Setup a Microsoft 365 Developer subscription with E5 License – 90 days Rolling

The following steps show how to Add the E5 Subscriptions in your 365 Developer Subscription. Follow steps to register for the developer subscription 1st

After the “Welcome to the Microsoft 365 Developer Program.”

Click Set up E5 Subscription

Follow the setup steps below:

Join the Developer 365 Program – Includes E5 License – 90 days Rolling

Microsoft have a developer subscription option Microsoft 365 Developer Program FAQ | Microsoft Docs

“subscription is good for 90 days and is renewable based on valid developer activity. If you’re using your subscription for development, it will be renewed every 3 months and will last indefinitely.”

Set up a Microsoft 365 developer subscription | Microsoft Docs

Join the Microsoft 365 Developer Program | Microsoft Docs

Steps to setup – “Join the Microsoft 365 Developer Program today!”

Click : https://developer.microsoft.com/en-us/microsoft-365/dev-program

Joining the program and Create a new account (I Created a new email just for this developer work)

We then get presented with a Dashboard – Microsoft developer center and technical documentation

Time to Explore > click Microsoft 365 > Learn more > Join Now

Clicked “Join Now” and got a missing info prompt.

Join the Developer Program

Select an options

Now you are Setup. Continue to steps for adding E5 license

Block Downloads In MS TEAMS Thick Client For Non Managed Computers

How to remove the download, save as or print option from the MS Teams thick client application on unmanaged device, logged into your corporate tenancy via a conditional access policy.

  1. Create a group : Block_Teams_Thick_Client_Downloads
  2. Add users to the group you want to block access to download, save as or print.
  3. Create a new conditional access policy – Example : Block Teams Thick Client Downloads
    1. Users and Groups add “Block_Teams_Thick_Client_Downloads”
    2. Cloud Apps or Actions – Select Apps – MS Teams
    3. Conditions – Select Client Apps> Configure >Yes> Tick : Mobile Apps, Exchange and Other Clients. Untick Browser.
    4. Device state (Currently in preview) > Set exclude > Tick : Hybrid Azure AD joined and Device marked as compliant
    5. Grant – Select > Block Access and For Multiple controls > “Require one of the selected controls”

Useful links:

Block Access From Unmanaged Devices To SharePoint or Specific Sites

Block Access From Unmanaged Devices To SharePoint

From SharePoint Admin Center > Polices > Access Control

Click Unmanaged Devices

Note “To use this setting, get a subscription to Enterprise Mobility + Security and assign a license to yourself. ” See Microsoft Endpoint Manager | Microsoft 365 for more information

Select Block Access > Save

Block Access From Unmanaged Devices To SharePoint Specific Sites and Limit access using PowerShell.

Examples block download, save and print on unmanaged devices for a specific SharePoint site (SharePoint, OneDrive)

  • Limit access to a single site: Set-SPOSite -Identity https://<SharePoint online URL>/sites/<name of site or OneDrive account> -ConditionalAccessPolicy AllowLimitedAccess

     

  • Block access to a single site: Set-SPOSite -Identity https://<SharePoint online URL>/sites/<name of site or OneDrive account> -ConditionalAccessPolicy BlockAccess

     

  • Update multiple sites at once: (Get-SPOSite -IncludePersonalSite
    $true -Limit all -Filter
    “Url -like ‘-my.sharepoint.com/personal/'”) | Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess

How to Enable “Security Defaults” in Azure and Office 365

Security Defaults in Azure Portal. IMPORTANT, SECURITY DEFAULTS IS NOT ALWAYS ENABLED BY DEFAULT. YOU MUST CHECK YOUR SETTINGS

What does Security Defaults give you? Security Defaults when enabled provide the following preconfigured security settings:

  • Requiring all users to register for Azure AD Multi-Factor Authentication.
  • Requiring administrators to perform multi-factor authentication.
  • Blocking legacy authentication protocols.
  • Requiring users to perform multi-factor authentication when necessary.
  • Protecting privileged activities like access to the Azure portal.

Azure Active Directory security defaults | Microsoft Docs

How do you enable? Azure Active Directory > Properties > Manage Security Defaults > Yes > Save

Useful links:

Discovering and blocking legacy auth:
Discovering and blocking legacy authentication in your Azure and Microsoft 365 subscriptions – Jussi Roine

Understanding Modern vs Legacy auth:
Understanding Modern vs. Legacy Authentication in Microsoft 365 – Ru365 (campbell.scot)

MS365 – Azure AD – Dynamic Groups and Expiration Settings

Maintain groups in Azure AD with dynamic groups and set expiration settings.

Example scenario : Controlling remote access to sub contractors working on a short term project. The project owner should remove all access for sub contractors after the project completes

How to guide :

If we combine Dynamic Groups and Expiration settings, we can automatically populate groups and then invoke regular check to maintain groups are still required. Group owners will be reminded regularly to verify groups are required. Owners will have a better understanding of who has access and this help assist with your security policies.

