Anyone doing IT for a small defense manufacturer: how are you gating ITAR files from non-US-person accounts (and AI tools) in M365?
Transparency first: I'm an engineer researching how small defense suppliers handle export controlled data, might eventually build tooling in this space. Nothing to sell and nothing to link, the question is the point. The setups I keep seeing are 10 to 50…
Transparency first: I'm an engineer researching how small defense suppliers handle export controlled data, might eventually build tooling in this space. Nothing to sell and nothing to link, the question is the point. The setups I keep seeing are 10 to 50 person manufacturers, M365, one IT person or an MSP, and a folder of ITAR-stamped drawings from a prime. Under ITAR a non-US person opening those files counts as an export even inside the US, and AI assistants add a second version of the same problem (Copilot indexing the drawing folder, someone pasting a drawing into a chatbot to speed up quoting). The prescriptions I've collected from adjacent threads: Purview sensitivity labels plus DLP plus conditional access, or block AI tools at the proxy, or self-host the AI layer. All of it assumes someone maintains an accurate map of which files are controlled and which accounts belong to US persons, and at these shops that's one overworked person, if it's anyone at all. For people actually running this: what does your stack look like, what broke first, and is the file-level classification real or aspirational? And where did you end up putting the citizenship dimension, since it's not exactly a default AD attribute?
Collected discussion
Attributes in Entra ID. Create a dynamic group. Users with the ITAR attribute are members of the group. are you in M365 GCC High?
Fair on the second point, so to be clear: i'm not at a defense contractor and there's no CUI or company specifics here. I'm an engineer researching how small shops handle this (first line of the post), the practices question is the point. On the first point, you've landed on exactly what several practitioners have told me: below a certain size the rational move is us persons only, company wide, skip the segregation burden. The wrinkle others have raised: itar's us person definition includes green card holders and asylees, so a citizens only hiring rule overshoots the reg, and that gap is apparently where the discrimination exposure lives. Have you seen a small shop actually write the us persons only policy down formally, or is it an unwritten screen at hiring?
Not an operator, i'm researching this from the outside (per the post), so no tenant of my own. The entra attribute plus dynamic group is the cleanest implementation answer this question has gotten anywhere, thanks. The part i keep hitting in the research: the group enforces whatever the attribute says, but someone still has to assert the attribute, decide who counts as a us person, and decide which files are itar so the labels point at the right things. At shops you've seen run this, who owns those two calls, IT, HR, somebody named in a control plan? And does anyone ever re check them, or is it set at onboarding and never touched again
The offshore admin through the MSP is the version of this i keep hearing described as a quiet norm, you're the first to name it as an export event outright. Have you seen it actually get caught, by a client audit, a prime, an assessor, or does it just sit there?
My understanding with your scenario is that no, it's not an export because nothing was actually accessed. However, when dealing with the gov't, ITAR, and lucrative defense contracts that rely on your reputation and history, it's important to not put yourself into the position of potential export. That support guy in India could access it, and if he decided to, you couldn't stop it, and wouldn't know about it until it was too late. At that point, you've got a mess on your hands, have you go through your data leakage process, notify your contacts, notify the gov't, complete an investigation, etc etc. It's far easier and less complex to just not put yourself into the position that even being possible.
non-US citizen accessing a confidential document = export This is pretty clearly defined.
who owns those two calls Never IT. HR designates person status, department heads/security heads designate file status.
Firstly, you're talking about tiny companies. If they are defense contractors, I find it hard to believe that is a small part of their business. I can understand a huge company where maybe a tenth of their business is ITAR covered, not wanting to waste the opportunity to hire good talent by putting unnecessary restrictions on the rest of the business, deciding to accept the massive compliance burden of keeping things separate. But for a small defense manufacturer, is hiring a few non-ITAR staff worth the burden of having to prove you kept them separate from all the ITAR stuff? Is it a jurisdiction that is going to hassle a defense contractor on equal opportunity if they just say "trying to keep it separate isn't worth it" and hire only ITAR compliant staff company wide? Or at least for roles that use a computer, or need a key to the building? Second, why is a defense contractor of any size going to rely on reddit for security advice, and do your compliance people know you are posting here?
You'd be surprised.. go on r/CMMC. LOL
Nobody care about this honestly. That's the problem lol
I'm curious if this is even an export. Suppose: A person in India has an account. Nothing ITAR regulated is shared with them, if they sign in to SharePoint for example, they do not have permissions to any sites that have ITAR data. However, they are granted the Global Admin role. This doesn't mean they can just view whatever, but they could give themselves the ability to do so. But if they did, it would be audit logged, and even a Global Admin can't tamper with cloud logs. Six months after they become a Global Admin, compliance realizes they are a non-US person and revokes it. The audit logs go back a year, so at that point, it can still be proven that even though they did have a possible path to access data, they did not actually ever give themselves permissions to, or actually access, any ITAR data. In that case, was there any "export"? Or just some lesser compliance breach since you're lucky there wasn't an export? Saying the data was exported is like saying sysadmins read HR's email every day. We all theoretically could, but we don't, and if accused, audit logs can prove whether we did or not. This distinction actually comes up in public sector, when local entities in states that have union protections try to classify IT into the same category as HR, who are "confidential employees" who are excluded from being able to unionize (basically because they can see HR's side's planning for negotiations the lawmakers say negotiations would not be fair). But the custodian who has a master key to the building where HR keeps the paperwork isn't considered a confidential employee, because while he COULD read their notes, he isn't allowed or supposed to, and would be fired if he did, and the confidential employees rule is for employees who actually do see the notes. Generally IT ends up NOT considered confidential employees, and IS able to unionize in states where public workers are union. Source: I'm a school district sysadmin and a union negotiator.
You have to move them into GCC Enclave, you can't have them on Commercial Cloud. Also, if you have Indian tech support with admin privileges thru an MSP, they would have access and you have then exported the data to India.