Azure AD

Close the gap. Azure AD Identity Protection & Conditional Access.

July 14, 2020February 15, 2021
4 Comments
Azure AD, Security
8 min read

This blog is about Azure AD Identity Protection and Conditional Access, and how these two features are working together. This is not my first article on this subject. (neither my last) In previous blogs, I covered the sign-in risk and user risk policies as part of the Secure Score Series, and in my blog, about Azure Multifactor Authentication I talked about Azure AD Identity Protection, and how it can be used to roll out MFA in your organization. Microsoft released…

Use Power Automate as your Conditional Access Police Department

July 4, 2020July 5, 2020
2 Comments
Azure AD, Logic Apps, Power Platform, Security
7 min read

Last week, I was working on a new blog for the Secure Score Series regarding global admin and break glass accounts. I came to the point where I was thinking of possible scenarios that could go wrong with these accounts. What if someone accidentally added these users to a certain group? What if that group would be triggered in some policy or maintenance tasks? A lot of these actions can be discovered using Microsoft Cloud App Security and Azure Monitor.…

Microsoft Secure Score Series – 14 – Designate more than one global admin

July 3, 2020July 4, 2020
1 Comment
Azure AD, Secure Score, Security
5 min read

Designate more than one global admin Having more than one global administrator helps if you are unable to fulfill the needs or obligations of your organization. It’s important to have a delegate or an emergency account someone from your team can access if necessary. It also allows admins the ability to monitor each other for signs of a breach. Having too many global admins is no good. But having only one global admin is even worse. Let’s talk about global…

Use Power Automate or Logic Apps to keep an eye on your licenses

June 27, 2020July 25, 2020
36 Comments
Azure AD, Logic Apps, Power Platform
9 min read

I guess we’ve all been there; you ran out of licenses in your Azure AD or Office 365 tenant. Despite you hang out in your admin portal every day, you were still taken by surprise when you discover an issue, caused by a license shortage. More often this is caused by the fact that the people who are responsible to buy these licenses, are not always IT admins. So it’s easy to run out of licenses. Time to get this…

A first look at Administrative Units and My Staff in Azure Active Directory

June 20, 2020June 20, 2020
3 Comments
Azure AD, Security
11 min read

Recently, Microsoft introduced Administrative Units in Azure Active Directory. At the time of writing, this feature is in preview. Today we take a first look at how this is going to help organizations managing users and groups in Azure Active Directory. But to understand why this feature is such a big deal, we need to know what the difference is between the “classic” Active Directory and the “modern” Azure Active Directory structure. Active Directory To illustrate this, I created a…

Microsoft Secure Score Series – 12 – Turn on customer lockbox feature

June 14, 2020June 14, 2020
Azure AD, Secure Score, Security
5 min read

Turning on the customer lockbox feature requires that approval is obtained for data center operations that grants a Microsoft employee direct access to your content. Access may be needed by Microsoft support engineers if an issue arises. There’s an expiration time on the request and content access is removed after the support engineer has fixed the issue. Today we are going to talk about the Customer Lockbox feature in Office 365. Some privacy regulations like HIPAA and FEDRAMP require procedures…

Microsoft Secure Score Series – 11 – Turn on user risk policy

June 8, 2020June 23, 2020
2 Comments
Azure AD, Secure Score, Security
5 min read

With the user risk policy turned on, Azure AD detects the probability that a user account has been compromised. As an administrator, you can configure a user risk conditional access policy to automatically respond to a specific user risk level. For example, you can block access to your resources or require a password change to get a user account back into a clean state. Today, we take a look at Azure AD Identity Protection. More specifically, the ability to take…

Microsoft Secure Score Series – 10 – Discover trends in shadow IT application usage

June 6, 2020June 7, 2020
5 Comments
Azure AD, Secure Score, Security
9 min read

Add a data source in automatic log upload for Cloud App Security Discovery to identify applications in your organization that run without official approval. After configuration, Cloud App Security Discovery will analyze firewall traffic logs to provide visibility into cloud applications’ usage and security posture. Today, we take a look at Cloud Discovery. With Cloud Discovery you can analyze your firewall and proxies log files, to track down shadow IT and determine the risk that is coming with the use…

Microsoft Secure Score Series – 09 – Do not allow users to grant consent to unmanaged applications

May 30, 2020October 8, 2020
Azure AD, Secure Score, Security
5 min read

Tighten the security of your services by regulating the access of third-party integrated apps. Only allow access to necessary apps that support robust security controls. Third-party applications are not created by Microsoft, so there is a possibility they could be used for malicious purposes like exfiltrating data from your tenancy. Attackers can maintain persistent access to your services through these integrated apps, without relying on compromised accounts. Today we take a look at a serious problem in the modern IT…

Sure, keep me signed in! And don’t prompt for MFA!

May 22, 2020May 22, 2020
1 Comment
Azure AD, Security
5 min read

Today a short blog about MFA prompts, session lifetime, and cookies. This will give you an idea of how you can tune the end-user experience and where to configure these settings. Session lifetime in Azure AD is often mistaken. When you start working with Azure AD, Conditional Access, and Multi-factor authentication, there are a couple of things you should know. The Azure AD defaults are pretty loose. When you leave every setting to default, the user experience is pretty good.…