Dynamic Group Example

Steps: Azure Active Directory > New Group > Type : Office 365 > Name, Description, Dynamic User > Owner > Dynamic user Members

Group Name : Sub Contractors    – Set the value for department equals “Sub Contractor”

Dynamic User Members    – Add Experssion

(user.department -eq “Sub Contractor”)

Configure Group lifetime / Expiration Settings

Steps: Azure Active Directory > Groups > Expiration > Days > No Owner email > Selected > Group > Save

“Renewal notifications are emailed to group owners 30 days, 15 days, and one day prior to group expiration. Group owners must have Exchange licenses to receive notification emails. If a group is not renewed, it is deleted along with its associated content from sources such as Outlook, SharePoint, Teams, and PowerBI.” Info from the portal Expiration settings.

Office 365 Security and Compliance – Alert When A Specific File Is Accessed

When a very important file stored in OneDrive needs to be monitored. This is how to create an alert on file activity. We specifically want to monitor and alert on any activity done to the specific file by any user.

This example file is called HR.doc and is stored in OneDrive.

This is how we created an alert policy for file activity of the file “HR.doc”.

Open Office 365 Security & Compliance

https://protection.office.com/alertpolicies

Alerts > Alert Policies > New Policy

Options selected

  • Status – Enabled
  • Severity – Medium
  • Category – Information Governance
  • Conditions – Activity is File Activity and File name is HR.doc
  • Scope – All Users
  • Email Recipients – email address
  • Limit the number of notifications – optional. 5 in this example

Test the alert by trying to modify or access the file.

Result

Alert email notification as shown below.

This logs an alert which then should be reviewed and investigated

Action the Alert

Content Search – Security And Compliance – Search A Mailbox For Specific Content And Then Export Results

If you’re doing some compliance investigation work, you may need to search a user’s mailbox for specific words.

This is how To Search Email Content in Office 365 Security & Compliance for a specific user which sent email containing a specific word then export results.

Reference guides – Content search

Microsoft Docs Content Search

Microsoft Docs Export Search

Content Search : How to search a mailbox for specific keywords and export the data

Mircosoft 365 Admin Center -> Compliance Admin Center

Content Search > + New Search

New Search > Keywords “Blog” example > Specific Locations > Modify > Choose Users, Groups or Teams

Enter users name > Select > Choose

Done > Save > Save & Run > Save Search

This search will trigger a default alert email to be sent out

Next step, Export the results

Unable to preview results problem or export?

If you cannot preview, you need to add a role to the user account, eDiscovery Administrator role (Example) or eDiscovery Manager for specific cases / Compliance Admin / Compliance Data Administrator

You must sign out and sign in for the groups to take effect.

Now back to the search

After the you can see the preview, now you can click Export

Click Export > ReportsOnly or Export > Copy to clipboard export key > Download report > Install eDiscovery Export Tool

Export tool installs

Use the Export Key and Set a directory. 

File Downloads

Now you can open the report exported

MS 365 Compliance Admin Portal Error – Status code: 503

Issue : Trying to connect to Compliance Admin Portal to Run a content search. Error – Status Code : 503

“The operation could not be completed. Please try again later. If the problem persists, contact Microsoft support.”

https://compliance.microsoft.com/homepage

Error – Status Code : 503

Error


The operation could not be completed. Please try again later. If the problem persists, contact Microsoft support.

Show details


Request: /api/contextinfo/

Status code: 503

Diagnostic information: **{Version:17.00.4803.004,Environment:WEUPROD,DeploymentId:ee****************e9d84,InstanceId:WebRole_IN_3,SID:ea*********81c9,CID:5b8***416}

Time: Tue, 09 Jun 2020 09:47:27 GMT

Trouble loading the page

REFRESH. Tried once. Same. Waited a few mins. Connected

Searches crashing.. Tuesday problems

Request: /api/ComplianceSearch?id=Blog+Mail+Search

Status code: 503

Diagnostic information: **{Version:17.00.4803.004,Environment:WEUPROD,DeploymentId:ee608**********84,InstanceId:WebRole_IN_3,SID:eaf****1c9,CID:433***0}

Time: Tue, 09 Jun 2020 10:28:55 GMT

Finally Ran a Content Search and another page loading error

Content search

Show in navigation

Sorry, we’re having trouble loading the page. Try refreshing the page later. (page: /Ediscovery/ContentSearch/Management)

Refreshed… Paused… Refreshed 5mins later…

Reason : Check Service Health

Service Incident “Users may also encounter similar issues when attempting to access the Security & Compliance Center.”

Solution : Intermittent Refresh Screen / Wait for Microsoft to Resolve Service Issues