Attachment_2_Statement_of_Work.pdf

United States Department of the Interior

INDIAN AFFAIRS

Division of Information Operations

1011 Indian School Road, NW Suite 177 Albuquerque, New Mexico 87104

Introduction

Department of Interior Indian Affairs (IA) is preparing to launch a new project with six major workstreams, to continue improving and modernizing both Bureau of Indian Affairs (BIA) and Bureau of Indian Education (BIE) Information Technology environments.

The overall goal of this project is to assess, plan, design, and execute the migration of on-premises servers and applications to the cloud, to help drop maintenance costs and increase reliability.

As part of that goal, IA is requesting assistance with improving enterprise security, particularly on endpoints and servers, using a Zero Trust methodology. Finally, IA wishes to continue efforts to widen both the productivity and effectiveness of M365 Office, OneDrive, SharePoint, and Intune, to minimize wherever possible the need for local on-premises servers. This will give IA employees a smoother and better user experience that is more suited to working remotely with good security practices.

The key workstreams will focus on these areas, under the direction of Indian Affairs:

1) DevOps

• Assist with introducing SaaS based DevOps tracking tools such as Azure DevOps

• Assist with DevOps support and training developers on Azure based Services.

• Assist in establishing new processes for application development management, as

Indian Affairs determines is necessary.

• Assist in training and supporting Indian Affairs contractors and full-timers to use

Microsoft cloud technologies and tools to improve both productivity and accountability.

2) Server Migration from On-Premises to the Cloud

• Assist with upgrading, deprecating, or replacing Windows 2012 servers that are approaching EOL within six months; wherever it is most effective and efficient, the goal is to move as many of these servers as possible into the Microsoft Azure cloud.

• Assist with assessments of on-premises SharePoint to either Azure or M365 online SharePoint platforms, then migrations of sites to the cloud

• Assist in identifying which on-premises servers and applications make sense to migrate, and which should be migrated first, by gathering inventory, raw data assessments of server processes and configurations, and interviews with application owners.

• Assist with developing and driving a reasonable migration timeline working with IA staff.

• Assist with actual server migration deployment, decommissioning of replaced or deprecated servers, and upgrade-in-place tasks.

3) Disaster Recovery, Backup, and Data Retention Policy redesign:

• Assist with rationalizing existing data archival stores, to retire out-of-date archives which Indian Affairs has determined are no longer required.

• Assist with replacing old tape-based systems with cloud backups and disaster recovery services.

• Assist with developing new retention policies that will meet DOI and Federal guidelines.

• Assist with improving the speed of storage and restoration of data.

• Improve time to recover from server events.

4) Cybersecurity

• Assist with improving Windows deployments, patching and compliance reporting, leveraging wherever possible cloud-based security applications and management tools.

• Assist with improving security scores in the cloud for both Indian Affairs tenants.

Assist with planning, designing, implementing a Privileged Access Workstation (PAW) image for workstations that will be utilized for cloud administration tasks.

• Explore potential for using Virtual Desktop technologies to assist with running cross-tenant (BIE to BIA) operations safely and securely in remote locations and on BYOD systems.

5) Cloud and Endpoint Management and Compliance

• Assist with improving performance and governance and security using Cloud

Management and Compliance tools available to Indian Affairs, including Intune and Microsoft Defender for Endpoint (MDE)

• Assist with improving security through monitoring and alerts, cross-referencing with DOI and Federal regulations and requirements.

• Assist with leveraging and designing additional dashboards to offer customized views to monitor events that concern Indian Affairs most, as needed.

To support these efforts as part of their End User Experience Improvement project, Indian Affairs requests three types of assistance from Microsoft:

1) Microsoft Unified Support: Note: these resources have been known to date to Indian Affairs as Microsoft Premier. Steady support from highly qualified Microsoft Customer Engineers who will be assigned to both Indian Affairs from the Microsoft Customer Success Unit (CSU) to run educational workshops and offer specific guidance, expertise and as-needed assistance with designing implementation strategies and troubleshooting Microsoft products involved in this migration effort;

this will be executed through the Unified contract model, with support provided to both Indian Affairs.

2) Microsoft Transformation Team (MTT), resources provided through the Microsoft Transformation Offering (MTO): Supplemental assistance from Microsoft to Indian Affairs’ existing full-time and contractor talent; this will be executed through a Microsoft offering called the Microsoft Transformation Offering (MTO). MTO allows Microsoft to assist Indian Affairs in accomplishing ‘hands-on-keyboard’ work, building out Indian Affairs documentation, and working closely with Indian Affairs resources to complete migration workloads, as hours provided in this contract permit.

