Keep calm and Twitter

Generally, the cloud is pretty reliable. However, it is not perfect and there will be downtimes and outages. Just because you move your information to the cloud doesn’t mean that you abdicate your responsibilities for it. Disaster planning is as important in the cloud as it is on prem.

image

The first place to start if you are having issues with what you believe to be related to Microsoft 365 is the Microsoft 365 Service Health page shown above, which can be found at:

https://portal.office.com/adminportal/home#/servicehealth

Of course, if you are unable to access your tenant for any reason, then you’ll have to try another resource.

image

Your next point of call should be the Office 365 status page here and shown above:

https://status.office365.com/

This is fairly generic and also just links back to the Service Health in your own portal. However there maybe information here around any wider scale issues so it is always worthwhile checking.

image

Next, you should follow the @MSFT365Status Twitter account as shown above. Here you’ll find information posted that is on infrastructure outside Microsoft’s. You can also communicate with this account if you need to.

image

You can also find an Azure Status page at:

https://status.azure.com/en-us/status

Given that many Microsoft 365 services are built on Azure, it is another area that may give you some insight.

image

There is also an Azure support Twitter account @azuresupport that will post information concerning issues and something you can also interact with if you need to.

There are also numerous third party services that will track whether a web site active.

Finally, a good approach is also to do a search across Twitter to see whether others are also having similar issues. People tend to be pretty vocal on social media when they are inconvenienced, so that should a source of both good and bad information.

As Noah knows, you prepare for the flood BEFORE it rains. In the event of cloud issues, how will you know the extent of the issues and where will you get good information? For me, that source has typically been Twitter as the major source. You do have to filter those results a tad to get helpful information there, but that is the nature of social media.

In short, you need a plan. Take my advice and start monitoring Twitter to get a better idea of what might be happening beyond your own screen.

Another great security add on for Microsoft 365

Previously, I have spoken about Cloud App Security being a ‘must have’ add on for any Microsoft 365 environment:

A great security add on for Microsoft 365

I now believe that the next ‘must have’ security add on you should integrate with your tenant is Azure Sentinel.

image

In a nutshell, Azure Sentinel will allow you to monitor, alert and report on you all you logs from just about any location, whether on prem or in the cloud.

image

Once you have created the Sentinel service and assigned it a log workspace, the first place to go is to the Connectors option as shown above.

Here you can connect up your services. There is a huge range of options from Office 365, Azure, on prem and third parties like AWS, At a minimum I would suggest you connect up your Azure and Office 365 services.

image

Next, go to the Analytics option, then select Rule templates from those available. These rules are basically queries across your data sources from your connectors. Add in the rules that make the most sense for your environment.

image

As you create these rules you be stepped through a wizard as shown above.

image

The Set rule logic step allows you to define the rule based on the data being received. You will notice there are lots of options. The great thing about using the templates is that this is already done for you but you can certainly modify these or create your own.

image

The real power of Azure Sentinel lies in the Automated response step shown above. Here you define what actions will be taken when a alert is generated by the rule. This means that you can have something automatically execute when an alert happen. This could be a remediation process, advanced alerting and more. This allows the response action to threat to be immediate and customisable.

image

Next, go into the Workbook options as shown and then the Templates area and add all the options that make sense.

image

A workbook is basically an interactive dashboard where you can graphically query and report on data as shown above.

image

When rules are triggered they will appear as Incidents that you investigate as shown above.

image

You’ll be able to explore incidents in greater depth using the graphical explorer as shown above.

image

Good security is about being pro-active and Azure Sentinel gives you this via the Hunting option as shown above. This allows you to run standard queries against the data to discover items that may need further investigation and analysis. Note the option highlighted here that allows you to Run all queries at the touch of button. This is yet another hugely powerful option as you can now ‘hunt’ across all your information so quickly. Show me another tool that can do this for both cloud and on prem?

image

There are lots more features, but by now you are probably wondering what the costs are? As you can see from above, they are based on storage and you can reserve a storage size to suit your needs. However, you can also opt, as I have, for a pay as you go option.

image

This means the Azure Sentinel cost to analyse all my data is AUD$3.99 per GB of data and

image

on the pay as you go plan I also need to factor in data ingestion, which is shown above in AUD$. Note that you get 5GB of data ingestion free per month. After that, I’d be paying AUD$4.586 per GB.

image

As you can see from the above usage figures I am no where near the 5GB ingestion limit, so all I am currently paying for just Azure Sentinel analysis.

The amount of data you ingest and analyse will depend on the services you connect and well as things like data retention periods. All of these can be adjusted to suit your needs. There are also many other Azure pricing tools you can use to control your spend. However, if you are concerned about running up an excessive bill, just connect and few services and scale from there.

In my case, I have logs from Microsoft 365 Cloud services, Azure, on premises machine monitoring, Defender ATP and more all going into Sentinel. Basically, everything I can, is going in there and the costs remain low.

