The changing security environment with Microsoft 365

First, a quick trip down memory lane. Back when Microsoft released Windows XP it had no local firewall (yep, I know, hard to believe now). After that fact being exploited by malicious software to spread through networks, Microsoft added a firewall to Windows XP in Service Pack 1. However, it didn’t automatically enable it. It remained something optional that was on the user to enable. Of course, given that most people are never going to enable a security feature that is optional, security issues continued. Then, with Service Pack 2, Microsoft enabled the firewall in Windows XP and it has been on ever since.

Most software is generally not configured as securely as it could be out of the box. In the case of Microsoft, it has to cater to a very, very broad audience with very different needs and configurations. Thus, it has fallen to the IT Professional for the business to implement the appropriate security using the features provided.

This equates to the Windows XP Service Pack 1 days. That is, the security capabilities are included but not enabled. And just like those days, only a very small percentage of them seem to get implemented. Multi Factor Authentication (MFA) is a great example of this. From Microsoft Ignite 2019 (i.e ONLY last year):

“it was discussed that out of all the Azure tenants globally, less than 8% of them WORLD-WIDE have enabled MFA.  99.9% of attacks on accounts are prevented by MFA.” – Reference

Even though EVERY Microsoft/Office 365 and Azure tenant includes MFA for identities, less than 8% have enabled it. This is hard to rationalise given the reality that doing so would prevent almost 100% of attacks. Clearly, it harkens back to the Windows XP Service Pack 1 days – if it ain’t on by default, then it will probably NEVER be turned on, no matter how much protection it provides.

So I hope you can appreciate, that in one aspect the IT security landscape hasn’t changed much from back when we had Windows XP (2002 if you check Wikipedia). I think however that this is in fact driving what I see as the ‘new’ security landscape for Microsoft 365.

The first big change with Microsoft 365 security is that Microsoft is beginning to move from Windows XP Service Pack 1 approach to a Service Pack 2 approach. That is, security enabled by default.

The first example of this is the End of support for Basic authentication and actively disabling it which you can read about here:

Deferred end of support date for Basic Authentication in Exchange Online

The next example is Security defaults.

Security defaults make it easier to help protect your organization from these attacks with preconfigured security settings:


  • Requiring all users to register for Azure Multi-Factor Authentication.
  • Requiring administrators to perform multi-factor authentication.
  • Blocking legacy authentication protocols.
  • Requiring users to perform multi-factor authentication when necessary.
  • Protecting privileged activities like access to the Azure portal.

If your tenant was created on or after October 22, 2019, it is possible security defaults are already enabled in your tenant. In an effort to protect all of our users, security defaults is being rolled out to all new tenants created.

and from – Introducing security defaults

“We will expand first to apply security defaults to all new tenants as well as applying it retroactively to existing tenants who have not taken any security measures for themselves.”

image

The next example are the new templated Exchange Online policies found in the Administration console which I have detailed previously here:

New templated email policies

image

Basically, this is a ‘Microsoft Security Baseline’ for securing Exchange online to best practices. You can read more about these at:

Preset security policies in EOP and Office 365 ATP

I can see a future where at least the Standard protection policy is applied to all new tenants out of the box.

SNAGHTML38b0b00c

Next, if you go and look in Microsoft EndPoint Manager you will see a growing number of similar baseline policies. I say growing, because a

New Security baseline for Office

is on the way.

At the moment, the smart approach is to use these baseline policies from Microsoft and then adjust or add as required to suit your own environment (i.e. Windows XP Service Pack 1 approach). Again, I see the day, in the not too distant future, where these baselines will be enabled by default (i.e. Windows XP Service Pack 2 approach).

image

Where I see a major difference between the Windows XP Service Pack 2 approach (i.e. security on by default) is with the introduction of Artificial Intelligence (AI). Thanks to telemetry from tenants and activities being fed back into the Microsoft Cloud, AI and Machine Learning (ML) can be used to look for anomalies. The best example of this Azure Sentinel.

In this new world of AI, you need to spend less time looking at individual events. In essence, you allow the AI to do that and determine what looks suspect based on EVERYTHING it sees in your environment and what it sees across the whole ecosystem. I can see a future where not only will the AI analyse all this data in a blink of the eye but it will also start taking action. For example, if you haven’t disabled basic authentication, it will disable it automatically because it knows that doing so is recognised by its algorithm to protect data to a high degree. I also believe we will also soon have the option for the AI to start taking ‘pro-active’ action to re-configure spam filtering to provide the best protection and adapt automatically to new methods of attack.