With this offering, Microsoft provides advice, guidance, and hands-on assistance as requested by Indian Affairs, which will be provided with this Statement of Work in the following specific delivery areas:

• Digital Transformation Planning, Envisioning, Change Management, Communications with End Users and Server Administrators, and coordination tasks

• Image and application package and policy planning, design, and support throughout early testing in the IA production networks (Indian Affairs; this will include Infrastructure-as-Code and Azure Resource Manager templates and scripts to standardize and simplify cloud deployments of servers

• Improvements to cloud-based services that enhance and improve endpoint deployments and overall management of both Windows and mobile phone devices.

Below are more detailed explanations of the scope and level of talent and ability that will be offered by Microsoft Unified Support Services (Microsoft Customer Success Unit or CSU) and Microsoft Transformation Team (Microsoft Consulting Services)

Microsoft Unified Support Overview

This Services Description describes the various types of Microsoft Unified Support Services that may be obtained (the “Support Services”) by Customer. In addition, it sets forth the parties’ respective responsibilities, prerequisites and assumptions that underlie the provision of the Services, applicable fees, and additional terms and conditions.

2. Support Services

Support Services

Microsoft Unified Enterprise Support Services (support services) is a comprehensive enterprise support set of services that helps accelerate your journey to the cloud, optimize your IT solutions, and use technology to realize new business opportunities for any stage of the IT lifecycle. Support services include:

• Proactive services help improve health of your IT infrastructure and operations

• Service Delivery Management to facilitate planning and implementation

• Prioritized 24x7 problem resolution services to provide rapid response to minimize downtime

2.1 Available Packages and Services.

Support services are available as a Base Package, with additional services, and enhanced services and solutions available to purchase under an existing Base Package agreement listed in this Services Description or its schedules or exhibits, as described below.

Item Description

Base Package A combination of proactive, reactive and delivery management services that support Microsoft products and/or Online Services in use within your organization. Part of your Base Package includes a Flex Allowance* to use to add proactive services (marked with “+”), enhanced services and solutions services and/or Custom Proactive services to your Base Package. Base Package included services are represented with a “” throughout this section.

Additional services Additional support services are available to add to your Base Package during the term of this Services Description and are represented with a “+” throughout this section.

Enhanced services and solutions Support services, which cover a specific Microsoft product or customer IT system, are available to add to your support Base Package during the term of this Services Description and are also represented with a “+” throughout this section.

*Flex Allowance is a flexible portion of your base package list price that may be applied towards the purchase of Proactive services, enhanced services and solutions, Proactive credits or Custom Proactive Services at the time of the services purchase. Your Microsoft representative will provide the portion of your Base Package list price available for use as Flex Allowance. The following conditions for allocation of your Flex Allowance apply:

• Up to 20% or $50,000, whichever is higher, of your allotted Flex Allowance may be applied to the purchase of Proactive Credits or Custom Proactive services.

• Flex Allowance is allocated on an annual basis and any services to which Flex Allowance has been applied must be utilized during the applicable annual term.

Flex Allowance may not be used for Service Delivery Management services, as defined herein.

• If you ordered one type of service with Flex Allowance and wish to exchange it for another type of service, you may apply equivalent value to an alternative service where available and agreed with your service delivery resource.

• All available Flex Allowance must be allocated by the time of contract execution, or it will be forfeited.

2.2 Description of Services

The items which are combined to form your support services package are described in this section. Also, listed are services that may be added to your Base Package or added during the Term of the agreement.

2.2.1 Proactive Services

Proactive services help prevent issues in your Microsoft environment and will be scheduled to help ensure resource availability and delivery during the term of this Services Description. The Proactive services that follow are available as identified below or detailed in your Fee Schedule or exhibits to this Services Description. Onsite delivery may not be available for all services and in all geographies. Delivery will be remote unless otherwise agreed in writing and for an additional fee or unless expressly sold as an Onsite service.

Planning services

Planning services provide assessments and reviews of your current infrastructure, data, application, and security environment to help plan your remediation, upgrade, migration, deployment, or solution implementation based on your desired outcomes.

Planning service types Plan

Proof of Concept +

- Additional service that may be purchased.

Proof of Concept: An engagement to provide evidence that enables the customer to evaluate the feasibility of a proposed technical solution. The evidence can be in the form of working prototypes, documents, and designs, but are not production-ready deliverables.

Implementation services

Implementation services provide technical and project management expertise to help you accelerate design, deployment, migration, upgrade, and implementation of Microsoft technology solutions.

Implementation service types Plan

Onboarding Services +

- Additional service that may be purchased.

Onboarding Services: A direct engagement with a Microsoft resource to provide deployment, migration, upgrade or feature development assistance. This can include assistance with planning and validation of a proof-of-concept or production workload using Microsoft products.

Maintenance services

Maintenance services help prevent issues in your Microsoft environment and are typically scheduled in advance of the service delivery to help ensure resource availability.

