Skip to content

Security

Microsoft Secure Score Series – 06 – Enable policy to block legacy authentication

Today, most compromising sign-in attempts come from legacy authentication. Older office clients such as Office 2010 don’t support modern authentication and use legacy protocols such as IMAP, SMTP, and POP3. Legacy authentication does not support multi-factor authentication (MFA). Even if an MFA policy is configured in your environment, bad actors can bypass these enforcements through legacy protocols. In this blog post, we take a look at legacy authentication and how to block it on your tenant. Legacy protocols are not… 

Read More »Microsoft Secure Score Series – 06 – Enable policy to block legacy authentication

Microsoft Secure Score Series – 05 – Enable self-service password reset

With self-service password reset in Azure AD, users no longer need to engage helpdesk to reset passwords. This feature works well with Azure AD dynamically banned passwords, which prevents easily guessable passwords from being used. In this blog post, we are going to take a look at Self Service Password Reset in Azure AD. Self Service Password Reset allows your users to quickly unblock their account without the help of IT staff or helpdesk. For readability, I use SSPR for… 

Read More »Microsoft Secure Score Series – 05 – Enable self-service password reset

Microsoft Secure Score Series – 04 – Ensure all users can complete multi-factor authentication for secure access

Multi-factor authentication (MFA) helps protect devices and data that are accessible to these users. Adding more authentication methods, such as the Microsoft Authenticator app or a phone number, increases the level of protection if one factor is compromised. In this blog post, we take a look at the different ways to make sure that your users can register for multi-factor authentication. Enabling Multi-Factor Authentication is a no-brainer giving the fact that your identity is your key to almost all your… 

Read More »Microsoft Secure Score Series – 04 – Ensure all users can complete multi-factor authentication for secure access

Microsoft Secure Score Series – 03 – Enable Password Hash Sync if hybrid

Password hash synchronization is one of the sign-in methods used to accomplish a hybrid identity. Azure AD Connect synchronizes a hash, of the hash, of the user’s password from an on-premises Active Directory instance to a cloud-based Azure AD instance. Password hash synchronization helps by reducing the number of passwords your users need to maintain to just one. Enabling password hash synchronization also allows for leaked credential reporting. In this blog post, we are going to take a look at… 

Read More »Microsoft Secure Score Series – 03 – Enable Password Hash Sync if hybrid

How to publish on-premises applications and protect them with MFA

Using Azure Application Proxy you can publish your on-premises web applications in a secure way. Combining this with Conditional Access, you can configure MFA for example. Now Coronavirus is hitting us hard, you might have to take a look at this feature. Assume the following use case: you have Citrix or RDS available for 50% of your users, so they can work from home or elsewhere. Now, because of the Coronavirus (or any future disaster), all of your employees have… 

Read More »How to publish on-premises applications and protect them with MFA

Microsoft Secure Score Series – 02 – Require MFA for administrative roles

Require MFA for administrative roles Requiring multi-factor authentication (MFA) for all administrative roles makes it harder for attackers to access accounts. Administrative roles have higher permissions than typical users. If any of those accounts are compromised, critical devices and data is open to attack. In this post, we take a look at enabling MFA for your administrators. As stated in the description, users with administrative roles are interesting targets for hackers. Of course, it is recommended to enable MFA for… 

Read More »Microsoft Secure Score Series – 02 – Require MFA for administrative roles

Get started with web content filtering in MDATP

Update 7-7-2020: Microsoft anounced that you no longer need a Cyren subscription. Web content filtering will be offered as part of Microsoft Defender ATP without any additional partner licensing. Now you get the benefits of web content filtering without the need for additional agents, hardware, and costs.   From the article: If you joined in on the public preview, you might be in one of the following scenarios:  If your 60-day trial for the partner license has already expired, all your policies are now active and protecting your enterprise.   If you have an active 60-day trial for a partner license, all your policies will… 

Read More »Get started with web content filtering in MDATP

Require trusted location for MFA and SSPR registration

This article shows how you can block MFA and SSPR registrations from untrusted locations using Azure AD Conditional Acces. When you want to enable MultiFactor Authentication and Self Service Password Reset for your users, they need to register their security settings first. Since the combined portal arrived, users can do this easily in just one place. Using this combined portal is also a requirement in order to make this possible. Although this portal is still in preview, it has great… 

Read More »Require trusted location for MFA and SSPR registration

Secure your Azure Management portal

Today a quick tip to secure your Azure Management Portal. By default, the inactivity timeout of the Azure Management portal is set to ‘Never’. From a security perspective, this is far from ideal. This small setting can be easily overlooked. It’s a good idea to configure this for your tenant. Administrators can set this value themselves. Global administrators are able to set this value globally. When configuring this setting, your administrators will be logged out when they are inactive for… 

Read More »Secure your Azure Management portal