When configuring Intune \ ASR (Attack Surface Reduction) policies for Windows Servers.

Why will the ASR policies not apply??

There is one setting in Intune\ Endpoint Security that is not compatible with ASR policies assigned to Windows severs, which is applicable to both Defender for Endpoint for servers plan 1or 2.

Within the ASR policy the following policy needs to remain – ‘Not Configured’

Once this policy remains ‘Not Configured’ , ASR rules can successfully apply to servers that are protected with Microsoft Defender for Server plan 1 & 2

Ref: https://www.linkedin.com/in/paul-costello-12950a101/

Microsoft do not update security baselines that are available in the Microsoft Intune portal very often. The Security Compliance Toolkit and Baselines HERE , which has been updated as recently as 11th of October 2023, provides the following baselines.

• Windows 10 version 22H2 Security Baseline
• Windows 11 version 22H2 Security Baseline
• Microsoft 365 Apps for Enterprise 2306
• Microsoft Edge v117 Security Baseline
• Windows Server 2022 Security Baseline

Windows Server 2022 Baseline

Dean Ellerby, has an excellent post on how to enrol Windows Servers for MDE protection and management: HERE

1. Download latest Security Compliance Toolkit and Baselines: HERE
2. Browse to Intune \ Devices \ Group Policy analytics

3. Click on : Import Group Policy Object Files

The extracted files will look like below, browse to ‘GP Reports’ and then select each ‘gpreport.xml’

4. We then select the MSFT Windows Server 2022 – Defender Antivirus policy

5. We then select : Migrate

6. Select all settings on this page and next

7. Give the policy a name

8. Assign the policy to a Microsoft Entra ID dynamic device group containing Microsoft Windows servers or a manually configured security group.

MSFT Windows Server 2022 – Member Server Base Line

These settings cannot be managed by Microsoft Intune, however the settings can be exported to a csv and then use a tool like Azure Logic Apps or Azure Automation Functions to apply the base line settings.

1. Select MSFT Windows Server 2022 – Member Server

2. The select export

3. The export process will export all of the settings that can be re-used in Azure Automation

Windows 11, Microsoft Edge and Microsoft 365 Apps for Enterprise Baselines

The built in Windows 10 and later, Microsoft Edge compliance policy, have configuration settings that conflict with Microsoft Defender Endpoint configurations, specifically ASR (Attack Surface Reduction) policies, some of these settings cannot be excluded from the default : ‘Windows 10 and later, and Microsoft Edge compliance policies’

Import all of the gpreport.xml files for Windows 11, Microsoft Edge and Microsoft APPs for Enterprise as described in the Windows Server 2022 baseline section. The image below high lights what policies can be exported and then create endpoint security policies or Windows device configuration policies.

Summary

In this blog post , I am mainly focusing on Windows 11 22H2 and the latest build of Windows Server 2022.

Some of the main benefits of using the ‘Microsoft Security Compliance Toolkit and Baselines’

• Typically, when devices are onboarded to Microsoft Defender for Endpoint, there can be a lot of notifications in terms of vulnerabilities and recommendations. A lot of these notifications and recommendations can be resolved, when ensuring end user Windows 11 and Windows Server 2022 devices have up to date security baselines
• Microsoft provide a delta spreadsheet with all changes when a new ‘Microsoft Security Compliance Toolkit and Baseline’ is released
• The new policies for Windows 10 and later, uses , the ‘Settings Catalog’ template in Intune. It is very easy to remove configurations that conflict with ‘Microsoft Endpoint Security Policies’
• I love Google Chrome and have used it for years, but my preference is to block Google Chrome on all managed devices and use one browser: Microsoft Edge on all platforms.
• Windows Server 2022 Security Baseline policies can be exported and applied via automation in Azure and then updated with the delta information from new releases of ‘Microsoft Security Compliance Toolkit and Baselines’
  
  If anyone, or any organisation would like some further assistance with this, please get in touch with me via LinkedIn : https://www.linkedin.com/in/seanofarrelll/

Reference: Simon Hartmann Eriksen https://www.simsenblog.dk/2023/05/08/security-baseline-latest-as-settings-catalog/

The Microsoft website : https://microsoft365dsc.com/ explains all things, regarding Microsoft DSC, including configuration, export, import, synchronisation etc..

Microsoft have made things a lot easier compared to earlier versions of Microsoft365 DSC. It is now possible to select which configuration policies can be backed up and re-used from the numerous M365 technologies via the Microsoft365DSC Portal: https://export.microsoft365dsc.com

This blog post will focus on the most common M365 configurations that can be re-used in multiple M365 tenants, to speed up deployment and also remove human error, which can often occur from manual configuration.

