Need to Know podcast–Episode 342

Join me for this episode with all the latest news and update from Microsoft as well as my take on the importance of logging as a security basic that many overlook. Plenty of security news in this episode especially around the latest exploits of MSHTA.EXE that you should be prepared for. Listen for all the information.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-342-logs/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show.

Resources

@directorcia

Join my shared channel

CIAOPS merch store

Become a CIAOPS Patron

CIAOPS Blog

CIAOPS Brief

CIAOPSLabs

Support CIAOPS

Comparing Copilot Chat included with Microsoft 365 to a paid Copilot license

Adobe and Microsoft Empower Marketers with AI Agents in Microsoft 365 Copilot

Introducing Copilot in the Microsoft 365 admin centers

Jailbreaking is (mostly) simpler than you think

Level up your defense: protect against attacks using stale user accounts

Defender XDR – Monthly news – March 2025

AI innovation requires AI security: Hear what’s new at Microsoft Secure

Microsoft Technical Takeoff: Windows + Intune

Continuing with Microsoft Entra: Advanced Identity Management

Phishing campaign impersonates Booking .com, delivers a suite of credential-stealing malware

Take Flight with Microsoft Security Copilot Flight School

Securing Your Nonprofit Environment (Part 1) – Enabling Security Defaults

Securing Your Nonprofit Environment (Part 2): Best Practices to Secure Your Admin Accounts

How to infect your PC in three easy steps

CIA Brief 20250322

image

Upgrade to Microsoft 365: Unlock the Power of the Cloud –

https://www.youtube.com/watch?v=zAVqDZN9BCk

Getting Started With Microsoft 365 Business Premium Video 01: Before You Begin –

https://www.youtube.com/watch?v=es8lisFPpBk

Comparing Copilot Chat included with Microsoft 365 to a paid Copilot license –

https://www.youtube.com/watch?v=ItcvkU528AI

Open shared Word, Excel, and PowerPoint files on iPhone and iPad devices without a Microsoft account –

https://techcommunity.microsoft.com/blog/microsoft365insiderblog/open-shared-word-excel-and-powerpoint-files-on-iphone-and-ipad-devices-without-a/4391659

Level up your defense: protect against attacks using stale user accounts –

https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/level-up-your-defense-protect-against-attacks-using-stale-user-accounts/4386290

Introducing Copilot in the Microsoft 365 admin centers –

https://www.youtube.com/watch?v=rMalGm0tBOY

The Enhanced “Edit in Grid” Experience for Document Libraries –

https://techcommunity.microsoft.com/blog/onedriveblog/the-enhanced-edit-in-grid-experience-for-document-libraries/4373895

New live chat in Microsoft Teams: Connecting customers and businesses effortlessly –

https://www.microsoft.com/en-us/microsoft-365/blog/2025/03/17/new-live-chat-in-microsoft-teams-connecting-customers-and-businesses-effortlessly/

Unlock the future of teamwork with Microsoft 365 Copilot in Teams –

https://www.youtube.com/watch?v=s9LX3SnLYpE

Defender XDR – Monthly news – March 2025 –

https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/monthly-news—march-2025/4391479

Peter is here –

https://unlocked.microsoft.com/minecraft-vatican/

How to deploy transformational enterprise-wide agents: Microsoft as Customer Zero –

https://www.microsoft.com/en-us/microsoft-copilot/blog/copilot-studio/how-to-deploy-transformational-enterprise-wide-agents-microsoft-as-customer-zero/

AI innovation requires AI security: Hear what’s new at Microsoft Secure –

https://techcommunity.microsoft.com/blog/microsoft-security-blog/ai-innovation-requires-ai-security-hear-what%E2%80%99s-new-at-microsoft-secure/4394130

Dow is targeting millions in cost savings with Microsoft 365 Copilot and agents –

https://techcommunity.microsoft.com/blog/microsoft365copilotblog/dow-is-targeting-millions-in-cost-savings-with-microsoft-365-copilot-and-agents/4393480

