Category: Azure
Need to Know podcast–Episode 324
Along with all the news and updates from the Microsoft Cloud I muse on the fact that the new Microsoft 365 Backup service may have been partially created to solve the storage issues of deleted data in Microsoft 365 environments. Just a theory, but listen along if you like to hear my thoughts.
You can listen directly to this episode at:
https://ciaops.podbean.com/e/episode-325-a-change-in-the-wind/
Subscribe via iTunes at:
https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2
Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show.
Brought to you by www.ciaopspatron.com
Resources
Microsoft 365 Insider Round Up
Microsoft Defender XDR – Monthly news – August 2024
Windows 365 at three years: Customer-centric solutions for security, management and productivity
New Windows 365 features help provide a more secure workspace
Windows 365 GPU-enabled Cloud PCs now generally available
Supercharge Your Business: Simplify communications with AI in Microsoft Teams and Teams Phone
Microsoft Announces General Availability of Microsoft 365 Backup and Microsoft 365 Backup Storage
SharePoint roadmap pitstop: July 2024
What’s new in Copilot | July 2024
What’s New in Microsoft Teams | July 2024
Looking back on FY24: from Copilots empowering human achievement to leading AI Transformation
Use WinGet 1.8 to download Microsoft Store apps
Monitoring Microsoft Sentinel Reports with Dashboard Hub & Power BI
Announcing quarantine release integration in MDO hunting experience!!
Windows Security best practices for integrating and managing security tools
Microsoft Purview Data Governance will be generally available September 1, 2024
Migrate ADAL apps to MSAL with enhanced insights
Public Preview: New Azure Monitor Auxiliary Logs Plan
Onyx Sleet uses array of malware to gather intelligence for North Korea
Zero Trust in the Age of AI: Join our online event to learn how to strengthen your security posture
Try out the new Copilot in Planner (preview) today in the new Microsoft Planner in Teams
OneDrive in-depth: Learning content
The Microsoft Copilot Dashboard is now included with Copilot for Microsoft 365
Getting Global Administrators using the Graph
A common task that needs to be performed is to return all the Global administrators in a tenant via PowerShell. With the focus on using the Microsoft Graph to do things like this you can use the following:
import-module Microsoft.Graph.Identity.DirectoryManagement
Connect-MgGraph -Scopes “RoleManagement.Read.Directory”,”User.Read.All”
$globalAdmins = Get-MgDirectoryRole | Where-Object { $_.displayName -eq “Global Administrator” }
$globalAdminUsers = Get-MgDirectoryRoleMember -DirectoryRoleId $globalAdmins.id
$globaladminsummary = @()
foreach ($adminuser in $globalAdminUsers) {
$user = Get-MgUser -userId $adminuser.Id
$globaladminSummary += [pscustomobject]@{
Id = $adminuser.Id
UserPrincipalName = $user.UserPrincipalName
DisplayName = $user.DisplayName
}
}
$globaladminsummary
which I have also uploaded to my Github repo here:
https://github.com/directorcia/Office365/blob/master/graph-globaladmins-get.ps1
You may also need to consent to some permissions like:
If your user doesn’t have these. Permissions required are:
RoleManagement.Read.Directory
User.Read.All
The list of tenant global admins will be held in the variable $globaladminsummary at the completion of this script.
KQL Query to report failed login by country
If you are interested to see how many failed logins your Microsoft 365 environment has had in the past 30 days you can run the following KQL query in Sentinel:
SigninLogs
| where ResultType == 50126
| where TimeGenerated >= ago(30d)
| extend Country = tostring(LocationDetails[“countryOrRegion”])
| summarize FailedLoginsCount = count() by Country
| order by FailedLoginsCount desc
you can then make a slight change and get all the successful logins
SigninLogs
| where ResultType == 0
| where TimeGenerated >= ago(30d)
| extend Country = tostring(LocationDetails[“countryOrRegion”])
| summarize LoginsCount = count() by Country
| order by LoginsCount desc
In my case, I found that only around 1% of my total logins were failed logins and all of these came from countries outside Australia.
Here is also a visualisation of the location of failed logins by country
Note: if you copy and paste directly from here you will probably have the change the “ around countryorregion when you paste into your own environment as teh wrong “ gets taken across!
Connecting Defender EASM logs to Sentinel workspace
A very important security task is to ensure you are collecting all the logging data for your services and sending them to a central location for storage and analysis.
Here’s how you can send the logs from Defender EASM into Sentinel.