I have always maintained that when you sell Microsoft 365, you should also sell an Azure subscription:

Deploy Office 365 and Azure together

Azure Sentinel is yet further confirmation that you should be doing this to add greater functionality and security to your environment. I will be spending more time deep diving into Azure Sentinel so make sure you stay tuned.

Allowing extensions with Edge Baseline

image

One of the handy things that Microsoft has now enabled is the ability to control the modern Edge browser (i.e. the one based on Chromium) via policy and services like Intune. In fact, if you visit Intune and look for Security Baseline you’ll find a new Microsoft Edge Baseline policy as shown above.

image

There are lots of great settings you can enforce by using this baseline to create a policy as you can see above.

I enabled the policy without making any changes initially so I could determine the impact, if any. It turns out that the default baseline actually disables any and all existing browser extensions you may have and also prevents you from adding new extensions.

I understand that this approach makes your environment more secure but I really can’t live with both the Lastpass and GetPocket extensions.

image

Unfortunately, by default with the baseline policy, these got blocked as you see above. This meant that I needed to adjust the policy.

image

As it turned out, you need to set the option:

Control which extensions can be installed = Not Configured

Just disabling and removing other options didn’t seem to do the trick.

image

After making that change and forcing the updated policy to sync to the workstation, I was back in business as you see above. I didn’t need to do anything in the browser, the previously disabled extensions were re-enabled automatically.

Enabling extensions is the only change I have made to the default baseline policy so far and now everything is working as expected and is more secure which I like.

I’d like the option to select ‘approved’ extensions so the baseline policy could be applied in total. Hopefully, that feature will make an appearance in the policy soon as I thing many will want it. However, this is quick and easy way to lock down the new Edge browser and another reason that, like me, it is my primary browser.

Need to Know podcast–Episode 219

We are just past Halloween and it’s time for something that seems to scare most people who administer Microsoft 365. PowerShell. However, to hold your hand while we dive deep we one of the best in business – Elliot Munro from GCITS – to guide you. Also, Brenton and I bring you all the latest news from the fire hose of Microsoft Ignite 2019, so much so that we’ll have more next time. Holey moley, there lots in the episode, so lean back, listen in an enjoy.

This episode was recorded using Microsoft Teams and produced with Camtasia 2019

Take a listen and let us know what you think – feedback@needtoknow.cloud

You can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-219-elliot-munro/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.

Resources

Elliot Munro

@contactbrenton

@directorcia

Introducing the new Edge and Bing

Microsoft 365 Productivity score

New Office Mobile App

Microsoft Fluid Framework

Introducing Microsoft 365 Business voice to UK and Canada

What’s new in Microsoft Teams from Ignite

Microsoft Endpoint Manager vision

The future of Yammer

Empower your people with Project Cortex

Check off your To-Do tasks in Teams

Security and Compliance announcements from Ignite

Their sacrifice shall live on

We pause today to remember all of those who gave their lives in war. Soldiers, sailors, airmen, civilians and more. We pause to remember lives cut short. Today, at 11am on the 11th of November is the anniversary of end of World War One in 1918. An anniversary of the first conflict where war truly became industrialised. Where weapons more than men had the advantage on the battlefield and a few could now kill so many thanks to the power of modern weapons.

The Australian landings at Gallipoli in 1915 are largely credited with giving ‘birth’ to Australia as a nation. They marked the beginning of a commitment of 313,814 Australians to the war of which around 53,000 died in France and Belgium alone. 152,171 were also wounded in this theatre as well, so the impacts on a young nation were marked.

It is not only the past the we remember today, it is also the ongoing service of those that protect us today. Not just soldier, sailor and airmen but emergency workers and more. Their service, like their forbearers, stands as a shining beacon of what can be achieved with the service to others. We don’t honour the methods or the reasons, we honour those that chose to serve. Those that put themselves in harms way for others. Those who were asked to perform a duty for others and did so without question, with many paying the ultimate price.

This is why we remember them. This is why we today pause and say:

Lest We Forget

for there would be nothing more tragic or disrespectful than to neglect to say ‘thank you’ to those that made our world a better place to be and gave us the opportunity to enjoy it. If nothing else, we owe them that. So today, take a moment to pause, reflect, say thank you and hopefully ask how you can make the world a better place in some small way as a way of honouring those who did not return because, sadly, there are still those suffering.

For more information on the Australian battlefields of World War One wish my website www.anzacsinfrance.com.

Governance is always important

white-paper-with-note-669986

There are many times I’m called in to help people design their Microsoft 365 compliance environment. In other words, help with SharePoint, Teams, etc. I generally use my trusty framework that I have spoken about here before:

A framework for file migrations to Microsoft 365

Most of the time I find that people have already ‘given it a go’ themselves but generally ‘mucked it up’ and that’s the reason I’m now there.

I have no issues if someone has in fact ‘mucked it up’ because at least they have tried and it is generally easy to rectify. What I do seriously wonder about is the response to the first question I ask them – ‘Why did you do it that way?’.

