive, so deletions happen only in the web application.

  7. Select Update policies.

You can add your handling notice to the end of every invitation to your Hubs by turning on the invite message appendix. Use it for terms of use or a handling notice that new users should see from the start.

Keep and delete data

  1. On the Policies page, turn on the Recycle bin. Set the expiry period to match your records policy. Deleted files are kept in the Archive until the expiry period has passed, which lets you recover from mistakes and malicious deletions.

  2. Set Previous version retention to the number of days your records policy requires.

  3. Leave Data Expiration off, unless your records policy requires automatic deletion.

    Data Expiration deletes all data older than the age you set, every day. Make sure the age matches your legal retention obligations before you turn it on.

  4. If you use Data clearout, note that it sends data older than your chosen age (at least 30 days) to the Recycle bin. It requires the Recycle bin to be on.

  5. If you use the Central Access Admin and Central Backup Account roles, nominate dedicated accounts, protect them with passkeys, and review them regularly. The two cannot be the same user.

  6. Select Update policies.

For more about deleted content, see Deleting Files and Recovering Deleted Content.

Monitor your tenancy

  1. Open your profile menu and select Tenancy Manager.

  2. Select Integrations.

  3. Connect Log Analytics (Microsoft Sentinel) logging. This sends your tenancy's activity events to your own Log Analytics workspace, so your security team can monitor them and set alerts.

    Log Analytics logging is a separately priced add-on arranged through your account manager. Standard level covers user activity, sign-ins and admin events. Extended also adds file names.

  4. Review the audit logs in Tenancy Manager regularly, and after any suspected incident. See In-App Audit Logging and Log Analytics Workspace Integration (Sentinel).

  5. Review your users and administrators in Tenancy Manager regularly. Remove people who have left, and keep the number of tenancy administrators small. See Removing Users and Offboarding.

Guidance for non-SSO users

Share these points with everyone in your tenancy:

  • Set up a passkey, or two-factor authentication, as soon as you are asked. Keep your recovery key somewhere safe.
  • Sign out on shared computers, and lock your screen when you step away.
  • Classify every file and message correctly, and share only with the people who need it.

Review your configuration

Review these settings at least once a year, and whenever a release adds or changes a tenancy security setting. Check What's new!? for changes to settings.

Was this article helpful?
Didn't find what you need?Ask the AI assistant about this topic, or contact support.
Request support