Included as part of your Base Package.

+ - Additional service that may be purchased.

Maintenance service types P l a n

On-demand Assessment

Assessment Program +

Offline Assessment +

Proactive Monitoring +

Proactive Operations Programs (POP) +

Risk and Health Assessment Program as a Service (RAP as a Service) +

On-demand Assessment: Access to a self-service, online automated assessment platform that uses log analyses to analyze and assess your Microsoft technology implementation. On-demand Assessments cover limited technologies. Use of this assessment service requires an active Azure service with adequate data limits to enable use of the on-demand assessment service. Microsoft may provide assistance to enable initial setup of the service. In conjunction with the On-demand Assessment, and for an additional fee, an Onsite Microsoft resource (for up to two days) or remote Microsoft resource (for up to one day) are available to assist with analyzing the data and prioritizing remediation recommendations per your services agreement. Onsite assessments may not be available in all geographies.

Assessment Program: An assessment of the design, technical implementation, operations or change management of your Microsoft technologies against Microsoft recommended practices. At the conclusion of the assessment, Microsoft resource will work directly with you to remediate possible issues and provide a report containing the technical assessment of your environment, which may include a remediation plan.

Health Check: An implementation assessment review of your Microsoft technology implementation against our recommended practices. A Microsoft resource plans the health check engagement with you, performs the review, analyzes the data and delivers a report upon completion.

Offline Assessment: An automated assessment of your Microsoft technology implementation with data collected remotely, or by a Microsoft resource at your location. The data gathered is analyzed by Microsoft using on-premises tools, and we provide you with a report of our findings and remediation recommendations.

Proactive Monitoring: Delivery of technical operations monitoring tools and recommendations for tuning your server incident management processes. This service helps you create incident matrices, conduct major incident reviews, and create the design for a sustained engineering team.

Proactive Operations Programs (POP): A review with your staff of your planning, design, implementation or operational processes against Microsoft recommended practices. This review is done either onsite or remotely by a Microsoft resource.

Risk and Health Assessment Program as a Service (RAP as a Service): An automated assessment of your Microsoft technology implementation, with data collected remotely. The data gathered is analyzed by Microsoft to create a findings report containing remediation recommendations. This service is available for on-site or remote delivery.

Optimization services

Optimization services focus on the goals of optimal utilization of the customer’s technology investment. These services may include recommendations for remote administration of cloud services, optimizing the adoption of Microsoft product capabilities by end users and ensuring robust security and identity posture.

Optimization service types P l a n

Adoption Services +

Development Focused Services +

IT Services Management +

Security Services +

+ - Additional service that may be purchased.

Adoption Services: Adoption support services provide a suite of services that help you assess your organization’s ability to modify, monitor and optimize changes linked to your Microsoft technology purchase. This includes support in the development and execution of your adoption strategy around the people's side of change. Customers have access to resources with expertise, knowledge and associated Microsoft recommended practices in support of their adoption program.

Development Focused Services: Services available to assist your staff build, deploy, and support applications built with Microsoft technologies.

Services Insights for Developers: An annual assessment of your application development practices helping customers with recommended practice guidance for developing applications and solutions on Microsoft platforms.

Development Support Assistance: Provides recommendations to help in creating and developing applications that integrate Microsoft technologies on the Microsoft platform, specializing in Microsoft development tools and technologies, and is sold as a quantity of hours listed in this Services Description or its accompanying schedules and exhibits.

IT Services Management: A suite of services designed to help you evolve your legacy IT environment using modern service management approaches that enable innovation, flexibility, quality, and operational cost improvements. Modern IT Service Management services may be delivered through remote or onsite advisory sessions or workshops to help ensure your monitoring, incident management or service desk processes are optimized to manage the dynamics of cloud-based services when moving an application or service to the cloud. IT Services Management services may be an element of a customized program of support services, available for an additional fee and may be defined in an exhibit and referenced in this Services Description or its schedules and exhibits.

Security Services: The Microsoft security solutions portfolio includes four focus areas: cloud security and identity, mobility, enhanced information protection and secure infrastructure. Security services help customers understand how to protect and innovate their IT infrastructure, applications and data against internal and external threats. Security services may be an element of a customized program of support services, available for an additional fee and may be defined in an exhibit and referenced in this Services Description or its schedules and exhibits.

Education Services

Education services provide training that help to enhance your support staff’s technical and operational skills through either onsite, online or on-demand instruction.

Education service types P a n

On-demand Education

Webcasts

Chalk Talks +

Workshops +

√ - Included as part of your Base Package.

On-demand Education: Access to a collection of online training materials and online labs from a workshop library digital platform developed by Microsoft.

Webcasts: Access to live Microsoft-hosted educational sessions, available on a wide selection of support and Microsoft technology topics, delivered remotely online.