In short, I see a day, in the not to distant future, when all possible security options will be enabled by default and then AI will not only monitor but automatically adjust services and settings as required to meet the changing threat landscape. All of this will be driven by the growing volumes of telemetry that Microsoft collects from tenants big and small.

This all seems pretty marvellous, having a self adjusting security posture but perhaps the bigger question to consider is, what role does the IT Professional who is supposed to be setting this security configuration up manually today play in this future? Does a role for manual IT security configuration exist in the future? If not, where will the opportunities be in the IT security realm?

New conversation button in Teams

image

A New conversation button has appeared for me inside my tenant both on the desktop and on the web as shown. This is very much like the button you in the mobile experience of Teams.

One of the major challenges with conversations or chats in Teams was the simplicity that you could create new conversation threads. This simplicity was its own worse enemy unfortunately, because what you’d find is that people would post new message threads rather than posting to the current or existing one. Many users didn’t notice that fact and you ended up with many, many disjointed conversations. That reduced Teams chat benefits and effectiveness.

This New conversation button will ensure that any existing reply will stay in the existing thread and you’ll only get a new conversation by pressing that button. It also makes the interface between, desktop, mobile and web more consistent.

Look out for the New conversation button coming to your Teams environment soon.

Need to Know podcast–Episode 252

In this episode I speak with MVP Megan Strant all about adoption. However, in this discussion we focus on the human side of adoption and change management which can be really challenging for many organisations to successfully manage. Megan shares her experiences and provides some handy insight into how we can improve our chances of successful adoption of Microsoft 365.

Of course, there is always Microsoft Cloud news which I’ll bring you up to date with. We will be expecting a whole lot more once Microsoft Ignite starts, so stay tuned here for all the latest!

This episode was recorded using Microsoft Teams and produced with Camtasia 2020

Take a listen and let us know what you think – feedback@needtoknow.cloud

You can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-252-megan-strant/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.

Resources

@meganstrant

@directorcia

Meganstrant

Megan Strant on Linkedin

Prosci

Microsoft Ignite 2020

Organize content your way with the Preview of Project Moca

Microsoft Lists in Microsoft Teams is now generally available

Updates for Dictate, including voice commands in Word

Transcribe in Word

What’s New with Microsoft 365 | August 2020

What’s New in Microsoft Teams | August 2020

Incrementing a SharePoint list column using Power Automate and Flow

Updated CIAOPS PowerShell course

https://ciaops.podbean.com/e/episode-252-megan-strant/

Incrementing a SharePoint List Column using Power Automate and Flow

A common task that I have found need for in SharePoint is the ability to increment an identifier field for an item in a SharePoint list. One use case that I have is the ability to send regular posts to a Team channel but continue to loop through all the items in the list no matter how many there is. In short, I want to take a list of items from SharePoint and post the contents one item per day to a Teams channel, forever in an automated fashion

I want to take this opportunity to thank Andrew from Andrew Gallagher Computing for assisting me working this out. Here is the result:

image

You can achieve this outcome using Power Automate in Microsoft 365, which we have done as shown in the above summary screen shot. Now let me break down all the components.

image

The first place to start is to create a list in SharePoint that you will use with the appropriate columns. In this case I have 3 columns:

TitleId = a column to keep track of each entry. This will contain an integer that gets incremented.

Title = the subject line of the post in the Microsoft Teams channel

Description = the body of the post in the Microsoft Teams channel

image

The first step in Power Automate is to create a recurrence trigger, which is pretty easy. I want this Power Automate to run once a day at a set time.

image

Next, I initialise 3 variables:

MaxTitleId = will hold the current maximum value found in the TitleId column in the list

MinTitleId = will hold the current minimum value found in the TitleId column in the list

NewTitleId = this value will be MaxTitleId + 1 and will replace the existing TitleId value in the list items when that item is used.

