When a very important file stored in OneDrive needs to be monitored. This is how to create an alert on file activity. We specifically want to monitor and alert on any activity done to the specific file by any user.
This example file is called HR.doc and is stored in OneDrive.
This is how we created an alert policy for file activity of the file “HR.doc”.
Open Office 365 Security & Compliance
Alerts > Alert Policies > New Policy
- Status – Enabled
- Severity – Medium
- Category – Information Governance
- Conditions – Activity is File Activity and File name is HR.doc
- Scope – All Users
- Email Recipients – email address
- Limit the number of notifications – optional. 5 in this example
Test the alert by trying to modify or access the file.
Alert email notification as shown below.
This logs an alert which then should be reviewed and investigated
Action the Alert
MS-101: Microsoft 365 Mobility and Security
#MS365 #Security #365Security #CertifiedProfessional #CloudSecurity #CloudFamily #CyberSecurity #Microsoft365 #MicrosoftCloud #Microsoft #alwaysbelearning #MS101 #EXAM #PASSED
Licenses and Limitations of Encryption and Exchange Online in you Microsoft 365 subscription.
Example Send a New message and there is an “Encrypt” button. Great feature but is there a gotcha you need to configure or another license version you require?
Slightly frustrating a button exists even if its not configured and gives your end users and error message.
“Your machine isn’t set up for Information Rights Management (IRM). To set up IRM, sign in to Office, open and existing IRM protected message or document, or contact your help desk.”
You created and new message in Outlook, clicked options, Encrypt, and Connect to Rights Management Servers and get templates
You received this message because RMS isn’t setup in your Microsoft 365 tenancy. Azure Information Protection is only included with certain licenses in Office 365. See License Data Sheet.
OME stands for Office 365 Message Encryption (OME).
OME is offered as part of “Office 365 Enterprise E3 and E5, Microsoft Enterprise E3 and E5, Microsoft 365 Business Premium, Office 365 A1, A3, and A5, and Office 365 Government G3 and G5.”
Microsoft provide this guide to choosing your activation method.
A good starting point for this exercise was to find the Microsoft Post on Mail Flow rules to inspect message attachments. Available here. There is also a good reference page on common blocking scenarios.
Recently some of our users received received PS1 files as attachments. We wanted to raise awareness to our users about PS1 files by adding an additional disclaimer in emails received with PS1 attached file types.
If you try to send a PS1 file as an attachment, you will often get a notification, but it allows you to send the email.
Users of Outlook might receive the email still and be notified of a potentially unsafe attachment. Which is good. But what if they weren’t using Outlook?
Web Mail “Outlook” will give you a “No Entry” sign
Challenge : How do we create a mail flow rule to add a disclaimer to inbound emails with PS1 files attached?
How to Guide : Create Mail Flow Rules
Start in “Microsoft 365 Admin Center” and browse to “Exchange” Admin Center
You can created new rules by selecting “Mail Flow” > “Rules” > “+”> “Create a new rule”
This example Appends the Disclaimer when a PS1 file is recieved
Additional options (Optional)
Rule is configured
.. Test Mail example sent to a Microsoft 365 Exchange Mail box – Disclaimer added. See example screen shot below.
Today I’m looking at Microsoft 365 Enterprise Mobility + Security E3 and E5 Licenses and trying to work out which licenses I need and what the differences are. I’ve reviewed the guide on features and pricing, visit compare-plans-and-pricing
There are four key areas for Enterprise Mobility + Security:
- Identity and access management
- Managed mobile productivity
- Information protection
- Identity driven security
If you business it focused on Enterprise Mobility + Security E5 licenses but you need to save costs, its certainly worth reviewing what features your using and what is available / partially included in an Enterprise Mobility + Security E3 license. Microsoft would describe the differences as “Enterprise Mobility + Security E5 includes new and advanced security capabilities that make up our holistic and innovative approach to security for the mobile enterprise. Some E5 capabilities were previously only available as standalone products, such as Microsoft Cloud App Security, or as products in preview, such as Microsoft Azure Active Directory Identity Protection, Azure Active Directory Privileged Identity Management, and Azure Information Protection.”
A break down of the Key Additional Features in E5 and not in E3.
This is a quick break down of the additional features in the E5 license you don’t get in E3 currently. (Please check again, this is not a live feature list)
- Register MFA – All Users
- Password changed (High risk users)
- Require MFA for medium to high risk users
- Manage, Control and monitor important information or resources
- Automate the classification and labelling process ( Personal interpretation, not sure if that terminology is correct)
- Azure identity Protection which can be leveraged in CA. Identity Protection Policies example
- CASB Cloud Access Security Broker
- Detect, Identify Abnormalities, Advanced Attacks
So does you business have any other 3rd party tools already providing the features of E5? It might be worth noting some components Enterprise Mobility + Security E5 can be purchased separately, but the logic is a suite gives more value in a bundle.
Another good option to get hands on and try the full E5 license, why not run a PoC to see if the features of Enterprise Mobility + Security E5 with a free Trial (90 days offered when I wrote this)?
I hope this post helped, additional information is available direct from the Microsoft Site.
Apologise if any information is incorrect, this is just a personal review and no way related to Microsoft.
April 27, 2020
MS-100: Microsoft 365 Identity and Services
#M365 #Security #M365Security #CertifiedProfessional #CloudSecurity #CloudFamily #CyberSecurity #Microsoft365 #MicrosoftCloud #Microsoft #alwaysbelearning #MS100 #EXAM #PASSED