The answer to this question I receive is generally a blank stare or silence, even a shoulder shrug. I point out that this is largely why things has been ‘mucked up’ in the first place,  because there was no governance.

In short, what I really want to see with collaboration in Microsoft 365 is the fact that thought has been invested beforehand. Why? Simple. A collaboration system in Microsoft 365 is something you build, not something you buy or magically appears. Microsoft 365 gives you the tools to create the best system, in the world for you. Tailored exactly to your business. Uniquely flexible for your business. Able to adapt to your needs, unlike any off the shelf system. However, it can never achieve that if it doesn’t know who you are what you want. You have to tell it (via governance) what you want it to be. In short, it is clay that you need to mould and governance tells you the shape into which you want to mould it.

Like any good project, the secret is to stop and think before acting. Planning before diving in makes a world of difference to the outcome. But most importantly, write down what you want to achieve! The one common thing about EVERY ‘mucked up’ Microsoft 365 collaboration project I see is simply the lack of documentation prior to commencement.

This documentation doesn’t have to be complex or involved and should be at the very minimum a single page that defines the ‘need’ for a collaboration system. What business pain point does it need to solve? What are the expected benefits? Why will it be used? Think of this document like a specification for the project, the plans if you like. You’d never build a house without foundations and plumbing before you put the walls up now would you? A plan helps make sure that you know what the desired outcome is, helps you understand how to get there and how avoid problems along the way. Without that, you are building something effectively blindfolded.

That one page governance document should hopefully be born before the Microsoft 365 collaboration project even starts. However it is by no means a static document. It is a living breathing entity. It should be added to, edited, enhanced, expanded constantly. But above all else, it should become the single point of truth for why we have this thing. Having such a document is both a guide and a reference. As you move through the various stages of development, which occur over a period of time, you can reference this document and understand the reasons for doing things the way you did. As the system grows it again becomes the reasons for what you are looking to achieve and how you approached that. If you don’t already have a governance document for your Microsoft 365 collaboration environment, then now is always the best time to start one.

The importance of this is that at some stage, maybe, the people initially charged to build the collaboration system move on or there is a decision to out source or change builders. If you have a document that sets out your manifesto for the Microsoft 365collaboration system it is so much easier for everyone involved. Everyone is on the same page and knows where to go to get answers if needed. That’s what I want to see if I become involved as a ‘collaboration consultant’. It means I can quickly understand what you want Microsoft 365 to achieve for your business. It is the platform on which your future solution is built. Remember, collaboration in Microsoft 365 is not a product you buy it is a solution you build.

Sadly, even the most generally organised business overlooks the need to have governance in any Microsoft 365 collaboration system. Governance at the very least should be everyone’s understanding of what is project is and what the aim is. The best way to achieve that, is to write it down beforehand! Without it then, there is no a single reference point that be used to guide the outcome and things unsurprisingly get ‘mucked up’.

As they say – ‘failing to plan, is planning to fail’. Governance is important for Microsoft 365 collaboration, if for nothing else because it is succeeding through planning!

CIAOPS Need to Know Microsoft 365 Webinar–November

laptop-eyes-technology-computer

We are expecting a big month in November with news from the Microsoft Ignite event. I’ll do my best to provide you a summary of all the important announcements before we dive deep into all the automation options that are available in Microsoft 365. You’ll actually be surprised at how many there are! There will also be the opportunity to ask questions on your burning Microsoft 365 and Microsoft Cloud topics. You won’t want to miss this month!

You can register for the regular monthly webinar here:

November Webinar Registrations

The details are:

CIAOPS Need to Know Webinar – November 2019
Thursday 28th of November  2019
10.30am – 11.30am Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

http://www.ciaopspatron.com

or purchase them individually at:

http://www.ciaopsacademy.com/

Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session and I look forward to seeing you there.

Need to Know podcast–Episode 218

I talk to industry veteran and Microsoft MVP Tony Redmond about a variety of topics including Exchange Online, Teams, PowerShell as well as his fantastic Office 365 administration eBook offering. He shares lots of great insights on a variety of Microsoft offerings. Brenton and I also talk about news and updates in the Microsoft Cloud and get you ready for what we are potentially expecting from the upcoming Microsoft Ignite conference. Listen along and get ready for the tsunami from Microsoft Ignite.

This episode was recorded using Microsoft Teams and produced with Camtasia 2019

Take a listen and let us know what you think – feedback@needtoknow.cloud

You can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-218-tony-redmond/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.

Resources

@12knocksinna = Tony Redmond

@contactbrenton

@directorcia

Tony’s blog

Office 365 for IT Pros eBook

Surface laptops are finally repairable

Microsoft’s cloud earnings

CIAOPS MS-101 online training course now available

New Microsoft partner CSP agreement

Microsoft acquires Mover.io

How to check user sign in history

Tamper protection in Microsoft Defender ATP

End user self service for Power Platform

What is Microsoft 365 Business [VIDEO]

Call of Duty – Modern Warfare