Introduction to Exchange Online Protection

This video is the technical session from my May 2023 Need to Know webinar that focuses on helping people understand Microsoft 365. The aim is to help viewers get an overview of how Exchange Online Protection secures their environment and where they can go to made additional adjustments if required.

The session was recorded using Microsoft Teams.

You can find the slide deck for this session here – https://www.slideshare.net/directorcia/may-2023-ciaops-need-to-know-webinar

Get Teams Meeting Attendees via PowerShell and the Microsoft Graph

Here’s a handy way to get a list of attendees in Microsoft Teams using PowerShell. I have uploaded the script to do this here:

https://github.com/directorcia/Office365/blob/master/tms-attend-get.ps1

Before you run the script you’ll need to have the Graph PowerShell module installed.

image

You’ll also need to set some variable values for your own environment in the script. You can do this by locating $tenantid in the script as shown above, and setting that to your own tenant URL. Then find $meetingjoinurl and set that to the URL for that meeting. Finally, set $useremail to the email address of the user who created the meeting.

image

The meeting URL is the link people selected to join the meeting as shown above. You’ll also find it in the configuration for the meeting.

image

With all those settings updated, when you run the script it should look something like shown above. The script will connect to the Microsoft Graph with the scopes required to read the meeting details. You may be requested to login to the tenant and then potentially consent to these scopes during the connection phase. The required scopes are:

OnlineMeetingArtifact.Read.All
OnlineMeetings.Read

The script will get the GUID of the creator of the meeting from the email you specified followed by the meeting id from the meeting join link you specified, then the report id for that meeting and finally the report details for the meeting. It will then display the email address (if recorded) of attendees as shown above.

Of course, you can just download the CSV meeting report from the Teams page I know, but this process will be first step in eventually using Power Automate to get meeting attendees and send them an automatic follow up after the meeting. Stay tuned for details on that coming soon. This is simply proof of concept and a handy option if you do indeed just want to use PowerShell to get a list of meeting attendees.

Using the Defender for Endpoint API and PowerShell (Updated)

A while back I wrote this post:

Using the Defender for Endpoint API and PowerShell

Problem is, the script that I developed:

https://github.com/directorcia/Office365/blob/master/endpoint-api-svbm.ps1

now doesn’t seem to bring back any results!

image

It used the following API:

https://api.securitycenter.microsoft.com/api/machines/SoftwareVulnerabilitiesByMachine

which isn’t generating any data or any errors!

image

The above returned results shows a good status but the value of data is empty.

So for now I’ll have to assume that this API is unavailable. No fear I’ve developed a new script:

https://github.com/directorcia/Office365/blob/master/mde-vul-get.ps1

image

image

which will not only list out the vulnerabilities but also export to a CSV file.

image

That allows you to sort and filter the results any way you wish.

To get the script working you still need the following API permissions for your Azure AD App with the WindowsDefenderATP API:

Application permissions = Vulnerability.Read.All

Application permissions = Machine.Read.All, Machine.ReadWrite.All

like so:

image

You also need to ensure you change the Azure AD App information in the script to match your own:

image

If you want to export more information you should be able to easily modify the script which firstly get the machine info and then the vulnerabilities on each.

Hopefully, this give people what they need until the original API comes back on line.

Need to Know podcast–Episode 302

In this episode I share some thoughts around AI and the impact that upcoming services like Microsoft 365 Copilot will have. As always, there is plenty of news an updates to share from the Microsoft Cloud. Listen in and let me know your thoughts on this episode.

You can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-302-thoughts-on-ai/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

This episode was recorded using Microsoft Teams and produced with Camtasia 2023.

Brought to you by www.ciaopspatron.com

Resources

@directorcia

@directorcia@twit.social

Join my shared channel

CIAOPS merch store

Become a CIAOPS Patron

CIAOPS Blog

YouTube edition of this podcast

Responding to targeted mail attacks with Microsoft 365 Defender

Microsoft 365 Lighthouse helps you secure and improve the health of your customer tenants

Introducing the Microsoft 365 Copilot Early Access Program and new capabilities in Copilot 

SharePoint in the AI Era: Introducing Copilot in SharePoint & 10 more innovations for creators

Public Preview: Token Protection for Sign-In Sessions

Get step-by-step guidance for enabling key features in Microsoft Defender

Microsoft 365 Admin Monthly Digest – April 2023

New Microsoft Entra Features Now Available

Automating and Streamlining Vulnerability Management for Your Clients

Microsoft Build

CIAOPS Need to Know Microsoft 365 Webinar – May

laptop-eyes-technology-computer

Join me for the free monthly CIAOPS Need to Know webinar. Along with all the Microsoft Cloud news we’ll be taking a look at Exchange Online protection.

