Category Security & Compliance

AZ-500: Microsoft Azure Security Technologies – EXAM PASSED!!!

AZ-500: Microsoft Azure Security Technologies

EXAM PASSED!!!

#Azure #Security #AzureSecurity #CertifiedProfessional #CloudSecurity #CloudFamily #CyberSecurity #MicrosoftAzure #MicrosoftCloud #Microsoft #alwaysbelearning #AZ500 #EXAM #PASSED 

Azure – Setup Azure Blueprints

Challenge: Separate subscriptions for multiple disciplines under the same Azure Active Directory Tenancy.

Required : Each subscription to have the same role assignments

Solution : Azure Blueprints to define a repeatable set of Azure resources

How ?

Azure Blueprints provides

  • Role & Policy Assignments
  • ARM templates
  • And Resource Groups

Reference guides

Getting Started Azure Blueprints (PREVIEW)

Creating Blueprint Guide – Focused on Roles

Create a blue print, if your new, start with a sample predefined Blueprint.

For this example I have selected Resource Groups with RBAC (Role-based Access Control)

Create blueprint> Enter Name, Description and Definition Location

Next : Artifacts

Click Save Draft


How to Publish Blueprint

Click Blueprints > Blueprint Definitions > Select the version to publish


Click Publish blueprint.

Enter version and change notes > Click Publish

Azure – Advisor

Sample screen shots of Azure Advisor

Recommendations : Cost , Security, High Availability, Performance, Operational Excellence

Example Recommendations report export, output as a PDF or CSV

Azure – AD Identity Protection

This feature looks to identify activity and assign a risk level. Risk detection and remediation”

All features look to be available in Azure AD Premium P2 and restricted number of features in Azure Premium P1 and Basic/Free.

Key differences are the notifications options only in Azure AD Premium P2.

There are three default polices

  1. User Risk
  2. Sign-In Risk
  3. MFA Registration

Example of the Identity Protection Policies

Reference How To Guides :

  1. How To: Configure the Azure Multi-Factor Authentication registration policy
  2. How To: Configure and enable risk policies
  3. How To : Identity protection configure notifications

Office 365 – Anti Malware Policy/ Mail Flow rule – Detected PS1 file – Email Attachment

A good starting point for this exercise was to find the Microsoft Post on Mail Flow rules to inspect message attachments. Available here. There is also a good reference page on common blocking scenarios.

Recently some of our users received received PS1 files as attachments. We wanted to raise awareness to our users about PS1 files by adding an additional disclaimer in emails received with PS1 attached file types.

If you try to send a PS1 file as an attachment, you will often get a notification, but it allows you to send the email.

Users of Outlook might receive the email still and be notified of a potentially unsafe attachment. Which is good. But what if they weren’t using Outlook?

Web Mail “Outlook” will give you a “No Entry” sign

Challenge : How do we create a mail flow rule to add a disclaimer to inbound emails with PS1 files attached?

How to Guide : Create Mail Flow Rules

Start in “Microsoft 365 Admin Center” and browse to “Exchange” Admin Center

You can created new rules by selecting “Mail Flow” > “Rules” > “+”> “Create a new rule”

This example Appends the Disclaimer when a PS1 file is recieved

Additional options (Optional)

Rule is configured

.. Test Mail example sent to a Microsoft 365 Exchange Mail box – Disclaimer added. See example screen shot below.

What is the difference in Microsoft 365 Enterprise Mobility + Security E3 and E5 Licenses

Today I’m looking at Microsoft 365 Enterprise Mobility + Security E3 and E5 Licenses and trying to work out which licenses I need and what the differences are. I’ve reviewed the guide on features and pricing, visit compare-plans-and-pricing

There are four key areas for Enterprise Mobility + Security:

  • Identity and access management
  • Managed mobile productivity
  • Information protection
  • Identity driven security

If you business it focused on Enterprise Mobility + Security E5 licenses but you need to save costs, its certainly worth reviewing what features your using and what is available / partially included in an Enterprise Mobility + Security E3 license. Microsoft would describe the differences as “Enterprise Mobility + Security E5 includes new and advanced security capabilities that make up our holistic and innovative approach to security for the mobile enterprise. Some E5 capabilities were previously only available as standalone products, such as Microsoft Cloud App Security, or as products in preview, such as Microsoft Azure Active Directory Identity Protection, Azure Active Directory Privileged Identity Management, and Azure Information Protection.”

A break down of the Key Additional Features in E5 and not in E3.

This is a quick break down of the additional features in the E5 license you don’t get in E3 currently. (Please check again, this is not a live feature list)

  • Risk-based conditional access (Explained further)
    • Register MFA – All Users
    • Password changed (High risk users)
    • Require MFA for medium to high risk users
  • Privileged identity management (PIM) – (Explained Futher)
    • Manage, Control and monitor important information or resources
  • Intelligent data classification and labelling (Azure Active Directory Identity Protection)
    • Automate the classification and labelling process ( Personal interpretation, not sure if that terminology is correct)
    • Azure identity Protection which can be leveraged in CA. Identity Protection Policies example
  • Microsoft Cloud App Security (Explained Further)
    • CASB Cloud Access Security Broker
  • Azure Advanced Threat Protection (ATP) – (Getting started with Azure ATP)
    • Detect, Identify Abnormalities, Advanced Attacks

So does you business have any other 3rd party tools already providing the features of E5? It might be worth noting some components Enterprise Mobility + Security E5 can be purchased separately, but the logic is a suite gives more value in a bundle.

Another good option to get hands on and try the full E5 license, why not run a PoC to see if the features of Enterprise Mobility + Security E5 with a free Trial (90 days offered when I wrote this)?

I hope this post helped, additional information is available direct from the Microsoft Site.

Apologise if any information is incorrect, this is just a personal review and no way related to Microsoft.

Office 365 – Alert Policy – Detected Malware in File – OneDrive or SharePoint

Security and Compliance Admin Center in Office 365 you can create alert policys.

Todays challenge was to setup an Alert Policy so an admin is notifed if a user adds a file to OneDrive or SharePoint containing Malware.

Start in “Office 365 Security & Compliance > Alerts Dashboard > New Alert Policy

I started by creating an Alert, selecting Threat Management & High Severity

Set the Trigger “Detected malware in file”

Select the Admins to be notified. I set a daily limit notification limit of 5 so I’m not get overloaded with the same alert.

Then “Finish” you have the option to turn the policy on or off

View “Alert polices”