CIA Brief – 231118

Our vision to bring Microsoft Copilot to everyone, and more –

https://blogs.bing.com/search/november-2023/our-vision-to-bring-microsoft-copilot-to-everyone-and-more

Ignite News: Augment your EDR with deception tactics to catch adversaries early –

https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/ignite-news-augment-your-edr-with-deception-tactics-to-catch/ba-p/3982253

Microsoft Security Copilot and NIST 800-171 –

https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-security-copilot-and-nist-800-171/ba-p/3984053

Power Apps accelerates the shift toward modern, AI-infused apps with governance at scale –

https://powerapps.microsoft.com/en-us/blog/power-apps-accelerates-the-shift-toward-modern-ai-infused-apps-with-governance-at-scale/

Microsoft Defender XDR, Security Copilot & Microsoft Sentinel now in one portal –

https://www.youtube.com/watch?v=snV2joMnSlc&t=1s

What’s new with Windows at Microsoft Ignite 2023! –

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/what-s-new-with-windows-at-microsoft-ignite-2023/ba-p/3980507

Microsoft Backup in public preview –

https://learn.microsoft.com/en-us/microsoft-365/syntex/backup/backup-overview

Simplify IT management with Microsoft Copilot for Azure – save time and get answers fast –

https://techcommunity.microsoft.com/t5/azure-infrastructure-blog/simplify-it-management-with-microsoft-copilot-for-azure-save/ba-p/3981106

Universal Print makes cloud printing truly “universal” –

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/universal-print-makes-cloud-printing-truly-universal/ba-p/3982872

Microsoft Archive available in preview –

https://learn.microsoft.com/en-us/microsoft-365/syntex/archive/archive-overview

Meet the new Microsoft Planner –

https://www.youtube.com/watch?v=jwGQPWAihjQ

Copilot Studios | Explained by Microsoft –

https://www.youtube.com/watch?v=06D4G2K9UFs

Microsoft Stream: The Future of Video in Microsoft 365 –

https://www.youtube.com/watch?v=XxuVc9ji3as

Microsoft Loop: built for the new way of work, generally available to Microsoft 365 work accounts –

https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-loop-built-for-the-new-way-of-work-generally-available/ba-p/3982247

Microsoft Intune introduces Security Copilot-embedded experience –

https://techcommunity.microsoft.com/t5/microsoft-intune-blog/microsoft-intune-introduces-security-copilot-embedded-experience/ba-p/3982632

Announcing Microsoft Copilot Studio: Customize Copilot for Microsoft 365 and build your own standalone copilots –

https://www.microsoft.com/en-us/microsoft-365/blog/2023/11/15/announcing-microsoft-copilot-studio-customize-copilot-for-microsoft-365-and-build-your-own-standalone-copilots/

Microsoft Stream: The Future of Video in Microsoft 365 –

https://techcommunity.microsoft.com/t5/microsoft-stream-blog/microsoft-stream-the-future-of-video-in-microsoft-365/ba-p/3969156

Announcing Windows 365 GPU-enabled Cloud PC public preview –

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/announcing-windows-365-gpu-enabled-cloud-pc-public-preview/ba-p/3982952

Introducing Microsoft Copilot Studio and new features in Copilot for Microsoft 365 –

https://www.microsoft.com/en-us/microsoft-365/blog/2023/11/15/introducing-microsoft-copilot-studio-and-new-features-in-copilot-for-microsoft-365/

Microsoft unveils expansion of AI for security and security for AI at Microsoft Ignite –

https://www.microsoft.com/en-us/security/blog/2023/11/15/microsoft-unveils-expansion-of-ai-for-security-and-security-for-ai-at-microsoft-ignite/

Microsoft Cloud PKI launches as a new addition to the Microsoft Intune Suite –

https://techcommunity.microsoft.com/t5/microsoft-intune-blog/microsoft-cloud-pki-launches-as-a-new-addition-to-the-microsoft/ba-p/3982830

Announcing Microsoft Intune Advanced Analytics –

https://techcommunity.microsoft.com/t5/microsoft-intune-blog/announcing-microsoft-intune-advanced-analytics/ba-p/3982742

Microsoft Ignite 2023: AI transformation and the technology driving change –

https://blogs.microsoft.com/blog/2023/11/15/microsoft-ignite-2023-ai-transformation-and-the-technology-driving-change/

Tailor Windows Update for Business reports with Power BI –

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tailor-windows-update-for-business-reports-with-power-bi/ba-p/3978975

Ten things you need to know before buying Microsoft 365 Copilot –

https://www.directionsonmicrosoft.com/blog/ten-things-you-need-to-know-before-buying-microsoft-365-copilot/

Microsoft could be bringing its AI Copilot to billions of Windows 10 users –

https://www.tomsguide.com/news/microsoft-could-be-bringing-its-ai-copilot-to-billions-of-windows-10-users

After hours

Candy Thieves vs Rigged Candy Bowl – https://www.youtube.com/watch?v=Zb01RStdzEs

Editorial

There is still more Microsoft Ignite goodness to digest, so be prepared for lots of links in the CIA Brief next week as well!