Chalk Talks: Short interactive services, typically one-day sessions, that cover product and support topics provided in a lecture and demonstration format and are delivered by a Microsoft resource either in person or online.

Workshops: Advanced level technical training sessions, available on a wide selection of support and Microsoft technology topics, delivered by a Microsoft resource in person or online. Workshops are purchased on a per-attendee basis or as a dedicated delivery to your organization, as specified in this Services Description or its schedules or exhibits. Workshops cannot be recorded without express written permission from Microsoft.

Additional Proactive services

Additional Proactive service types P a n

Custom Proactive Services (Maintenance, Optimization and Education services)

Support Technology Advisor

Proactive Accelerator

Designated Engineering

Custom Proactive services: A scoped engagement with Microsoft resources to deliver services at the customer’s direction, in person or online, which are not otherwise described in this document. These engagements include Maintenance, Optimization and Education service types.

Support Technology Advisor (STA): A customized service that provides a technology assessment supporting customer business goals including, but not limited to, workload optimization, adoption or supportability, delivered by a Microsoft resource. This service may include a plan and technical guidance tailored to customer environment and business goals.

Proactive Accelerator: A Microsoft resource-led service comprised of a scoped set of activities to help you accomplish a technical or business outcome based on goals to eliminate deployment risks, increase availability, or optimize solution performance. Using a programmatic approach, the Microsoft resource will determine the set of activities needed for engagement, which may include, but are not limited to, fit gap analysis, onboarding, optimization, knowledge transfer, design validation, and implementation plan.

Designated Engineering (DE): Curated and outcome-driven solution(s), based on Microsoft recommended practices and principles, that help accelerate your time to value, A lead expert will work with your team closely to provide deep technical guidance and leverage other Microsoft experts where required, to help with deployment and/or optimization of your Microsoft solutions. Including services that span from assessment and planning, to upskilling and design, to configuration and implementation.

Other Proactive P a n

Proactive Credits +

Proactive Credits: The value of exchangeable services represented in credits in this Services Description or its schedules or exhibits. Proactive Credits can then be exchanged for, or applied to, one or more defined additional services, as described within this document, and at current rates provided by your Microsoft Services representative. After selecting the available additional service, we will deduct the value of that service from your credit balance, rounded up to the nearest unit.

Reactive services

Reactive services help resolve in your Microsoft environment and are typically consumed on demand. The following reactive services are included as needed for currently supported Microsoft products and online services, unless otherwise noted in this Services Description or its schedules or exhibits. NOTE: All reactive support is delivered remotely.

Reactive service types P l a n

Advisory Support

Problem Resolution Support

Reactive Support Management

Root Cause Analysis

Reactive Support Management Add-on

- Included as part of the Base Package.

Advisory Support: Phone-based support on short-term (limited to six hours or less) and unplanned issues for IT Professionals. Advisory Support may include advice, guidance, and knowledge transfer intended to help you deploy and implement Microsoft technologies in ways that avoid common support issues and that can decrease the likelihood of system outages. Architecture, solution development and customization scenarios are outside of the scope of these Advisory Services.

Problem Resolution Support: This assistance for problems with specific symptoms encountered while using Microsoft products includes troubleshooting a specific problem, error message or functionality that is not working as intended for Microsoft products.

Incidents may be initiated either by phone or submitted via the web. Support requests for services and products, not covered by the applicable online service support portal, are managed from within the Microsoft Services online portal.

Severity definitions and the Microsoft estimated initial response times are detailed in the incident response tables below. The term 'First Call Response' is defined as the initial non-automated contact via phone or email.

Upon your request, we may collaborate with third-party technology suppliers to help resolve complex multi-vendor product interoperability issues, however, it is the responsibility of the third party to support its product.

The incident severity determines the response levels within Microsoft, initial estimated response times and your responsibilities. You are responsible for outlining the business impact to your organization, in consultation with us, and Microsoft will assign the appropriate severity level. You can request a change in severity level during the term of an incident should the business impact require it.

Severity and situation

Our expected response

Your expected response

Severity 1

Critical business system down:

Business at risk.

Complete loss of a critical application or solution.