Unveiling the Shadows: Extended Critical Asset Protection with MSEM –

https://techcommunity.microsoft.com/blog/microsoft-security-blog/unveiling-the-shadows-extended-critical-asset-protection-with-msem/4394485

StilachiRAT analysis: From system reconnaissance to cryptocurrency theft –

https://www.microsoft.com/en-us/security/blog/2025/03/17/stilachirat-analysis-from-system-reconnaissance-to-cryptocurrency-theft/

Strengthening Email Security: Our New Approach to Non-RFC Compliant Emails –

https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-security-our-new-approach-to-non-rfc-compliant-emails/4338306

After hours

Can You Fool A Self Driving Car? – https://www.youtube.com/watch?v=IQJL3htsDyQ

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

ASD Configuration policy templates for Intune

image

The Australian Signals Directorate (ASD) has produced a number of recommended configuration policies for Intune as part of their Secure Cloud initiative. You can find them here:

ASD Configuration policies

Edge hardening guidelines

All Macros disabled

Macros enabled for trusted publishers

Office Hardening guidelines

Windows hardening guidelines

User rights assignments

Theses policies are in TXT format but are effectively just JSON files.

I have therefore takes these TXT files, renamed to JSON files and uploaded into my best practices repository here:

CIAOPS Best Practice Repo – ASD recommended policies

It would have been good if the ASD had placed in their own repo so they could easily be monitored for updates. Alas, maybe in the future.

So for now you can import these files directly from my repo into your Intune and I’ll try and do my best to keep them current with what the ASD does.

Mastering Autonomous Actions with Copilot Studio: A Step-by-Step Guide

https://www.youtube.com/watch?v=U_M2nGwFGBg

In this video, I provide an in-depth tutorial on using Copilot actions within Copilot Studio to create autonomous agents. I demonstrates how to set up triggers, specifically focusing on activating an agent when a new email arrives. I walk through the process of creating a trigger using Power Platform, configuring the agent to respond to emails, and enabling orchestration to ensure seamless operation. I also shares practical tips and insights from his experience, emphasizing the importance of clear instructions and matching action names. This video is ideal for anyone looking to automate tasks using Copilot Studio and Power Platform.

Key topics covered:

  • Setting up triggers for autonomous actions

  • Configuring agents to respond to emails

  • Using Power Platform for automation

  • Enabling orchestration in Copilot Studio

  • Practical tips for successful implementation

Watch this video to learn how to effectively use Copilot actions to automate your workflows and enhance productivity.

CIA Brief 20250315

image

How-To Sync EntraID Group Memberships Into Any System –

https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/how-to-sync-entraid-group-memberships-into-any-system/4383082

Microsoft Security Implementation Proof of Concept by Lighthouse with Microsoft 365 Defender –

https://www.youtube.com/watch?v=rxiVirns1D4

Announcing a Limited Preview of GPT-4.5 in Copilot Studio –

https://www.microsoft.com/en-us/microsoft-copilot/blog/copilot-studio/announcing-limited-preview-gpt-4-5-microsoft-copilot-studio/

Phishing campaign impersonates Booking .com, delivers a suite of credential-stealing malware –

https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-impersonates-booking-com-delivers-a-suite-of-credential-stealing-malware/

Copilot supports communication in every style –

https://techcommunity.microsoft.com/blog/Microsoft365InsiderBlog/copilot-supports-communication-in-every-style/4386393

Securing Your Nonprofit Environment (Part 2): Best Practices to Secure Your Admin Accounts –

https://techcommunity.microsoft.com/blog/nonprofittechies/securing-your-nonprofit-environment-part-2-best-practices-to-secure-your-admin-a/4385305

Jailbreaking is (mostly) simpler than you think –

https://msrc.microsoft.com/blog/2025/03/jailbreaking-is-mostly-simpler-than-you-think/

Improve your DLP maturity with DLP Analytics –

https://techcommunity.microsoft.com/blog/microsoft-security-blog/improve-your-dlp-maturity-with-dlp-analytics/4392655

