How Allianz Technology Manages Information For 180,000 Users

Yaacov Cohen: So we will see in the demo how you made it easy. You talked a lot about in order to get acceptance from the business units, it's not enough today to just say you have to do it, this is a corporate mandate. We know that a end user today needs to be engaged and you can't really enforce a policy, but you need to get them to a deal and understand the why. As you mentioned, why the company is doing it, and to make it easy, not a burden. It's also interesting to see that more and more the legal requirements for protecting data privacy is specifically about maintaining retention and disposition at the right time. That's also very important principle, I think here.
I was talking to chief legal officer which were explaining the more data you keep in particular for large enterprise, the more liabilities you accumulate. This is true for a lot of businesses. They don't want to have to answer approval if they don't want to be asked to to give data which is redundant and have to end, create liability. So that's really interesting.
And then I think IT also making sure that you don't amass too much information, because the more you keep information, the more liability you keep. Also, if you have an intrusion, or you the more information you have there, the more critical the intrusion can be. So that's also really interesting. So thank you. Thank you for really giving us a big picture of this free set of requirements.
And I think the next thing is really how you guys came up with the right architecture and implementation to implement across multiple countries and multiple business units. How did you implement it? So maybe you can tell us more about the implementation.
Yes, of course. And before we jump to the technical deep dive with Julia, just a brief overview, because, as mentioned, I think, also in the invitation. So one of the key aspects we are using here is SharePoint Online meets Office 365, or M 365, how it's now called.

Maximilian Friedl: Microsoft 365 offers various different license packages, which can be used to do more security and compliance related topics. And to make sure that information is protected, and that there's some more governance in the tenet, and that's what we made use of it. So we have, as mentioned, we are a shared service provider. We have created a service which we call the Information Protection & Governance Service, built on the IPG license pack which covers various aspects for data protection security but mainly also, and that was the initial part for it. The ASIDM means for Allianz standard, for information and document management standard, a compliant digital archiving system. And that's the part where we will deep dive now in the next few minutes with Julia. So one part of it is SharePoint DMS how we call it.
And then, of course, also for retaining and archiving emails, we have harmon.ie as integration into Outlook. And then, that being said, switching over to Julia to show us and talk a little bit more about the technology.
Julia Stettner: So on a next slide, we can see the application sets that we offer within Allianz to facilitate the retention. And first of all, storing documents. And for that we use SharePoint.
Within Allianz, the users have the option to either create so-called SharePoint basic sites which cover more of the collaborative part of document management, so you could upload your files there to collaborate with them, together with your team, with your colleagues from the department.
And files would get deleted after 6 years on those SharePoint basic sites. You have the option to manually retain them a bit longer.
And on the other hand, we have our SharePoint DMS sites, which are the compliant digital archiving sites within Allianz.
Now, while both SharePoint types can be combined or integrated with the harmon.ie Outlook add in to upload emails and email attachments to the connected SharePoint site.
The SharePoint DMS sites are really the go to point for the end users to perform compliant digital archiving that needs the regulatory requirements.
SharePoint DMS sites come with an extended set of metadata that allow the user to classify the uploaded files or emails with some extensions that describe the content of the file.
In addition, and that's the big big benefit of the SharePoint DMS sites, we have an extended capability for retention and records management, and users really benefit from an automatic retention labeling on those SharePoint DMS sites.
Automatic retention labeling means the users provide certain metadata texts to an uploaded file, and based on the metadata text that the user provided, an automatic job that regularly runs in the back end automatically decides instead of the end user how long this particular file needs to be retained, how long it needs to be protected and when it eventually needs to be deleted.
Yaacov Cohen: So that's really interesting, what you’re describing is that you have basically basic sites which are for collaboration. And there is not much metadata, right?
Julia Stettner: Right. It has a basic set of metadata. But it's not mandatory to use them. So you could use them if it supports your information, architecture and SharePoint site. But it's not mandatory--
Yaacov Cohen: The business unit will decide if they want to put metadata. Yeah. And do you have any thinking moving SharePoint Online basic sites for collaboration to Teams, to benefit from chat and the functionality like that?
Julia Stettner: You can optionally build a team in front of a SharePoint basic site and also a SharePoint DMS site. So Teams is an optional construct which you can have in front of both SharePoint site types.
Yaacov Cohen: Very interesting. So and then only in the DMS, so you have this separation between collaboration and digital archiving with automatic record and retention labeling, okay, very interesting. Interesting architecture.
And harmon.ie gives you access to both, basically.
Julia Stettner: Exactly. Yeah.
Yaacov Cohen: Okay, thank you.