Needs immediate attention

Azure components1

- First call response in 15 minutes or less

All other products and services - First call response in one hour or less

Critical situation resource2 assigned

Continuous effort on a 24/7 basis3

Rapid escalation within Microsoft to product teams

Notification of our senior

Notification of your senior executives, as requested by us

Allocation of appropriate resources to sustain continuous effort on a 24/7 basis3

Rapid access and response

Submission via phone or web

Severity and situation

Our expected response

Your expected response executives, as required

Severity A

Critical business system degraded:

Significant loss or degradation of services

Needs attention within one hour

First call response in one hour or less

Critical situation resource2 assigned

Continuous effort on a 24/7 basis2

Allocation of appropriate resources to sustain continuous effort on a 24/7 basis3

Rapid access and response

Submission via phone or web

Severity B

Moderate business impact:

Moderate loss or degradation of services, but work can reasonably continue in an impaired manner

Needs attention within two business hours4

First call response in two hours or less

Effort during business hours only 4

Allocation of appropriate resources to align to Microsoft effort

Access and response from change control authority within four business hours

Submission via phone or web

Severity C

Minor business impact:

Substantially functioning with minor or no impediments of services

Needs attention within four business hours4

First call response in four hours or less

Effort during business hours only4

Accurate contact information on case owner

Responsive within 24 hours

1 The listed response time for your Azure components does not cover, Azure StorSimple, GitHub AE, Azure Communication Services or Billing & Subscription Management 2Critical situation resources are help drive for prompt issue resolution through case engagement, escalation, resourcing, and coordination.

3 We may need to downgrade the severity level if you are not able to provide adequate resources or responses to enable us to continue with problem resolution efforts.

4 Business hours are generally defined as 09:00 to 17:30 Local Standard Time, excluding holidays and weekends.

Business hours may differ slightly in your country.

Reactive Support Management: Reactive Support Management provides oversight of support incidents to drive timely resolution and a high quality of support delivery. Service Delivery Management will be utilized for the Reactive Support Management of all support requests. Per the Incident Response tables above, for Severity B and C incidents, the service is available by customer request during business hours to the Microsoft resource who can also provide escalation updates when requested. For Severity 1 incidents, an enhanced escalation process is initiated and automatically executed. The assigned Microsoft resource is then responsible for ensuring continued technical progress by providing you with status updates and an action plan.

For non-business hours extended coverage, you may purchase Additional Reactive Support Management Hours.

Root Cause Analysis: When explicitly requested prior to incident close, we will perform a structured analysis of potential causes of a single incident, or a series of related problems.

You will be responsible for working with the Microsoft team to provide materials such as log files, network traces, or other diagnostic output. Root Cause Analysis is only available for certain Microsoft technologies and may incur an additional charge.

Reactive Support Management Add-on: You may elect to purchase additional hours to provide Reactive Support Management. These resources will operate remotely and deliver the service during the business hours in the time zone that is agreed upon in writing. This service is delivered in English and, where available, may be provided in your spoken language. This service is subject to Microsoft resource availability.

Service Delivery Management Service Delivery Management (SDM) is included with your support services, unless otherwise noted herein or in schedules or exhibits to this Services Description. Additional delivery management services may be added when purchasing additional services or enhanced services and solutions.

SDM services are provided digitally and by a designated customer success account manager. This named resource may operate either remotely or onsite at your location.

Service Delivery Management scope The following SDM services are available:

Service delivery management service types P a n

Customer Organization Enablement

Microsoft Product, Service, and Security Updates Guidance

Program Development & Management

Unified Enterprise Support Onboarding

Cloud Success Program

Cloud Solution Architect Developer Advocate

Executive Relationship Management

Service Delivery Management Add-on

Onsite Service Delivery Management

- Included as part of the Base Package.

1 – Additional services that may be provided by Microsoft.

Customer Organization Enablement: Guidance and information provided to your named Support Service Administrator about how to manage utilization of your Unified Support services and prepare you to use Unified Support digital and reactive services.

Microsoft Product, Service and Security Updates Guidance: Information shared with you about important upcoming product and service features and changes, as well as security bulletins for Microsoft technologies.

Program Development & Management: Activities designed to plan, propose, and manage your support program’s services, across your organization to help you realize greater value from your investments in Microsoft technology and services. Microsoft may recommend a variety of services intended to help you achieve key business and technology outcomes, making use of the capabilities included in your Base Package support, as well as additional services you may purchase.

Unified Support Onboarding: Activities to support your initiation into Unified Support, including the introduction and promotion of self-service capabilities in the online support portal, with a goal of ensuring timely utilization of your Unified Support services.

Cloud Success Program: Planning and delivery services are included to help you achieve specific cloud outcomes, empowering you to accelerate the implementation, adoption and realized value of Microsoft cloud technologies.

Cloud Solution Architect Developer Advocate: A development focused Microsoft support resource who will deliver strategic advice and guidance to accelerate innovation and drive efficiency throughout the software development lifecycle. The assignment of these resources is subject to Microsoft resource availability.

Executive Relationship Management: A set of activities to ensure the Microsoft Support team is aligned to your organization’s strategic priorities and engaged with key business and technology decision makers.

Service Delivery Management Add-on: You may elect to purchase additional custom SDM resources to provide service delivery management services as part of a pre-determined scope of work, which are not explicitly detailed in this document. This service is also subject to Microsoft resource availability. These resources will operate either remotely or onsite at your location determined by customer. If delivered onsite, the below restrictions will apply.

