Meishen Yin

Meishen Yin

Information Protection DataScan

Information Protection DataScan

Information Protection DataScan

Information Protection DataScan

Microsoft Azure

A module within Azure Information Protection allows security admins to discover and classify sensitive data stored in the Azure cloud.

Microsoft Azure is a world-leading cloud platform. In 2021, facing competition from Google Cloud and Amazon Web Services, Microsoft Azure urgently needed to offer more advanced features to clients in order to expand its market share. Data compliance is a critical need for modern companies. However, Azure did not have built-in governance tools for sensitive data (such as social security numbers, bank account information, etc.), which led to the loss of clients.

Company:

Microsoft Azure

My Role:

Product Designer

Year:

2020

Service Provided:

PM, VP of Product, Software Engineer

Problems

Problems

Problems

Problems

Microsoft Azure is an open, flexible, enterprise-grade cloud computing service. Facing the fierce competition with other cloud services, Azure cloud has a need to improve the user acquisition. The program manager conducted market research and learned that the one of the concerns the enterprise user had is that the Azure function can not support the data compliance feature.

Enhance adoption

Enhance adoption

Enhance adoption

Enhance adoption

65%

of enterprise users hesitate to adopt Azure due to its incapabilities in data classification for compliance.

Improve revenue

Improve revenue

Improve revenue

Improve revenue

By offering scanning services in the

information protection module, Azure

revenues can grow further

Solution

Solution

Solution

Solution

To efficiently deliver the design and communicate the interaction, I created a systematic UI flowchart.

Users & Problems

Users & Problems

Users & Problems

Users & Problems

The product users are security admins who are responsible for data loss prevention and make sure the data is compliant. After adopting Azure, they need to make sure the data in cloud is secured and compliant. Their workflow contains 3 major steps. I discovered there were three major pain points. For the first release of this product, the product team decided to focus on the first problem.

Discover

Find out where the sensitive data is located across Azure Blob Storage, Azure storage, and Azure Files



Have limited sight of the confidential data kept in Azure




Classify& Label

Assign predefined labels or tags to data based on its sensitivity and importance. "Confidential," "Internal Use Only," "Public," and "Restricted."



Difficulty in data classification and identification

Protect

Lack access control for

Encryption and data masking


No seamless way to manage the sensitive information stored in Azure for compliance and security purpose

Challenges and Problem-solving

Challenges and Problem-solving

Challenges and Problem-solving

Challenges and Problem-solving

Challenge 1: Product scope is not clear

Method1 : map user stories

Method 1 : map user stories

From the start, PMs wrote very rough and drafted user stories which were not clear and specific. Thus, I led a user story mapping workshop.


By delving into the program managers’ minds, asking user research questions, and listing out user sub-tasks, the user stories became more specific and executable.


In this process, the team agreed on the user stories, and it facilitated communication. I also became more empathetic to users.









From the start, PMs wrote very rough and drafted user stories which were not clear and specific. Thus, I led a user story mapping workshop.


By delving into the program managers’ minds, asking user research questions, and listing out user sub-tasks, the user stories became more specific and executable.


In this process, the team agreed on the user stories, and it facilitated communication. I also became more empathetic to users.

From the start, PMs wrote very rough and drafted user stories which were not clear and specific. Thus, I led a user story mapping workshop.


By delving into the program managers’ minds, asking user research questions, and listing out user sub-tasks, the user stories became more specific and executable.


In this process, the team agreed on the user stories, and it facilitated communication. I also became more empathetic to users.

From the start, PMs wrote very rough and drafted user stories which were not clear and specific. Thus, I led a user story mapping workshop.


By delving into the program managers’ minds, asking user research questions, and listing out user sub-tasks, the user stories became more specific and executable.


In this process, the team agreed on the user stories, and it facilitated communication. I also became more empathetic to users.

Method2: Information Architecture And Wireframing

Method 2: Information Architecture And Wireframing

The information architecture served as a tool to validate my initial assumptions about the user journey and navigation design for the product.


To validate these assumptions and ensure alignment with user needs and expectations, I designed the first version of information architecture to verify my initial assumptions about how would users interact with the product.



I quickly produced mid-fidelity wireframes based on the validated information architecture. These wireframes were crucial in validating the user stories, ensuring they were practical and feasible.


I presented the wireframes to the product management team. It helped them visualize the complexity of the product and they decided to descope the problems solved for users in version 1.