Shortly after registering you should receive an automated email from Microsoft Teams confirming your registration, including all the event details as well as a calendar invite.

You can register for the regular monthly webinar here:

May Webinar Registrations

(If you are having issues with the above link copy and paste – https://bit.ly/n2k2305

The details are:

CIAOPS Need to Know Webinar – May 2023
Friday 26th of May 2023
11.00am – 12.00am Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

http://www.ciaopspatron.com

or purchase them individually at:

http://www.ciaopsacademy.com/

Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session and I look forward to seeing you there.

Adoption with fun and OpenAI

I’ve detailed how to use an API with Power Automate to inject some engaging content automatically into Microsoft Teams.

Adoption with fund and astronomy

Thanks to API’s I want to extend this to use OpenAI and ChatGPT.

What I want to achieve is to ask a question of ChatGPT via an API everyday something like this:

Tell me about 1 May as a list

When I do this interactively at chat.openai.com I see:

image

I now want something like that to appear in Microsoft Teams daily for each day.

You’ll need to head over to OpenAI and get an API key. Here’s how to do that:

How to get an OpenAI API key in just 5 easy steps

I’d also suggest signing up for an OpenAI API subscription if you want to continue using this service. Here’s an idea of the costs.

image

Create a new Scheduled cloud flow. Don’t forget to change the repeat option to 1 day typically.

image

Add the Current Time action.

Add the Convert time zone action to get the time in your location. Set the format string to Month/day pattern (i.e. May 1).

image

Add the HTTP action. Remember, this is a Premium connector. Set teh following options here:

Method = POST

URI = https://api.openai.com/v1/chat/completions

Accept = application/xml

Content-Type = application/json

Authorization = Bearer (your OpenAI API key)

Body:

{
   “model”: “gpt-3.5-turbo”,
   “max_tokens”: 2000,
   “temperature”: 0,
   “messages”: [
     {
       “role”: “user”,
       “content”: “Tell me about @{body(‘Convert_time_zone’)} as a list”
     }
   ]
}

Ensure you double check all these settings as it is easy to make a mistake.

image

Add the Parse JSON action.

I’ve put the JSON schema you need here:

https://github.com/directorcia/general/blob/master/Power%20Platform/OpenAI/JSON-for-GPT

image

Add the Initialize variable action. We need to extract the returned text and format it so it will display in Teams. That means replacing the ‘/n’ string ‘<br>’. That can be done via this expression:

replace(body(‘Parse_JSON’)?[‘choices’][0]?[‘message’]?[‘content’],’/n’,’<br>’)

NOTE: if you copy and paste this expression and receive an error when you try and save it, you’ll most likely have to change the apostrophe from ‘ to ‘. It’s subtle, but you need to use the one to the left of the ENTER key on most keyboards to get it to work in Power Automate.

image

Finally add the Post message in chat or channel action.

image

Ensure you swap to the HTML editor using the </> item in the top right of the message as shown above.

Format the message the way you want to and insert variable created previously as shown.

image

When the Flow executes the output should look something like the above.

Note that GPT isn’t always right! You can also change the AI models if you wish, but remember they have different prices.

Typically, I’d suggest you run this Flow once a day to promote more engagement in your Microsoft Team. Better yet, you can show everyone how you are integrating AI into Teams. Yet another point of engagement in your Microsoft Team and perhaps a way to spark ideas for how you can expand the use of OpenAI in yoru business.

Need to Know podcast–Episode 301

News and updates from the Microsoft Cloud and then a deep dive into Compliance policies in Intune. Have a listen and let me know what you think.

You can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-301-compliance-policies/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

This episode was recorded using Microsoft Teams and produced with Camtasia 2023.

Brought to you by www.ciaopspatron.com

Resources

@directorcia

@directorcia@twit.social

Join my shared channel

CIAOPS merch store

Become a CIAOPS Patron

CIAOPS Blog

YouTube edition of this podcast

Windows 365 Frontline available in public preview

OneNote: Your Digital Notebook, Reimagined with Copilot

Quick Wins to Strengthen Your Azure AD Security

Automating and Streamlining Vulnerability Management for Your Clients

Phone Link for iOS is now rolling out to all Windows 11 customers

Introducing cloud.microsoft: a unified domain for Microsoft 365 apps and service

Centrally manage multiple Microsoft Sentinel workspaces with workspace manager

Announcing Windows LAPS management through Microsoft Intune

Practice Assessments for Microsoft Certifications

Profanity filtering control for live captions in Teams meetings