An interesting point here that we found was that the field time for the variables has to be Float even though the actual numbers in the SharePoint list field are integers.

image

Next I need to get items from the SharePoint list I have created, from the SharePoint site location I desire. You will notice here that I also want to display the Advanced fields so I can add the following fields:

Order by = TitleId desc

Top count = 1

In effect, I am ordering the list by the TitleID column in descending order, which places the row with the highest value in the TitleId column at the top of the list. Then I simply take the 1 item from the list in that order, i.e. the top row. In essence, I am finding the item in the list with the highest  TitleId number in the list.

image

I then take that List row and set the variable MaxTitleId to be the value in the TitleId field for that item in the SharePoint list I just captured. That means that I am finding the highest value in the TitleId column for the list and saving that highest value into the variable MaxTitleId for later use.

image

next, I perform the operation of MaxTitleId + 1 using the expression:

add(variables(‘MaxTitleId’),1)

and store it into the variable NewTitleId. This will be the new value of the field TitleId in the list item after I have used that item. In effect, it will move the item that I use to end of my list.

image

I now again, get the same list, but this time sort by the field TitleId in ascending order using the command:

TitleId asc

After doing this, I again only take the top row of the list. In essence, I am now finding the row in the list where the field TitleId is the lowest. This will be the item that I want to post out to my Teams channel.

image

Before I do that, I save this minimum TitleId value to the variable MinTitleId as shown above.

image

I now post the information in the row item with the lowest value of TitleId to my preferred Microsoft Teams channel as shown above.

image

and above, is what it appears like in my Teams channel.

image

Finally, I update the item that I just used to post information to my Teams channel and replace the existing Titleid with the one in the variable NewTitleId. In effect, I am now making this used item in the list with the lowest TitleId field, the one with the highest value + 1 of TitleId in the list. This means that this item will fall to the bottom of the list and won’t be used again until down the track it becomes the item with the lowest TitleId field once again. That won’t happen until all other items in the list have been published and completed a similar process.

So there you have it. Yes, technically we don’t use the variable MinTitleId but we have included here to help anyone who may be looking for that using Power Automate. I speak more about the business reason for creating this type of automation in an upcoming article, but for now, consider it as a way to continually broadcast common messaging to people using Microsoft Teams.

CIAOPS Need to Know Microsoft 365 Webinar–September

laptop-eyes-technology-computer

Time to look at the newest Microsoft 365 service – Lists. In this webinar I’ll show what Microsoft Lists is all about and give you some suggestions on how you can put it to work in your business. I’ll also have the  the latest Microsoft Cloud updates plus open Q and A as well.


You can register for the regular monthly webinar here:


September Webinar Registrations


The details are:


CIAOPS Need to Know Webinar – September 2020
Thursday 24th of September 2020
11.00am – 12.00am Sydney Time


All sessions are recorded and posted to the CIAOPS Academy.


The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:


http://www.ciaopspatron.com


or purchase them individually at:


http://www.ciaopsacademy.com/


Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.


I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session and I look forward to seeing you there.

Updated CIAOPS PowerShell course

I am pleased to announce that I have updated my online PowerShell course for Microsoft 365. A lot has changed in recent times so I’ve been through the content and updated it as well as add lots more lessons and resources. The only thing that hasn’t changed is the price. That remains at US$39!

You can view the course content and sign up here:

https://www.ciaopsacademy.com/p/powershell-for-microsoft-365

Of course, if you are eligible CIAOPS Patron, you’ll also get immediate access to the course for free as part of your benefits.

The idea with the course is not to give you a deep dive into all the workings of PowerShell. It is designed to get you up and running using PowerShell with Microsoft 365 as quickly as possible. No pre-existing knowledge is assumed. I’m aiming to bring out more advanced courses, but this course is the foundation on which courses will be built.

As I have said many times here, PowerShell is a KEY skill for any IT Pro going forward in the Microsoft Cloud space. It allows you to do things faster and more consistently, just to name two benefits. If you haven’t taken the step to learning PowerShell then invest in yourself and you future and do so!

September poll

ask-blackboard-chalk-board-chalkboard-356079

For September I’m asking people:

Have you ever paid, or helped someone else pay, a ransom after a ransomware attack?

which I greatly appreciate you thoughts here:

http://bit.ly/ciasurvey202009

You can view the results during the month here:

http://bit.ly/ciaresults202009

and I’ll post a summary at the end of the month here on the blog.

Please feel free to share this survey with as many people as you can so we can get better idea of how much ransom is being paid out there. I’ll bet is more than most think. Let’s see.

August poll results

August’s question was :

Are you considering or using Microsoft Defender ATP in place of other third party anti virus and end point security solutions?

and the results are:

image

A much stronger result for Defender ATP that I thought! 93% of respondents are looking at using Defender ATP! Wow, shows you that Defender ATP is really starting to kick some goals out there and make waves.

The anonymous September question for you is:

Have you ever paid, or helped someone else pay, a ransom after a ransomware attack?

which can be found at:

http://bit.ly/ciasurvey202009

appreciate if you could take a moment and let me know your experiences.