Challenge 2: Lack user research resources at the beginning

I rapidly iterated based on feedback and used usability testing to validate assumptions.

I rapidly iterated based on feedback and used

usability testing to validate assumptions.

I adopted the fast iteration methodology to validate my assumptions along the way. At the later stage of the project, I got usability testing opportunities and tested my assumptions.







Iteration 1 :Navigation Iteration

One specific challenge was designing the navigation panels for the product.


In order to designing an intuitive user journey navigated from the panel, I quickly iterated based on the internal experts’ feedback.


At the later stage, i conducted the usability testings to further validate assumptions.


The final design prioritized the frequent action, formed an intuitive user journey.

Search in the menu

Scan

Scannings

Scan configuration

Labels

Label management

Protection

Protection management

Reports

Dashboards

Info types found

Covered resources

Label types

Search in the menu

Overview

Get started

Dashboard

Reports

Classifiers found

Data sources covered

Settings

Scan configuration

Iteration 2: Summary Page Iteration

Another challenge was designing an intuitive and information-rich summary page. Facing ambiguity and uncertainty in understanding users from the start, I ideated features for the first version based on assumptions. During the iteration process, I always kept the following questions in mind:

What is the user journey like when reading the summary page?

What data visualization format suits the users' purpose best?

What information is most important for users, and what information would users like to dive into more?

The final summary page design is simple and information-rich. It offers an overview for important information. Users can dive in more detailed information easily from this page.

Iteration 3: Add Scan Design

Adding a scanning flow was crucial for this module. User research highlighted the need for a more efficient way to add data sources. I explored several options and implemented a design that streamlined complexity. The result: an efficient scanning flow that meets security admins' expectations.

I also reframed the users problem that it is not efficient to add data sources to the problem that users’ lack the knowledge where they should start with adding data sources.



I also reframed the users problem that it is not efficient to add data sources to the problem that users’ lack the knowledge where they should start with adding data sources.

So I came up with another two questions:



So I came up with another two questions:


What do users care about most?

Where does the risk reside?

Based on these two questions, I came up with another 2 ideas: data in use analysis and file type analysis. During the research session, users found these two are helpful when prioritizing the data sources to scan. Users found these two functions are very helpful.



Based on these two questions, I came up with another 2 ideas: data in use analysis and file type analysis. During the research session, users found these two are helpful when prioritizing the data sources to scan. Users found these two functions are very helpful.

Based on these two questions, I came up with another 2 ideas: data in use analysis and file type analysis. During the research session, users found these two are helpful when prioritizing the data sources to scan. Users found these two functions are very helpful.

Usability Testing/Research

In the later stages of design, I conducted usability testing sessions to validate assumptions and improve usability. I analyzed qualitative data from 8 sessions, summarizing findings into 10 key topics. This analysis proved valuable to product managers for future feature planning. Additionally, I identified 2 insightful personas that provided clear direction for enhancing the product's user experience.

Core Screens

Outcome

After releasing this module for three months, 60% of existing users scanned their data sources. Additionally, 90% of existing users expressed interest in a fully-fledged version of this module.


Users Adoption


60%

Stated Interest


75%

Add Scan Design

Adding a scanning flow was crucial for this module. User research highlighted the need for a more efficient way to add data sources. I explored several options and implemented a design that streamlined complexity. The result: an efficient scanning flow that meets security admins' expectations.

I also reframed the users problem that it is not efficient to add data sources to the problem that users’ lack the knowledge where they should start with adding data sources.



So I came up with another two questions:



What do users care about most?

Where does the risk reside?

Usability Testing/Research

In the later stages of design, I conducted usability testing sessions to validate assumptions and improve usability. I analyzed qualitative data from 8 sessions, summarizing findings into 10 key topics. This analysis proved valuable to product managers for future feature planning. Additionally, I identified 2 insightful personas that provided clear direction for enhancing the product's user experience.

Based on these two questions, I came up with another 2 ideas: data in use analysis and file type analysis. During the research session, users found these two are helpful when prioritizing the data sources to scan. Users found these two functions are very helpful.

Huge amounts of data sources and the amounts change every day

“In a single subscription, it might be 10 data sources, 50 data sources on another day. 100 new ones the day after, 20 more deleted in the same day. It is unmanageable if it is manual to select the data source to scan” (26:05)

Tracking data source by tags

“We track data source by tags, but that cannot fully roll out more than 50%. Some classic resources and thousands of storage accounts cannot be tagged. We have done the manual process to tag, which takes months, and it is still incomplete.”