Julia Stettner: So with that, I would directly jump to the demo to show you the ideal archiving journey for the end users.
On the next slide we can see it somehow visualized on 2 different paths, which I will show you both.
Within Allianz, most end users use the browser interface to upload their normal documents like PowerPoint, Word, Excel files into SharePoint, whereas harmon.ie as an Outlook plugin is used to upload and archive emails.
So I will now show you both, and the SharePoint interaction, as well as to how many interaction to quickly guide you along this path or these 2 paths.
So we would start with the creation of a container, then upload the files, classify them, and finally close the container. Again to say, this automatic job that's running in the back end that the final retention period for the files inside the container should start.
And that I would share my screen. I hope you're able to see it.
Maximilian Friedl: Yes.

Julia Stettner: Perfect. So this is the SharePoint DMS site that I prepared upfront or ordered upfront and as you've seen on the slide, the journey starts with the creation of what we call [unintelligible]. We use the document set, content type, and SharePoint, and maybe knows about document sets.
You can think of it as a folder with the option to add metadata to it. So when our users create a new just here, they need to provide a couple of information about this container and typically, when you create a new container for files that belong to the same subject, you would mark it initially as open, so it means the files inside are still ongoing. The subject is not yet closed.
Yaacov Cohen: And so this is a document set. It looks like a folder for the user. But in addition, you said, you have metadata, which typically you don't have on the folder. So it's really implemented with a SharePoint document set, right?
Julia Stettner: Right. So we decided to do so in order to facilitate a better searchability of content. So you could, for example, search for files that are owned by a particular person.
So now we created this document set, and users now can start to just drag and drop files from wherever file location. Sorry. Just drag and drop their files to SharePoint.
Now, the next step for the end users is to classify the files based on the category or content of the files. So if they want to archive a file for a regulatory reason, then the first step is to classify the file as relevant document, which is done via the content type. So along with that they can see an additional metadata field popping up, which is the document class.
And document classes come from our group standard for information and document management, and they contain a list of several document classes, and each of those document classes is associated to a defined retention period. So these letters might need to be kept longer than or maybe shorter than, for example, a corporate tool.
So the user would provide a tag to this file and now the file is classified as relevant. And the sort of file is a business letter. Now, when the subject of this dossier is closed, the user just needs to go back to the metadata of the dossier and change the dossier status from open to closed. Changing the dossier status to closed triggers the automatic retention labeling to start running in the back end and within a time of around 7 days, the automatism would provide the correct retention label to this file means the end user doesn't need to know, and doesn't need to think about, How long do I need to retain a business letter? Is it 10 years? Is 20 years? Is it for indefinite, and because the automatism really applies the correct label based on the metadata classification that the user provided to this file.
Yaacov Cohen: So rather than asking the users to define a retention period, you’re abstracting that by saying you don't need to worry about the retention period. This is something Allianz Group Corporate is defining with legal, and all they need to say is what type of a business document is this, if it's a relevant document. So then they choose from the list of document type. And that's how the retention is automatically defined.
Julia Stettner: Correct. Yeah. And in this demo dossier which I created some weeks earlier, and you can see how it then looks in the end. So files that are classified as relevant, either an email or relevant document, which within a respective document class will receive the retention or record label
which is defined and the retention schedule. So for those 2 items it was record 10 years, and those 5 are now protected, not only against manual deletion, but also against changing any metadata or the content of the file itself.
So when we now go into Outlook, I will quickly show you how it looks from the harmon.ie perspective.
Yaacov Cohen: To let everybody know, harmon.ie is an Outlook plugin. So you are within Outlook and you are using the plugin to access your SharePoint sites. Harmon.ie gives you access to all your SharePoint locations, to all your Microsoft Teams locations, and your OneDrive locations, just to give the perspective of harmon.ie.
Julia Stettner: Yeah. So I connected my SharePoint set that you've just seen in the browser to harmon.ie. So now I am able to access what I actually see in the browser, and just via this sidebar in Outlook. So this is just the same as I would see in the SharePoint browser view.
You can see this harmon.ie demo dossier that I just created in the browser. And I can now do the same archiving journey for emails as well. So I can just pick an email and move it into my harmon.ie sidebar.
We configured harmon.ie in a way that it automatically detects emails as relevant emails whenever they are uploaded via harmon.ie. And the reason for this is that we actually want the user to only upload their relevant emails and not emails that are not relevant from a legal or business perspective.
And with that they just need to select the appropriate document class as they did for normal documents as well and save it and the file, the email is now uploaded into SharePoint into my dossier and is archived properly.
I can do the same for email attachments. So whenever I receive any file format as an attachment to an email, I can also just drag and drop that file into the sidebar. Again, as you've seen in the browser view, I need to select a content type for this uploaded file. So this case, it's relevant document.
And just the same as in the browser or for an email, I need to provide a document class and now, actually, all the functionality of SharePoint applies to those files.
As mentioned, harmon.ie is just another view into SharePoint. And with that I'm at the end of my demo.
Yaacov Cohen: Thank you, Julia. Thank you very much. And basically harmon.ie is learning on the fly, you don't need to set up anything about telling him about the metadata. If you change the metadata on SharePoint, is there anything you need to do with harmon.ie?