Onsite Service Delivery Management: You may request onsite visits from your customer success account manager that may require an additional charge per visit. This service is subject to Microsoft resource availability.

2.3 Enhanced Services and Solutions

In addition to the services provided as part of the Base Package or as additional services, the following optional enhanced services and solutions may be purchased. Enhanced services and solutions are available for an additional fee and may be defined in an Exhibit referenced in this Services Description or its schedules.

Service P l a n

Enhanced Designated Engineering

Unified Enhanced Response

Rapid Response

Azure Event Management

O365 Engineering Direct

Developer Support

Service P a n

GitHub Engineering Direct

Support for Mission Critical

Cybersecurity Support Services

U.S. Citizen Program

Secured Delivery Management

- Additional service that may be purchased.

1 - Additional service that may be purchased up to a limited maximum quantity.

Enhanced Designated Engineering Enhanced Designated Engineering (EDE): A custom service that provides a deep and ongoing technical engagement for customers with complex scenarios. This offering is scoped to match the customer’s needs and outcomes by providing a designated engineer who will build a deep knowledge of the customer’s environment or solution and support customer business goals including, but not limited to, workload optimization, adoption or supportability. EDE services may be purchased as pre-defined offerings or as a block of custom hours that can be used to deliver scoped proactive services.

When purchased as hours, EDE service hours are then deducted from your total purchased hours as they are utilized and delivered.

Pre-defined EDE offerings are tailored to your environment and help you achieve a desired outcome. These offerings include the required pre-defined proactive services built in.

The focus areas for EDE services:

• Help maintain a deep knowledge of your current and future business requirements and configuration of your information technology environment to optimize performance

• Document and share with you recommendations of the use of support services–related deliverables (e.g. supportability reviews, health checks, workshops, and risk-assessment programs)

• Help make your deployment and operation activities consistent with your planned and current implementations of Microsoft technologies

• Enhance your IT staff’s technical and operational skills

• Develop and implement strategies to help prevent future incidents and increase system availability of your covered Microsoft technologies

• Help determine the root cause of recurring incidents and to provide recommendations to prevent further disruptions in the designated Microsoft technologies

Regardless of how EDE is purchased, resources are allocated, prioritized and assigned based on the agreement of the parties during the initiation meeting and documented as part of your service delivery planning.

Service-specific prerequisites and limitations

• You must have a current Microsoft Unified Support services agreement to support your EDE services.

If your Microsoft Unified Support services agreement expires or is terminated, your DSE service will be terminated on the same date.

• EDE services are available during normal business hours (09:00 to 17:30 Local Standard Time, excluding holidays and weekends).

• EDE services support the specific Microsoft products and technologies selected by you and listed in this Services Description or its schedules or exhibits.

• EDE services are delivered to a single support location in the designated support location identified in this Services Description or its schedules or exhibits. Unified Enhanced Response

• EDE services are delivered remotely unless as agreed in advance in writing. Where onsite visits are mutually agreed upon and not pre-paid, travel and expenses incurred by Microsoft will be in accordance with U.S. Government travel regulations.

Enhanced Designated Engineering – Cleared (EDE-CL): As Enhanced Designated Engineering above.

This service will be delivered using Cleared Resources. Cleared Resources may not be available for all technologies.

Unified Enhanced Response Unified Enhanced Response: Unified Enhanced Response (UER) provides accelerated reactive support for your products and cloud services with faster routing for all critical situation incidents (‘crit sits’) and assigning resources from the Enhanced Incident Management team designated to you for enhanced reactive incident management.

Customers may purchase Unified Enhanced Response in addition to their Unified Enterprise base support agreement or add it at any point in the term of an active Unified Enterprise base support agreement.

To receive UER support for your Microsoft products and cloud services, you must submit an incident by phone or via web. If opened at Severity 1 or Severity A, your Problem Resolution Support requests will automatically be routed with the enhanced response time and your Senior Incident Manager team will be automatically assigned for incident management.

Enhanced Incident Management: The Enhanced Incident Management service is available 24x7x365 for all Severity 1 or Severity A Problem Resolution Support request. Customers are assigned a designated pool of resources with knowledge of customer business goals and environment. These resources are assigned in addition to the technical resolution resources and are responsible for oversight of all critical situation support incidents to drive timely resolution and a high quality of support delivery. The Enhanced Incident

Management team resources designated to the customer can be reached directly via email 24-7 and will ensure continued technical progress by providing you with status and escalation updates and an action plan.