Scan frequency

“Look at how many changes we have, continuous would be a good start”

“If the scan results show the states stay similar over a couple of weeks, we will scale down”

Workflow

“Have not used the AIP. It is very manual now. Currently, talk to the different teams to know where financial data locate, etc.“

“We want one-size fit all at the beginning, look at the big picture from the beginning.”(41:16)

Customization classifiers

“Manually set up the keywords as classifiers such as “password”/ phrase matching”

“Really would like to add customized classifiers (34:05) like NSCC”

Workflow

“The application team creates sources and automatically detects them in the environment, and scan rules are applied by the security team. The security team will apply the scan rule on the newly created.”

Data sources under scanning

“ If here can have info of the last run and next run can be handy. Status: completed, failed, did not run, etc. If it fails, it may originate from other issues”

Ideal workflow

“ Whenever the application team creates a data source, we would like to pick it up automatically and apply the rule(scan rule, mark content rule, classification rule, etc.) that we have the central security team has defined in advance. So can have visibility centrally.”

Organizing qualitative data into themes

Usability Testing/Research

In the later stages of design, I conducted usability testing sessions to validate assumptions and improve usability. I analyzed qualitative data from 8 sessions, summarizing findings into 10 key topics. This analysis proved valuable to product managers for future feature planning. Additionally, I identified 2 insightful personas that provided clear direction for enhancing the product's user experience.

Huge amounts of data sources and the amounts change every day

“In a single subscription, it might be 10 data sources, 50 data sources on another day. 100 new ones the day after, 20 more deleted in the same day. It is unmanageable if it is manual to select the data source to scan” (26:05)

Tracking data source by tags

“We track data source by tags, but that cannot fully roll out more than 50%. Some classic resources and thousands of storage accounts cannot be tagged. We have done the manual process to tag, which takes months, and it is still incomplete.”

Scan frequency

“Look at how many changes we have, continuous would be a good start”

“If the scan results show the states stay similar over a couple of weeks, we will scale down”

Workflow

“Have not used the AIP. It is very manual now. Currently, talk to the different teams to know where financial data locate, etc.“

“We want one-size fit all at the beginning, look at the big picture from the beginning.”(41:16)

Customization classifiers

“Manually set up the keywords as classifiers such as “password”/ phrase matching”

“Really would like to add customized classifiers (34:05) like NSCC”

Workflow

“The application team creates sources and automatically detects them in the environment, and scan rules are applied by the security team. The security team will apply the scan rule on the newly created.”

Data sources under scanning

“ If here can have info of the last run and next run can be handy. Status: completed, failed, did not run, etc. If it fails, it may originate from other issues”

Ideal workflow

“ Whenever the application team creates a data source, we would like to pick it up automatically and apply the rule(scan rule, mark content rule, classification rule, etc.) that we have the central security team has defined in advance. So can have visibility centrally.”

Organizing qualitative data into themes

Outcome

Outcome

Outcome

After releasing this module for three months, 60% of existing users scanned their data sources. Additionally, 90% of existing users expressed interest in a fully-fledged version of this module.


Users Adoption


60%

Stated Interest


75%

Next Project

Information Protection DataScan

A module within Azure Information Protection allows security admins to discover and classify sensitive data stored in the Azure cloud.

User Research

Web SaaS

0-1 Tehcnical Prouct

Data Security

Information Protection DataScan

A module within Azure Information Protection allows security admins to discover and classify sensitive data stored in the Azure cloud.

User Research

Web SaaS

0-1 Tehcnical Prouct

Data Security

Contract Designer

An actuarial science-based product helps simulate costs and savings for different value-based contracts for healthcare providers and payers.

Data Visualization

0-1 Data Analytic Product

Fast Iteration

Marketing Page

Contract Designer

Contract Designer

An actuarial science-based product helps simulate costs and savings for different value-based contracts for healthcare providers and payers.

Data Visualization

0-1 Data Analytic Product

Fast Iteration

Marketing Page

Contract Designer

An actuarial science-based product helps simulate costs and savings for different value-based contracts for healthcare providers and payers.

Data Visualization

0-1 Data Analytic Product

Marketing Page

Fast Iteration