In my previous blog post, I wrote about the new Teams activity policy templates in Cloud App Security. A great addition to easily keep an eye on your teams. Let’s take a short look a the policies before we continue. The policies will create alerts when: a team’s access level is changed from private to public an external user is added to a team a user deletes a large number of teams These templates are easy to use, and will…
The usage of Teams is massively increased over the past weeks. The numbers of people using Teams nowadays are insane. Organizations rapidly enrolled Teams to their users. But what about security? Time to take a look at security and governance. But where do you start? In my opinion, Microsoft Cloud App Security gives you the best insights on where to focus. Using the MCAS activity log you can study the users’ behavior. What is happening? What files are downloaded? What…
Update! I got some feedback on this blog. Seems that if your users are not members of the local administrator group, install will faill with error: 0x80070001. I’ve updated the article to solve this problem. I replaced the cmd files for Powershell scripts and did some minor changes to the detection and uninstall scripts. This should now work for users without admin permissions. Microsoft introduced background effects in Teams. All of a sudden you see people having their custom backgrounds.…
Turning on the sign-in risk policy ensures that suspicious sign-ins are challenged for multi-factor authentication. Azure AD Identity Protection is powerful in many ways. As discussed in my previous post about Multi-factor Authentication, you can use IdP to onboard your user for MFA. Once you’ve had all your users registered, it’s time to tighten your security by prompting for MFA when a sign-in is risky. This improvement action wants you to turn on the sign-in risk policy in Azure Identity…
Today, most compromising sign-in attempts come from legacy authentication. Older office clients such as Office 2010 don’t support modern authentication and use legacy protocols such as IMAP, SMTP, and POP3. Legacy authentication does not support multi-factor authentication (MFA). Even if an MFA policy is configured in your environment, bad actors can bypass these enforcements through legacy protocols. In this blog post, we take a look at legacy authentication and how to block it on your tenant. Legacy protocols are not…
Azure AD Dynamic Groups Dynamic groups in Azure AD are awesome. I use them a lot. Dynamic groups can create groups based on attributes. For example, you can create a group that includes all the users from the Sales Team. The query for the group would look like this: If a new user comes along with the same attribute, the user will automatically be added to this group. This can be really helpful for onboarding. You can pick a lot…
With self-service password reset in Azure AD, users no longer need to engage helpdesk to reset passwords. This feature works well with Azure AD dynamically banned passwords, which prevents easily guessable passwords from being used. In this blog post, we are going to take a look at Self Service Password Reset in Azure AD. Self Service Password Reset allows your users to quickly unblock their account without the help of IT staff or helpdesk. For readability, I use SSPR for…
Multi-factor authentication (MFA) helps protect devices and data that are accessible to these users. Adding more authentication methods, such as the Microsoft Authenticator app or a phone number, increases the level of protection if one factor is compromised. In this blog post, we take a look at the different ways to make sure that your users can register for multi-factor authentication. Enabling Multi-Factor Authentication is a no-brainer giving the fact that your identity is your key to almost all your…
Password hash synchronization is one of the sign-in methods used to accomplish a hybrid identity. Azure AD Connect synchronizes a hash, of the hash, of the user’s password from an on-premises Active Directory instance to a cloud-based Azure AD instance. Password hash synchronization helps by reducing the number of passwords your users need to maintain to just one. Enabling password hash synchronization also allows for leaked credential reporting. In this blog post, we are going to take a look at…
Using Azure Application Proxy you can publish your on-premises web applications in a secure way. Combining this with Conditional Access, you can configure MFA for example. Now Coronavirus is hitting us hard, you might have to take a look at this feature. Assume the following use case: you have Citrix or RDS available for 50% of your users, so they can work from home or elsewhere. Now, because of the Coronavirus (or any future disaster), all of your employees have…