For any Severity 1 incident, a member of the Enhanced Incident Management team will also provide a post-incident review with the customer, Customer Success Account Manager and other members of your account team with the goal of strengthening your business and prevent future outages and issues. During the meeting, the Enhanced Incident Management team member will provide an overview of incident response, including successes and areas for improvement, and work with your Customer Success Account Manager (CSAM) on recommendations for remediation, to proactively reduce future cases and strengthen your solutions.

A member of the Enhanced Incident Management team will inform you during the incident if a Root Cause Analysis (RCA) is also available for the impacted Microsoft technology, if an additional charge will be incurred by performing the RCA and will work with your CSAM to initiate an RCA if available and explicitly requested by the customer prior to incident close.

You will be responsible for working with the Microsoft team to provide materials such as log files, network traces, or other diagnostic output needed to complete the RCA.

For your Enhanced Incident Management team to have basic knowledge of your goals and environment, you must provide documentation if requested and participate in onboarding activities during the first 60 days of the contract term.

These resources will operate remotely. The Enhanced Incident Management service is delivered in English.. No Enhanced Incident Management service delivery by region restricted, citizenship required or cleared delivery resources is possible in this offer.

UER’s reactive services help resolve issues in your Microsoft environment and are typically consumed on demand. The reactive services provided are included as-needed for currently supported Microsoft products and online services, unless otherwise noted in this Services Description or its schedules or exhibits. All reactive support is delivered remotely. In addition to the as-needed reactive services, a set quantity of hours for Reactive Support Management and Service Delivery Management are included for your Enhanced Incident Management team and CSAM to use to deliver for onboarding activities, quarterly meetings with your Enhanced Incident Management team and Sev 1 post-incident reviews.

Additional or more frequent meetings are available by request and with prior Microsoft agreement where resourcing available. If you elect to purchase additional hours beyond those included to provide additional Reactive Support Management and Service Delivery Management by your Enhanced Incident Management team and Customer Success Account Manager.

Unified Enhanced Response Severity and situation

Our expected response

Your expected response

Severity 1

Critical business system down:

Business at risk.

Complete loss of a critical application or solution.

Needs immediate attention

Azure components1

- First call response in 15 minutes or less

All other products and services – First call response in 30 minutes or less

Senior Incident Manager2 automatically assigned

Continuous effort on a 24/7 basis3

Rapid escalation within Microsoft to product teams

Notification of our senior executives, as required

Notification of your senior executives, as requested by us

Allocation of appropriate resources to sustain continuous effort on a 24/7 basis3

Rapid access and response

Submission via phone or web

Severity A

Critical business system degraded:

Significant loss or degradation of services

Needs attention within 30 minutes

First call response in 30 minutes or less

Senior Incident Manager automatically2 assigned

Continuous effort on a 24/7 basis2

Allocation of appropriate resources to sustain continuous effort on a 24/7 basis3

Rapid access and response

1 The listed response time for your Azure components does not cover, US Gov Clouds Azure StorSimple, GitHub AE, Azure Communication Services or Billing & Subscription Management, A40, Azure Media Services, Azure Stack, Test Base for M365, Microsoft Mesh or Universal Print.

2 Enhanced Incident Management recourses help drive for prompt issue resolution through case engagement, escalation, resourcing, and coordination.

3 We may need to downgrade the severity level if you are not able to provide adequate resources or responses to enable us to continue with problem resolution efforts.

Rapid Response Rapid Response: Rapid Response provides accelerated reactive support for your cloud services by routing support incidents to technical experts and providing an escalation path to cloud service operations teams, as required.

To receive Rapid Response services for your Microsoft Azure components you must submit an incident through the applicable cloud service portal. Your Problem Resolution Support requests will be directly routed to a Rapid Response support queue which is staffed by a designated team of engineers with cloud service expertise. For this team to have basic knowledge of your deployment, you must provide documentation on basic Azure deployment and database topology, as well as scaling and load balancing plans where available. While incidents may require resources from standard product support professionals for resolution, the Rapid Response team retains primary responsibility for the incidents 24x7x365.

For your Azure components, the response times for problem resolution support are listed in the table below and supersede any expected Base Package support response times.

Rapid Response does not cover Azure Media Services, Azure Stack, Azure StorSimple, GitHub AE, Azure Communication Services, Universal Print, Test base for M365, or Microsoft Mesh.

Rapid Response purchase is subject to resource availability. Please consult your customer success account manager for availability details.

Rapid Response Severity and situation

Our expected response

Your expected response

Severity 1

Critical business system down:

Business at risk.

Complete loss of a critical application or solution

Loss of a core business process and work cannot

First call response in 15 minutes or less

Continuous effort on a 24x7 basis1

Access to Microsoft’s experienced specialists2

Notification of your senior executives, as requested by us

Allocation of appropriate resources to sustain

Rapid Response situation

Our expected response

Your expected response reasonably continue

Needs attention within 15 minutes

Rapid escalation within Microsoft to cloud service operations teams

Notification of our senior executives, as required continuous effort on a 24x7 basis1

Rapid access and response

Severity A

Critical business system degraded:

Significant loss or degradation of services

1 We may need to downgrade from 24x7 if you are not able to provide adequate resources or responses to enable Microsoft to continue with problem resolution efforts.