If you found this valuable, the I’d appreciate a ‘like’. This helps me know that people enjoy what I have created. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

Watch out for the next CIA Brief next week.

Accessing Azure Key Vault via Power Automate

In a previous article:

Adding a secret to an Azure Key Vault

I showed how a secure credential could be saved to an Azure Key Vault and then retrieved either from the browser, or PowerShell. You can however, also retrieve a secret using Power Automate.

You can see I have the same ‘super secret’ password stored in the Azure Key Vault above.

The Azure Key Vault connector in Power Automate is a premium connector which means you’ll either need an advanced Power Platform license or you’ll need to set up a

Power Platform PAYG configuration

which is probably the more cost effective approach.

You’ll firstly need to login to your Power Platform environment and select Connectors from the menu on the left as shown above. In here look for the Azure Key Vault connector. If it is not there select the +New connector from the menu at the top.

Search for key vault in the top right and then select Azure Key Vault as shown above. You will note that this connector is a Premium connector as highlighted earlier.

Enter the vault name and select Create.

You should now see the connector displayed in the list as shown above.

If you select this connector you will see additional information and the connection Status as well. Icons on the menu bar at the top that allow you to maintain this connector if needed.

Create a new flow and add a new step. Search for key vault as shown and select Get Secret as the action below as shown above.

If you pull down the Name of the secret field you should see your secret name previously created in the Azure Key Vault as shown above, which you can select.

Complete your flow. Here I’m just going to output the value of the secret (i.e. the password) to a Microsoft Team channel.

If you now run the flow you see that it succeeds.

You should also see the output of the secret (i.e. here the password) stored in the Azure Key Vault displayed as shown above.

Another advantage of using an Azure Key Vault is that you can use it a variety of tools such as PowerShell and Power Automate as I have shown here. This means that the credentials stay secure and can still be accessed via your automation process.

CIAOPS Need to Know Microsoft 365 Webinar – November

Join me for the free monthly CIAOPS Need to Know webinar. Along with all the Microsoft Cloud news we’ll be taking a look at the Microsoft 365 video service, Stream.

Shortly after registering you should receive an automated email from Microsoft Teams confirming your registration, including all the event details as well as a calendar invite.

You can register for the regular monthly webinar here:

November Webinar Registrations

(If you are having issues with the above link copy and paste – https://bit.ly/n2k2311

The details are:

CIAOPS Need to Know Webinar – November 2023
Thursday 30th of November 2023
11.00am – 12.00am Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

http://www.ciaopspatron.com

or purchase them individually at:

http://www.ciaopsacademy.com/

Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session and I look forward to seeing you there.

CIA Brief is coming

messenger delivering a new annoucement to the pubblic

For a long while I used Power Automate to push out interesting stories around the Microsoft Cloud I found to Twitter (X now). Unfortunately, X changed the pricing of their API which made it prohibitively expensive to continue with this approach.

Given this, I’ve been thinking about what would be a suitable replacement. I initially considered an email list, as that is what all the cool kids do, but I also needed a process that was simple and easy for me, especially if I was going to do something weekly. The problem using a bulk email system like Mailchimp, is that I would need to format each blast using the Mailchimp website as well as send it from there. If I planned to do a weekly update of links I have found, that becomes time consuming and inconvenient, especially if I’m travelling.

Another reason I have not opted for an email list is that I am already on plenty that send updates weekly and honestly I don’t find that it is a very effective mechanism. Yes, I do read them all and yes, they provide value but I tend to put off reading them and deal with more important things in my inbox. I kind of need to be in the ‘mood’ to sit there and read through all the information and if I’m not then they tend to ‘backup’ as a to-do item.

I also considered doing a video update and posting it on YouTube as many others do. The downside to this method is it is a huge amount of work behind the scenes. My experience is also that a video of a whole bunch of screen shots or text really doesn’t appeal to people because when I tried it a while back by posting my podcasts with this content, the number of views simply didn’t reach acceptable minimums for the amount of invested effort.

Thus, I ruled out setting up an email list or using a video update as well as few other methods and instead have favoured posting the information here on my blog. The benefits of this is that it will be easy for me to quickly copy, paste and post the collection of stuff I find weekly. For those that do want emails there is the option to subscribe to my blog as email if you wish. The blog method however means you can simply read the post without having to give up your email if you choose and not have additional emails in your inbox, which is always a good thing. I also like that it will be searchable and publicly available.

I have created a tag on my blog called ‘CIA Brief’ which allows you to filter by just that tag. For example the feed will be:

https://blog.ciaops.com/tag/CIA-Brief/

that means you can simply follow the items I post with this tag the get the list of information I plan to post.

The ask I have of those that find value in the CIA Brief is to Like the post, as shown above at the bottom of each post. This way I know that the information is of value to people and provides an incentive for me to continue producing it. If you can Like each CIA Brief you see that would be very much appreciated.

Of course, I also welcome your feedback about how to make this concept even more valuable to people. I want something that is quick and easy to view on a weekly basis that will keep you up to date with the Microsoft Cloud. If you have any suggestions or feedback then I’m all ears.