Where to start

Browse to https://export.microsoft365dsc.com/ and then select the configuration items per M365 technology, that you would like to re-use in, another M365 tenant, tenants’ or a research and development M365 tenant.

Microsoft Entra ID \ Azure Active Directory

The items highlighted in yellow, could be potentially be used per M365 tenant, tenants’ or a research and development M365 tenant.

Items : Highlighted in red

Microsoft have recently added, conditional access templates, which was a very welcome addition, however, I still prefer to use PowerShell to implement Conditional Access Policies, which can be unique per organisation.

Exchange Online

The items highlighted in yellow, could potentially be used per M365 tenant.
I do not like using the Exchange Online, standard and strict protection templates, as they cannot be re-configured.

My preference is to run an Exchange Online Orca Report and then review the recommendations and tweak the configuration per organisation. Microsoft Exchange Online security policies should always come first.

Intune

Intune DSC, for me, this is by far the most beneficial use case.

Device security ( Jeffrey Appel’s : Defender for Endpoint – Ultimate Blog Series)
Jeffrey’s blog series, doesn’t just focus on Microsoft Defender for Endpoint configurations, it includes a lot of Windows 10 and later, hardening policies, which should be used in every organisation. It takes a long time to configure these policies! M365 DSC can, re-use these configurations polices, if Jeffrey, updates his blog series, the change can be made in a research and development M365 tenant, tested and then pushed to a production tenant.

The following images that contain items highlighted in yellow , could be potentially used per M365 tenant.

Additional M365 DSC modules

• Office 365 : do not re-use per M365 tenant
• OneDrive: do not re-use per tenant, however an Intune ‘IntuneDeviceConfigurationAdminisrativeTemplatePolicyWindows10; can be re-used to configure One Drive for Business configuration and governance
• Planner : do not re-use
• Power Platform : do not re-use
• Security and Compliance: do not re-use, (unique per organisation)
• SharePoint : do not re-use, (unique per organisation)

Teams

The following images that contain items highlighted in yellow , could be potentially be used per M365 tenant

Summary

This blog post , attempted to highlight the practical and beneficial usage of M365 DSC.

An IT services provider can, standardise configurations in line with best practices and re-use these configurations per customer.

Microsoft consistently drives innovation and adaptability to meet evolving industry demands.

An organisation can test emerging M365 technologies in a research and development M365 tenant, and when the organisation has completed testing etc, the configuration can be synchronised to the organisation’s production tenant or tenants’, which can control and mitigate risks, with regards, simply allowing an M365 tenant accept all new and emerging technology features from Microsoft. It can also accelerate the adoption of new and emerging technology features from Microsoft, when an organisation has fully tested these new features and is ready to deploy the new features in their production tenant or tenants’

If anyone, or any organisation would like some further assistance with this, please get in touch with me via LinkedIn : https://www.linkedin.com/in/seanofarrelll/

Microsoft’s unwavering commitment to security and compliance has consistently driven innovation and adaptability to meet evolving industry demands. Their dedicated security and compliance portals have left the legacy portal, portal.office.com, in the not too distant past.

One common frustration for M365 administrators is the inability to assign the following roles within Microsoft Privileged Identity Management:

• Microsoft Purview roles’
• Microsoft Defender roles’
• Microsoft Dynamic roles’
  
  This blog post will primarily delve into the assignment of Microsoft Purview roles. The image below showcases the default role assignment choices available in Microsoft Privileged Identity Management.
  

Microsoft Purview Roles

Microsoft has invested significantly in their portal redesign at compliance.microsoft.com. In traditional scenarios, IT administrators often find themselves tasked with configuring, executing, exporting e-discovery case results, and subsequently reporting to compliance officers, data protection officers, or HR departments. However, entrusting IT admins with these compliance tasks raises initial concerns about data protection. It’s imperative that IT admins remain unaware of sensitive information contained within e-discovery case results, as these results might encompass IT admin staff within the search criteria.

As of the time of this post, there are approximately 95 role groups within M365 Purview. Here are some practical use cases illustrating how these roles can be assigned to fulfil various compliance roles and organizational requirements:

• e-discovery
• Insider Risk Management
• Privacy Management
• Data Investigator

How to Assign Microsoft Purview Roles to Microsoft Entra ID Groups

Note: For the purposed of this blogpost, I created a Microsoft CDX tenant, all users and screenshots are fictional.