Take Flight with Microsoft Security Copilot Flight School –

https://techcommunity.microsoft.com/blog/securitycopilotblog/take-flight-with-microsoft-security-copilot-flight-school/4391712

Defending Against OAuth-Based Attacks with Automatic Attack Disruption –

https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/defending-against-oauth-based-attacks-with-automatic-attack-disruption/4384381

Boost customer engagement with live chat in Microsoft Teams –

https://www.youtube.com/watch?v=y_fTX0E08BU

Introducing Microsoft Entra Health alerts: An enhancement to tenant health monitoring –

https://techcommunity.microsoft.com/blog/microsoft-entra-blog/introducing-microsoft-entra-health-alerts-an-enhancement-to-tenant-health-monito/4352583

New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects –

https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/

Built-in report button is available in Microsoft Outlook across platforms –

https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/built-in-report-button-is-available-in-microsoft-outlook-across-platforms/4388434

Blog Series: Charting Your Path to Cyber Resiliency –

https://techcommunity.microsoft.com/blog/microsoft-security-blog/blog-series-charting-your-path-to-cyber-resiliency/4390355

After hours

Gemini Robotics: Bringing AI to the physical world – https://www.youtube.com/watch?v=4MvGnmmP3c0

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

SharePoint Agents PAYG costs

image

To get a better idea of the costs of using SharePoint Agents, I’d suggest you have a look at:

https://techcommunity.microsoft.com/blog/spblog/consumption-based-pricing-for-sharepoint-agents/4389591

with the highlight being:

Under the PAYGO model, customers are billed $0.01 per message. Each interaction with a SharePoint agent uses thirty-two (32) messages, so customers are billed at $0.32 per interaction with SharePoint agents. The PAYGO meter uses your Azure subscription as the payment instrument, ensuring seamless integration with existing billing processes. This meter is available worldwide.

and

There are no in-product feature differences between the PAYGO meter, and the SharePoint agent included in the Microsoft 365 Copilot license. Users have the same capabilities and benefits, regardless of the billing model they choose.

Thus, with each interaction being $0.32, let say that typically a user will interact with SharePoint agents three times during any inquiry. That makes it about $1 per enquiry. If we now say that an average user will make 20 inquiries per day, that is $20 per user per day. Multiply that across all the users in an organisation and you can see how it could get very expensive very quickly.

Clearly then, pay as you go SharePoint agents is for very low volume of usage across the organisation, typically one enquiry per day. Otherwise, it make more sense to buy a full license of Microsoft 365 Copilot for the user in question because they effectively get unlimited SharePoint agent enquiries as well as a personal AI assistant plus more.

If you combine any other pay as go usage of Copilot, such as with Copilot Studio as I have outlined before, then it make far more sense to get a full Microsoft 365 Copilot for those who need to use any AI tools. However, pay as you go billing does provide you the flexibility to mix and match with full Microsoft 365 Copilot licenses. If you have a business with 5 major users and 20 casual users then teh starting point is for those 5 users to have full Microsoft 365 Copilot license, while the rest simply use an Azure subscription to cover any incidental costs until the point when another person in the business needs a full license.

To keep control of any SharePoint or Copilot pay as you go, you shoudl always set up a budget in Azure as I have outlined before with Security Copilot

Pay as you SharePoint agents do provide a degree of flexibility of quickly and easily enabling AI across your SharePoint information for your whole organisation but if usage of AI starts to grow then so too will the costs, and potentially quite dramatically if appropriate limits are not configured. The best option with pay as you go SharePoint agents then is its use in combination with full Microsoft 365 Copilot licenses for users who need to use AI extensively in their jobs, while casual users can remain on the pay as you go option. The good news is that you do have the flexibility to mix and match with the two types of licenses as needed and Azure does give you the added benefit of being able to turn off immediately where Microsoft 365 Copilot licenses are typically an annual commitment.