Julia Stettner: Er no, because it just retrieves the information from the SharePoint set up.
Yaacov Cohen: Okay, great. And what's the impact of harmon.ie on the user community? Why is it better to have Outlook plugin, rather than just the browser?
Julia Stettner: So one of our requirements, to be fulfilled from a legal perspective, was that the email metadata are visible in SharePoint. So what we do or what basically the core feature that we use within harmon.ie is that all the email metadata information like to send, recipient, sent date, subject, and so on, are extracted out of the message and written into SharePoint columns. And that again improves the searchability of your email so that you could easily search for email sent at a certain date, for example,
just by using the normal SharePoint search, which is much, much more end user friendly than opening each and every email file within SharePoint and trying to identify the sent date from there.
Yaacov Cohen: So the ability, really, that harmon.ie automatically map email headers to SharePoint columns which enable you, after that, to really classify email and search by sender or by date. And so on.

Okay, thank you very much. So, thank you. And with that we wanted to talk also about what were the challenges in this journey. This is a long journey, where you are in this journey, and what did you learn? We always learn more from challenges than from successes. So maybe you can share that with us also.
Maximilian Friedl: Umhm. Yes, sure, and that I would take over again and over the course as mentioned, we are working on that topic, at least from a technical point of view, for more than 2 years. But the whole journey started already in 2018, when this whole ASIDM group corporate rule was defined and released for organization, and there was a timeline given within 3 years to find ways to archive emails especially, and to find retention and deletion policies. Well, the first challenge was, there was already an archiving system for
unstructured data from file shares like regular documents, documents stored on file shares or emails shared from the past. But in the past, it was more a specific specialist tool for our legal departments in some of our OEs which have failed for the last years already with such requirements. But it was not a tool which was suitable for a user base of more than 180,000 users. It was based on finite and was really, from a user experience point of view, not that easy to understand from a regular employee level and it also did not fulfill our global requirements. It was hosted mostly in the European area, but it was nothing we can easily roll out on global scale. Therefore, we have to check for different approaches. Our answer to that, first of all, was then the introduction of the Office 365 service, so we can maybe jump to the next animation. Yes, and when we introduced Office 365 in 2019 and 2020, also with a huge acceleration caused by the pandemic for sure.
And meanwhile we have more than 185,000 users rolled out to Office 365. The full focus was mainly on collaboration, on sharing, on collaborating, on documents in the Office 365 area, the main focus for also switching to it was mainly different from a cost perspective to reduce the on premise storage cost for file shares and so on. But the requirements back then were not yet in the area of retention and deletion of data, and to perform record management. And also that being said, there was no license available yet in that time from Microsoft, and which was suitable for us from a cost perspective. Also to come up with such technology enhancements on Office 365. And what was changed in 2020 when Microsoft decided to change the license setup of the E5 license to allow the purchase of separate packages like the IPG enhancement, which we did, and this enabled us to design and build service, what we call IPG service, and including the enhancement of SharePoint with the tech document management system functionality. That was the design phase. Of course,
technically, everything is evaluated, tested, and so on. But the most critical part is, such a system has to be compliant with the legal requirements, and therefore legal assessment had to be done for a longer period, which took us nearly 5 months last year.
With exhaustive alignments, also with external legal parties to check if all the regulatory requirements are fulfilled. If our own corporate rules are fulfilled and everything is fine, not just from a technical, but also from a compliance point of view, and last, but not least, we received the prospective go live approval mid of last year. And so far we have rolled out 135,000 users out of our 185,000 Office 365 users to the platform with more to come until mid of next year.
And that is basically the biggest challenge right now, to not just enable the users technically, but also to drive change and adoption, because we, as a shared service provider, of course we provide a technical solution, but to make the adoption within each and every of our organizations of the operational units takes time, and takes also time to make the users understand why this has to be done. Because, as mentioned, the old archiving system was for special users, which are in the legal field which know there are regulatory requirements for years, and which have to do all that stuff on a daily basis. But for the majority of our user base, that's something completely new. So that they have to take care of, okay, I received an email, maybe 2 years ago, which is relevant for my company, not just for me personally, but relevant for the company from a legal point of view. So where do I have to put it now to avoid that, it's getting deleted. And all that is driven with extensive training. Not just from technical point of view, but also from the organizational point of view with the understanding of the corporate rule which was going out.