1: Create a Microsoft Entra id group. Important, to not add any members or owners

2: Login to Microsoft Entra Privileged Identity Management and select Groups.

3.Seclect Discover Groups

4.Search for the previously created group and then select manage groups

5.Select groups in Privileged Identity Management

6. Click on assignment, add members to eligible assignments, this is why , we did not need to add any group members in step 1

7. Click on settings and member

8. Edit the member settings

9. Set hours to 4, require justification on activation, require approval to activate and then finally select the approver. The approver may be different per role that requires activation.

10. Create a role group in the compliance.microsoft.com portal : Microsoft Purview Permissions

11. Name the role group

12. Add the roles.

Select all roles

13. Choose groups and add the group that was created previously

14. Now the end user Adele Vance can login to https://entra.microsoft.com /identity governance / Privileged Identity Management and select ‘Activate just in time’

15. The user then selects group, activate and provides a business justification.

16. The group owner and admin , receives an email notification, that there is a pending just in time access request and can choose to approve or deny the request.

17. The compliance officer can then login to complicane.microsoft.com and perform his\her compliance activities. During my testing, no license was required for the compliance officer. I am sure Microsoft would insist that the compliance officer has an M365 E5 or E5 compliance add-on license:)

Summary

The technical steps outlined in this blogpost, enable organisations to apply Privileged Identity Management policies to roles \ permissions control in services like

• Microsoft Purview roles’
• Microsoft Defender roles’
• Microsoft Dynamic roles’

M365 Purview roles are not available in M365 roles or Microsoft Entra ID Privileged Identity Management, for really good reasons. M365 Purview role \ permission elevation , can be typically required for legal disputes.

Every organisation, should consider compliance and governance with a cloud transformation journey where services, data and line of business workflows, transition from on-premises to Microsoft cloud services.

If anyone, or any organisation would like some further assistance with this, please get in touch with me via LinkedIn : https://www.linkedin.com/in/seanofarrelll/

What is password less authentication?

What is Microsoft’s Password less strategy?

There have recently been an increased amount of brute force password spray attacks against M365 \ Azure AD tenants.

The obvious protection is to implement (MFA) Multi Factor Authentication as the first line of defence.

A complex 8 character password that is not protected with MFA can be cracked in 24 hours or less.

I recently worked on a project where some M365 user accounts were brute force password sprayed attacked over 20,0000 times in a single month.

A lot of organisations make the mistake of having a ‘Meet the Team’ section on their corporate website, including the senior team member’s email addresses, which is one of the first places a bad actor will target.

Bruce force password spray attacks are not performed by human beings, they are performed by bots, hosted on private cloud networks or some public cloud networks……

A simple solution to protect an organisation against brute force password spray attacks is to enable Microsoft password less, gps authentication and biometric authentication via the Microsoft Authenticator application.

Conditional access policies that allow or block countries are not effective as a bad actor can simply mask their IP and pick any country code IP that they choose.

Microsoft password less authentication methods

Microsoft Authenticator
FIDO2-compliant security keys 
Windows Hello for Business
Microsoft password less methods wizard

Microsoft Authenticator password less authentication mechanism
To enable password less and GPS location authentication , please implement and test the following configuration.
1. Browse to Azure Active Directory\ Security \ Authentication Methods
2. Select Microsoft Authenticator

3. Enable and target a test group before enabling the feature for all users

4. Select the following 3 configurations

Microsoft Authenticator Application Configuration

The end user must enable phone sign in on the Microsoft Authenticator application. Currently, this can only be enabled for one password less account on Android, but multiple accounts on iOS.

End User Experience

No password

Click yes if you are in Dublin, no if the GPS notification is displaying an incorrect location. The GPS location, protection mechanism must be communicated to end users. Do not click yes if the GPS co-ordinates specifies Hong Kong, if you are in Dublin

The final step is to validate via biometric thumbprint on your Android or iOS device.

Summary

Brute force password spray attacks cannot succeed when the following authentication methods are in place.

1: Password less
2: GPS verification
3: Biometrics validation on the Microsoft Authenticator application

The end user experience is much more user friendly, and most importantly a lot more secure.

This blog post will focus on the triggers and actions available in the ‘Microsoft Defender ATP API’ and how Power Automate can, automate tasks using this API.

The number 1, recommendation is to use Microsoft Sentinel. In my view SIEM without SOAR is useless.

When can an organisation be truly ready to enable SOAR automation for Windows 10\11 endpoints?

The Microsoft portal security.microsoft.com/Vulnerability Management/recommendations section provides recommendations on all endpoint vulnerabilities.