That is the why and wherefores done. Stay tuned for the first CIA brief at the end of this week.

October Microsoft 365 Webinar resources

The slides from this month’s webinar are available at:

https://github.com/directorcia/general/blob/master/Presentations/Need%20to%20Know%20Webinars/202310.pdf

If you are not a CIAOPS patron you want to view or download a full copy of the video from the session you can do so here:

http://www.ciaopsacademy.com.au/p/need-to-know-webinars

Watch out for next month’s webinar.

CIAOPS Need to Know Microsoft 365 Webinar – October

Join me for the free monthly CIAOPS Need to Know webinar. Along with all the Microsoft Cloud news we’ll be taking a look at OneDrive for Business.

Shortly after registering you should receive an automated email from Microsoft Teams confirming your registration, including all the event details as well as a calendar invite.

You can register for the regular monthly webinar here:

October Webinar Registrations

(If you are having issues with the above link copy and paste – https://bit.ly/n2k2310

The details are:

CIAOPS Need to Know Webinar – October 2023
Tuesday 31st of October 2023
11.00am – 12.00am Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

http://www.ciaopspatron.com

or purchase them individually at:

http://www.ciaopsacademy.com/

Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session and I look forward to seeing you there.

Monitoring a break glass account with Sentinel

In a previous article I covered off how to use Defender for Cloud Apps to monitor a break glass account. Typically, the alerts generated there will feed into Sentinel, however it is possible to configure Sentinel to perform a similar role.

The starting point is to use a KQL query like this:

SigninLogs
| where UserPrincipalName == “breakglass@domain.com”
| where OperationName == “Sign-in activity”
| project TimeGenerated, UserPrincipalName, ClientAppUsed, LocationDetails

If you run that query manually you’ll see a result like shown above. You will however also notice a New alert rule option in the top right of the window.

Selecting this will reveal two choices as shown above. Select Create Microsoft Sentinel alert to continue.

Make the appropriate settings in the General page, like shown above, and continue.

Here there are number of settings you can select but you will probably want to adjust how often the query is run as shown above. The important point to remember is that, as Azure is a consumption based billing model, there is a (very, very small charge) every time the query is run. Thus, the more often it runs the more it will cost.

When you have completed this section, move onto the Incident settings.

Here it is important to ensure that the option to Create incidents is Enabled as shown above.

Make any additional adjustments and move to Automated response.

Here you can enable any automation action you wish by selecting from those already created, as shown above. You can always add additional automation later if desired.

Finally, review and create the alert.

Verify that the alert you just created now appears in the list of Analytic rules for your environment as shown above.

If you now test this by logging as your breakglass account you should an incident generated as shown above. Once again, it is important to remember that this incident doesn’t appear immediately. It will appear in a time period based on how often you set the alert to check.

Another important thing to remember is that by default, the incident will not send an email notification of the alert. You can configure that a variety of different ways if you wish, which I won’t cover here.

The differences with using Sentinel for custom alerts is that the billing is consumption based, but you have a lot more flexibility in how you configure the actual alerts as well as any automated response if desired. I would also say that Sentinel has more power around actually analysing signals as well which is handy to protect your breakglass account.

Monitoring a break glass account with Defender for Cloud Apps

It is a very good thing to have a breakglass account in your environment. I have spoken about this in depth in an episode of my podcast:

Need to Know podcast – Episode 310

The challenge can be ensuring you know if and when this account is used because it typically has less protection associated with it than normal accounts in the environment.

One way to achieve this is to use Defender for Cloud Apps, which can be found by navigating to:

https://security.microsoft.com

to generate alerts when the account logs into the environment.

On the left hand menu of the Microsoft Security Center for your tenant expand the Policies option under the Cloud apps heading, and select the Policy management item.

Now select the +Create policy menu item on the right as shown above.

From the drop down that appears, select Activity policy as shown above.

Give the new policy a Name and Description. Select the Policy severity and the Category.

Select the option to Act on: Single activity.

In the Activities matching all of the following select:

Activity Type equals Log on

then add another filter and select:

User Name equals breakglassaccount@domain.com as Any role

as shown above. This in essence will trigger and alert whenever the breakglass account logs into the environment.

Configure the Alerts and Governance actions to suit your requirements. At a minimum you probably want the alert to be emailed to an external address. You can also build a Power Automate Flow from this also if you wish.

Save the new policy.

Locate the policy just created in the list (you can sort using the Modified column if necessary). Select the ellipse (three dots) to the right of the policy entry and from the menu that appears, select View all matches as shown above.

Ensure you test the policy by logging into your breakglass account.

This will now show all the matches in your environment as shown above. It is also recommended that you Save as so you can easily return these results if needed in the Activity log.

If you have also set up Sentinel, the alert should also flow into here as shown above. More automation and alert options are available here if needed.

The most important thing to remember that any alert generated by the login of your breakglass will NOT be immediate! It should however appear with a a few minutes of the action taking place and then a little while after in Sentinel as it flows through the logging process.

There is more that can be done to with this process, but this should get you started protecting your breakglass account.