2 Rapid Response Problem Resolution Support services are only available in English.

Azure Event Management Microsoft Azure Event Management (“AEM”): AEM provides enhanced proactive and reactive support during customers’ critical business events.

An in-scope critical business event supported by this offer is defined as a brief, customer-anticipated period of high business impact and/or peak demand for the customer, requiring higher levels of service availability and performance. Critical business events may receive up to five (5) calendar days of consecutive reactive coverage; customers may choose to purchase as many critical business events as required to run consecutively and cover the entire duration of the anticipated demand if longer than five

(5) consecutive calendar days.

Azure Event Management is subject to resource availability, please consult your customer success account manager for availability details. Support will not be delivered except for critical business events that have been scheduled in advance and confirmed in writing at least 8 calendar weeks before the start of the event unless Microsoft agrees. Microsoft may at its discretion reduce the scope of the pre-event assessment, if it chooses to accept an event with less notice.

AEM supports critical business events that utilize core Microsoft Azure services. Each event covers a single Azure solution, if multiple Azure solutions require support then a customer must purchase additional events. An Azure solution is defined as a set of Azure subscriptions and Azure resources that connect to a common business outcome to provide customers with products or services. Microsoft will evaluate the customer’s solution during the pre-event assessment period and communicate identified risks in writing to the customer.

As part of the pre-event activities, the Microsoft will:

• Assess and familiarize itself with your solution.

• Identify possible issues and risks affecting uptime and stability

• Perform capacity and resiliency reviews on Azure platform

Microsoft will provide written documentation of the results of its assessment including actions to mitigate possible risks affecting uptime and stability.

For Azure cloud solutions, during the event, incident service requests related to the event should be raised through the Microsoft Azure portal including AEM in the case description.

Severity and situation Our expected response Your expected response

Severity 1

Critical business system down:

Business at risk.

Complete loss of a critical application or solution

Loss of a core business process and work cannot reasonably continue

Needs attention within 15 minutes

First call response in 15 minutes or less and rapid escalation within

Critical situation resource assigned in 30 minutes or less.

Continuous effort on a 24x7 basis1

Access to Microsoft experienced specialists and rapid escalation within Microsoft to product teams

Engagement of support engineers who have knowledge of your solution configuration.

Where applicable, those engineers may assist and streamline the incident management process

Notification of your senior executives, as requested by us

Allocation of appropriate resources to sustain continuous effort on a 24x7 basis1

Rapid access and response

Severity A

Critical business system degraded:

Significant loss or degradation of services

Severity and situation Our expected response Your expected response

Notification of our senior executives, as required

1 Microsoft may need to downgrade from 24 x 7 if you are not able to provide adequate resources or responses to help us to continue with problem resolution effort.

2 AEM Problem Resolution Support services are only available in English

Microsoft will provide a post-event summary of any cases opened during the reactive support window and ensure these cases are resolved.

For Azure products:

Severity and situation

Our expected response

Your expected response

Severity 1

Critical business system down:

Business at risk. Complete loss of a critical application or solution

Loss of a core business process and work cannot reasonably continue

Needs attention within 15 minutes

First call response in 15 minutes or less and rapid escalation within Microsoft2

Critical situation resource assigned in 30 minutes or less.

Continuous effort on a 24x7 basis1

Access to Microsoft experienced specialists and rapid escalation within Microsoft to product teams

Engagement of support engineers who have knowledge of your solution configuration.

Where applicable, those engineers may assist and streamline the

Notification of your senior executives, as requested by us

Allocation of appropriate resources to sustain continuous effort on a 24x7 basis1

Rapid access and response

Severity A

Critical business system degraded:

Significant loss or degradation of services incident management process

Notification of our senior executives, as required

1 Microsoft may need to downgrade from 24 x 7 if you are not able to provide adequate resources or responses to help us to continue with problem resolution effort.

2 AEM Problem Resolution Support services are only available in English

For all other products, incident responses will align to the following:

situation

Our expected response

Your expected response

Severity 1

Critical business system down:

Business at risk.

Complete loss of a critical application or solution.

Needs immediate attention

Azure components1 - First call response in 15 minutes or less

All other products and services – First call response in one hour or less

Critical situation resource2 assigned

Continuous effort on a 24/7 basis3

Rapid escalation within

Microsoft to product teams

Notification of our senior executives, as required

Notification of your senior executives, as requested by us

Allocation of appropriate resources to sustain…