Skip to content

Moraph for clients

Sign in

Getting started

Getting started with "Civic-Secure" Microsoft 365

What "Civic-Secure" Microsoft 365 is for, who uses it, what you need before you start, and your first steps.

Applies to "Civic-Secure" Microsoft 365 as it works today. Moraph updates the platform continuously, and this page is reviewed when it changes.

Last reviewed 2 min readReport a problem
On this page
  1. What it is for
  2. Who uses it
  3. Before you start
  4. Steps to get started
  5. Where to go next

Moraph resells, deploys and manages Microsoft 365 in Microsoft's Government Community Cloud (GCC) for police departments, courts and other local agencies that handle criminal justice information. We configure identity, devices, labeling, data loss prevention, retention and logging to support the FBI CJIS Security Policy, document how each requirement is met, and keep the configuration in line as Microsoft changes the service. Your agency and your state's CJIS Systems Agency keep the policy decisions and the audit relationship.

What it is for

Local agencies want the same email, file sharing and chat tools everyone else uses, but criminal justice information comes with the FBI CJIS Security Policy attached. Microsoft 365 has the settings needed to support it, yet getting them right means working through multi-factor authentication, device controls, encryption, logging, retention and personnel requirements, then proving it all to the state CJIS auditor. Small IT teams rarely have the time to configure it, keep it configured as the service changes, and answer audit questions with evidence.

  • Officers and court staff share case material through personal email, unmanaged devices or consumer file sharing
  • Cloud settings that matter for CJIS are spread across many admin centers and change as Microsoft updates the service
  • Audit preparation means assembling screenshots and policy documents by hand
  • Small IT teams cannot watch sign-in risk, data loss alerts and access reviews every day

Who uses it

  • Police and sheriff's departments moving to cloud email and collaboration
  • Courts, prosecutors and probation offices that receive criminal justice information
  • City and county IT departments that support public safety agencies
  • Local Agency Security Officers responsible for CJIS compliance
  • Agency records and legal staff who manage retention and public records requests

Before you start

  • Your organization uses "Civic-Secure" Microsoft 365 as a managed platform from Moraph, under an agreement that covers it.
  • Licences for GCC, bought through Moraph or under your own agreement with the vendor.
  • A Moraph account in your organization for each person who works with Moraph on the service.
  • Named technical and security contacts, recorded in the Moraph Portal.

Steps to get started

  1. Agree the scope of the managed service for "Civic-Secure" Microsoft 365 with Moraph, including which environments and teams it covers.

  2. Name your administrators, technical contact and security contact in the Moraph Portal under People and access.

  3. Review the configuration baseline Moraph proposes for your regulations, and record any changes you need.

  4. Confirm how users will sign in, through your identity provider where the platform supports it.

  5. Agree the pilot group and the cut-over plan with your Moraph delivery lead.

Where to go next

Was this page helpful?

Report a problem with this page
What’s the problem?
Quote the step or heading if you can. Don’t include passwords or personal records.
Only if you’d like a reply. We use it for this report and nothing else.

Need help with your own setup rather than this page? Raise a support ticket.