Yaacov Cohen: So you’re saying, Maxi, that really user adoption and user experience started in 2019 with the challenge of having an archiving solution which didn't provide the right user experience, the right user interface.
And then you are saying today, also, your main motivation is a user interface. So one of the things we have been looking at at harmon.ie is first facilitating user experience. We've a side bar within Outlook. So to avoid the toggling across applications, making it easy for users to drag and drop emails directly from Outlook.
But the other aspect to get the next step, ideally, information management should be totally transparent and add the 0 burden on the user. So one of the thing we've been exploring the past couple of months is, how can we use the advances in AI, the AI advances and with the [unintelligible] models to actually automate a lot of the information management. Is that something that you see in the future which would be of interest for Allianz Technology?
Maximilian Friedl: Yes, indeed. And that's also one part and one aspect we have defined for our overall strategy enrollment, because, as you mentioned, change in adoption is one thing, user trainings is the other thing, but it's always challenging that users are, thanks to the daily use or daily duties they do on their regular job, now they get another task which may consume a certain amount of time during that week, during their months, and that's sometimes not available, and also very difficult for most of the users to take the right decision where to put a certain document for archiving, how long. So we try to simplify that, of course, with the automation, with applying the labels, for instance, and take the decision how long it needs to be retained. But
to take the decision, okay, this email or that document now needs to be moved to the archiving system still has to be done by the employee themselves, and in some cases that works fine. In some cases, it's maybe difficult, and in some cases, maybe, the users do not even know if an email or a document needs to be retained for a longer period, because maybe they didn't make up their mind that they maybe have dealt with the relevant information overall. Therefore AI
could help there a lot because you can, first of all, learn from others. AI is trained usually, like the large language models, from the experiences from experts in our organization which maybe do that on a daily basis, and can maybe predict over time which documents might be of which document class and might be needed to be archived, and that could be something we could on the long run add to our product, so that the users not always have to take decision on their own, or at least are supported with taking the right decision.
Yaacov Cohen: Okay, yeah, yeah. I think, as we discussed before, we share the same vision of really making it easy for the user. And one of the things we have been, really, looking at at harmon.ie is when you look at any compliance initiative, it's very hard to engage the users. And typically you're going to get only 10% of early adopters. You know the user in your organization which will really be sensitive to this information management initiative sometime. It's legal, you know. Sometime IT is also an adopter, sometime you have a business unit.
So what we are looking at in our strategy for AI to facilitate information management is to leverage this 10% early adopters to actually train the model. So because this way the model can be trained.
You can learn from 10% users. And then you can start prompting the 90% which are maybe passive right now. You can prompt them to say, Hey, this email should be saved in this place. Go ahead and do it. Is that something you think that makes sense, to rely on the early adopters, to say what they are doing is actually a good behavior? We can assume it's a good behavior? Because typically you don't really know, there's no audit trail. And you just assume that these early adopters are right, are doing the same thing, and you can push the rest of the organization to mimic them. That makes sense?
Maximilian Friedl: Yes, of course. It's one of the aspects when using such AI tools, for sure, because early adopters usually are the ones which are feeling confident to use it. And which maybe already are in the position to take the right decision on their own and therefore, of course, their experience can help the organization to take the right decisions. But as always, and I think that's also in general, the overall discussion we also have internally about AI. Of course, it has to be reviewed afterwards, if the decision proposed to the users is the right one. So that's also in general, for AI the general rule to review what was proposed to make sure that you don't 100% rely on it. But it can definitely make a difference. And especially the early adopters play a huge role.
Yaacov Cohen: Yeah, what's interesting is so that the machine can learn from-- the machine gave a recommendation, and if the user has ignored it, then the machine can learn. Or if the user has accepted it and has moved. So basically, you start from semi automation where you only recommend to the user
and [unintelligible] a machine can get better. It's like a reinforce training. And then eventually, you may be able to get to full automation. But having this intermediate period when you only prompt the user with a recommendation and then learn if he makes sense from the user, the machine can adapt and learn a second time with reinforce training. Okay? Good. So maybe let's move to Q and A. We have questions from the audience. Maya, can you take us through that?