The following questions about the proposed project on faculty and staff e-communications were gathered from the tri-campus town hall meetings, departmental consultations, multiple committee meetings, and feedback received via the proposed project Web site.
Additional questions that may be of interest to the community have been included. If there are further questions that you wish to pose, please submit them on our feedback form and we will find the answers and post them to the FAQ site.
Office 365 is a comprehensive online e-communication and collaboration service provided by Microsoft. The service provides virtually anywhere access to familiar Office tools (e.g., online versions of Word, Excel, Powerpoint…), e-mail, calendaring, instant message, audio/video conferencing, and cloud storage services. Note that the online Office applications do not replace PC/Mac-based software. They are adjuncts to the software you may already have.
A decision has not been made yet on Office 365. The consultation with faculty and staff continues, and the committee is still considering an array of feedback, questions and other issues raised during the process. No recommendations have been made to the Provost and senior administration yet, as each item must be addressed in detail before making any such reports.
O365 service is intended to replace the current UTORexchange and UTORmail services, if institutional go-ahead is provided.
Microsoft would provide the O365 service at no charge to the University.
For at least a decade, Microsoft and Google have provided hosted communication and collaboration services to the education community at no charge. Two reasons have been provided:
If a decision is made to implement O365, Information Technology Services will initiate a tri-campus wide education campaign for the available cloud services; however, most of the services such as e-mail and calendaring will remain the same if the user is taking advantage of popular desktop clients such as Outlook, MacMail and other desktop e-mail clients.
No. E-mail addresses will not change from the current @utoronto.ca. Accounts will be migrated into Office 365.
The following new features will be available if O365 is implemented:
No. There is no requirement to use the online suite of Office products. Local networks will continue to operate as will the capacity to save documents to local machines. Online Office is not intended to replace desktop Office. The University’s Microsoft Campus Agreement licenses ALL faculty and staff to obtain the Office ProPlus suite at no local charge for University-owned equipment. For $11, the Home Use program allows employees to buy Office ProPlus for two personally-owned machines. On December 1, Microsoft’s Student Advantage program commenced. This allows current students to obtain Office ProPlus for free — and to use for as long as they remain active students. The Office Online applications are not replacing machine-based applications. So, laptops in the field, and any University or personally owned machines can have up-to-date Office for free, or nominal charge for personal machines.
The Office of the Chief Information Officer has actively consulted with the Office of the Privacy Commissioner of Ontario. The following document provides useful guidance in regards to outsourcing e-communications service.
Yes. We have explored multiple options for hosting Exchange and alternatives in country. Costs are significant and will be summarized with the committee’s report. We note too, as does the Privacy Commissioner, that data are not easily confined by geographic borders. Further, an analysis of e-mail traffic flow demonstrates that a very high proportion of incoming and outgoing mail resides outside the University’s network and travels across the public Internet –where we cannot control the routing paths of messages and data may traverse borders. We also note the revelations of in-country data snooping and the multinational agreements for intelligence data gathering and sharing.
The advisory committee recognizes that there are those who may not wish to use Office 365. Should approval to proceed be granted, there will be an opt-out option for faculty.
An e-mail service comparable to existing UTORmail services will be made available to faculty who choose to opt-out of Office 365. In addition, we are investigating other services for large file transfer – something that is of difficulty today because of e-mail attachment limitations.
Yes. Here are some universities in Canada that have already outsourced faculty, staff and student e-mail:
Many other schools in Canada, the United States, and abroad have outsourced their e-mail to Microsoft’s Office 365 or Google’s Apps for Education. Some have only outsourced student mail, and many are working through the processes of including faculty and staff in the offering.
Should the University make a decision to roll-out O365 service to faculty and staff, Information Technology Services will begin an implementation consultation with divisional IT leaders and create a carefully scheduled implementation plan that does not interfere with the business of University and its community.
Microsoft offers a fairly lengthy upgrade period, the most recent example is 24+ months. If on a rare occasion an upgrade requires an outage, the University will have adequate time to negotiate an appropriate outage period in consultation with the community. We anticipate, from experience, that most upgrades to the system will not require an outage and will not affect concurrent use of service.
No. Departmental networks and servers, as well as the central data centres will continue to operate. Community members will be under no obligation to utilize the cloud storage available through the O365 SkyDrive. Should community members decide to use SkyDrive in O365, they should consult the use-case guidelines that will be provided by the University. Note that facilities and processes employed by Microsoft to secure, protect and preserve data are at least as strong and likely better than anything we can provide internally. It is still important to consider where cloud storage is appropriate before using.
Yes. When placing documents in electronic media, one must always be considerate of the risks associated with loss or misdirection. For example, it would be unwise to send credit card numbers or passport information via unencrypted e-mail because of the risk of exposing personal and sensitive information. The University recognizes that there are varying degrees of confidentiality and sensitivity in information handled by faculty and staff. The University will provide guidance and use cases to assist community members in appropriately utilizing the variety of available tools and services for e-communication and collaboration. Additionally, the University will work with the community to identify and develop alternative tools for the delivery of sensitive and confidential information that may not be appropriate for cloud services such as O365.
In our digital world, most forms of communication are potentially exposed to electronic surveillance regardless of where they are hosted. Microsoft has stated that they do not provide back doors to their servers to governmental agencies.
No. Users gain access to O365 by logging on to our standard University weblogin screens. When a user wants to access e-mail, O365 sends a request to the University’s authentication system (weblogin) asking for UTORid credentials. This takes the user to the University’s weblogin screen, on equipment hosted by the University. When login is successful, a token is sent back to O365 that verifies the user’s identity. This is part of the separation of duties designed to better protect the privacy and confidentiality of community members.
Office 365 physical and logical security is managed by Microsoft and their service and data centre staff. U of T manages the authentication and login credentials. Microsoft does not get user IDs and passwords. We have administrator access to our instance of Office365. The University is the service provider to the community. Microsoft is hosting the service. We control our data.
The University has undertaken the process of assessing the proposed O365 service using the Privacy by Design principles as outlined by the Privacy Commissioner of Ontario. Our staff has created an Information Risk and Risk Management (IRRM) document which provides an depth assessment of privacy and security for the proposed service from a technical perspective. This document is a “living-document” and in updated as new information becomes available.
The O365 service is hosted in the United States in Microsoft’s data centers.
No … not without a fight. Microsoft has asserted that it has not provided security agencies with backdoors to customer data and metadata and that unless prohibited by law or regulation, it will alert customers to government orders to provide information. See: http://blogs.technet.com/b/microsoft_blog/archive/2013/12/04/protecting-customer-data-from-government-snooping.aspx and http://reformgovernmentsurveillance.com/
Additionally, the University’s O365 plan includes a proposal to allow users to encrypt their content and retain those encryption keys locally, eliminating Microsoft’s agency. We recognize the risk of surveillance activities by intelligence agencies such as the NSA, CSEC, and others, and the possibility that encryption can be compromised to weaken these risk mitigation approaches. At the end of the day, the University encourages all users to recognize that email is not a secure communication channel and to communicate in a manner consistent with the sensitivity of their information.
Yes. The institutional BES server will continue to operate. There is an offering in Office 365 to host the BES server but we are not pursuing at present. Office 365 is intended to replace UTORmail and UTORexchange.