You’ll need to have already established both Sentinel and Defender EASM instances. Underneath Sentinel is a Log Analytics Workspace that is where all the logging data for Sentinel is accumulated. It is into this workspace that the Defender EASM logs will be sent.
Log in to the Azure portal and navigate to Defender EASM as shown above. Select the Data connections option from the menu on the left. From the window that appears on the right select Add connection under Log Analytics as shown.
A dialog will appear from the right hand side prompting you for further information as shown above.
Open a new browser tab and navigate to Sentinel.
Select the Settings option at the bottom of the menu on the left hand side as shown above. From the windows that appears on the right select Workspace settings as shown.
In the Log analytics workspace for Sentinel select the Agents option under Settings from the menu on the left as shown.
In the window that appears on the right you will find both the Workspace ID and an API key as shown. Both of these will be required back in the Defender EASM connectors page.
Return to the Defender EASM connectors page configuration and give this connection an appropriate Name. Enter the Workspace ID and Api key from the Sentinel Log Analytics page. Select All content and Daily for frequency.
Save these settings.
If everything is correct you should now see that the Log Analytics connexion now displays you settings under Connected as shown above.
The logs from Defender EASM will now start becoming available for you in Sentinel to use in things like KQL queries.
Introduction to Microsoft Copilot for Security
This video will show you how to enabled and use Microsoft Copilot for Security across the different interfaces that it integrates with. You’ll also see how to delete Copilot for Security when complete. The blog article referenced in the video is here – https://blog.ciaops.com/2024/04/02/a-day-with-copilot-for-security/
Need to Know podcast–Episode 321
Lots of news an updates after being a few weeks since last episode. Fear not however, they are all linked below. Plenty of really detailed and helpful articles from Microsoft of late, especially around security. All of which I highly recommend you spend time working through and implementing the recommendations. Also plenty of new features and products to cover so dive in and take a look.
You can listen directly to this episode at:
https://ciaops.podbean.com/e/episode-321-initiatives/
Subscribe via iTunes at:
https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2
Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show.
Brought to you by www.ciaopspatron.com
Resources
Granular RBAC permissions for endpoint security workloads
How to break the token theft cyber-attack chain
Microsoft Incident Response lessons on preventing cloud identity compromise
How Copilot for Microsoft 365 Works
From pixels to presence: new features coming to Microsoft Mesh
How to unlock new experiences on your Copilot+ PC
Introduction to Cross-Tenant Mailbox Migrations
Copilot is now available in classic Outlook for Windows
Microsoft Incident Response tips for managing a mass password reset
Set default organization version limits for new document libraries and OneDrive accounts (Preview)
The guide to Microsoft Intune resources
Email Protection Basics in Microsoft 365: Bulk Email
Data security in Microsoft Copilot for Microsoft 365
Moving from AI experimentation to business breakthrough
Update on the Recall preview feature for Copilot+ PCs
Secure your business: Four ways Microsoft 365 for Business can help
The new Microsoft Planner is here! Streamline the planning, management, and execution of work
Announcing new Windows Autopilot onboarding experience for government and commercial customers
AI jailbreaks: What they are and how they can be mitigated
How Russia is trying to disrupt the 2024 Paris Olympic Games
Microsoft is again named the overall leader in the Forrester Wave for XDR
What’s New in Copilot | May 2024
Exploring Copilot for Security to Automate Incident Triage
Demystifying Microsoft Entra ID, Tenants and Azure Subscriptions
Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks
Defender for Cloud App connectors
An important piece of the security puzzle is to ensure everything that you have access to is enabled and configured fully. If you have any version of Defender for Cloud Apps you should verify that the signals from Microsoft 365 are feeding into Defender for Cloud Apps.
To verify or enable this connection fully navigate to:
Open the Settings option from the menu on the left. From the options that appear on the right select Cloud Apps as shown above.
Then under the Connected Apps heading select App connectors as shown above. Ensure that connectors for Microsoft 365 and Microsoft Azure appear. If they don’t you can use the Connect an app option on the menu.
To verify the Microsoft 365 app is fully enabled locate the ellipse (three dots) on the right hand side of this connector and select it as shown above.
From the menu that appears select Edit Settings.
Ensure all the settings available to you are enabled as shown. Select the Connect to Office 365 button at the bottom of the dialog to save your settings and continue.
There is no addition cost to enabling these options and when you do you are able to monitor, audit and capture the logs for:
– Azure AD Users and Groups
– Azure AD Management events
– Azure AD Sign-in events
– Azure AD Apps
– Office 365 Activities
– Office 365 files
all thanks to Defender for Cloud apps.
CIAOPS 