How does this section of the Microsoft security portal, provide recommendations on devices that have not been enrolled into Microsoft Defender for Endpoint management? This can be controlled via the Microsoft security portal device discovery configurations.

Typically organisations do not transition, straight away to using (MEM) Microsoft Endpoint Manager to provide software update services.

A remediation task in MEM to update a version of Google Chrome or Notepad ++, can only be actioned if, MEM is controlling software updates and if the latest versions of Google Chrome or Notepad ++ are available in the MEM Microsoft Windows application repository for Windows 10\11 devices.

I recommend that an organisation, responds to all security.microsoft.com/Vulnerability Management/recommendations, via their existing software update service prior to transferring update services to MEM. MEM provides excellent automated software update services to Microsoft software products, but can be quite cumbersome when it comes to updating 3rd party software products, like Google Chrome and Notepad ++

Some organisations, make the mistake, and think that enabling (MDFE) Microsoft Defender for Endpoint – auto remediation, will just work and protects endpoints from all threats.

The Microsoft ‘Defender Vulnerability Management add-on license‘, provides the ability to create some of the following, security baseline assessments.

Run these baselines , my preference is the CIS security baseline and improve the security posture of an organisation’s Windows 10\11 devices as much as possible before implementing, Microsoft Defender for Endpoint – Auto Remediation, or Microsoft Defender automation tasks via Power Automate or Microsoft Sentinel.

The Microsoft : security.microsoft.com portal provides a service called ‘Custom detection rules’, however the frequency of ‘custom detection rules’ is ‘every hour’, which is not good enough.

Power Automate – automated protection via the ‘Microsoft Defender ATP API’

Firstly, there are two amazing blog posts that describe the process of using Power Automate on how to auto isolate, Windows 10\11 devices, based on their severity risk level.

Nächster Artikel : extending-mdatp-alerting-sending-text-messages-sms-and-push-notifications
Ammar Hasayen: MS Flow and MS Defender ATP Integration

Microsoft Defender ATP API’ Triggers

‘Microsoft Defender ATP API’ Actions
The following actions, clearly illustrate the power of the ‘Microsoft Defender ATP API’, when an organisation has improved their security posture with Windows 10\11 devices. With some Power Automate or Microsoft Sentinel runbooks, these actions can enable an organisation to protect a bespoke line of business work flow on endpoint devices.

Some organisations may say, ‘Why MDFE, cannot, just provide this protection as standard’, and the simple answer is, every organisation’s line of business applications or workflows are different and require, custom, granular control, that the ‘Microsoft Defender ATP API’ can provide via Power Automate but, most preferably : Microsoft Sentinel.

The following images outline the actions that are possible using the ‘Microsoft Defender ATP API’

Microsoft Defender Auto Isolation new Feature
It is now possible to ‘isolate’ devices but continue to allow end users to use ‘Microsoft Outlook and Teams’

This feature, ensures that end users can continue to remain productive in their daily work routines when using Windows 10\11 devices, yet be isolated from their corporate network, probably the best use case, is to prevent the spread of ransomware or Mimikatz credential theft.

How is this Auto Isolation feature to allow users to continue using ‘Microsoft Outlook and Teams’ controlled in the ‘Microsoft Defender ATP API’

I always find using Microsoft Azure Active Directory dynamic groups much easier to use when assigning policies, for example Defender for Endpoint onboarding policies via Intune.

Microsoft Defender for Endpoint included with M365 licensed user rule syntax

user.assignedPlans -any (assignedPlan.servicePlanId -eq “871d91ec-ec1a-452b-a83f-bd76c7d770ef” -and assignedPlan.capabilityStatus -eq “Enabled”)

Microsoft Defender for Endpoint plan 1 licensed user rule syntax

user.assignedPlans -any (assignedPlan.servicePlanId -eq “292cc034-7b7c-4950-aaf5-943befd3f1d4” -and assignedPlan.capabilityStatus -eq “Enabled”)

Microsoft Defender for Endpoint DLP

user.assignedPlans -any (assignedPlan.servicePlanId -eq “64bfac92-2b17-4482-b5e5-a0304429de3e” -and assignedPlan.capabilityStatus -eq “Enabled”)

Microsoft Defender for Vulnerability Management add-on

user.assignedPlans -any (assignedPlan.servicePlanId -eq “36810a13-b903-490a-aa45-afbeb7540832” -and assignedPlan.capabilityStatus -eq “Enabled”)

Data Classification : Where to start?

I have created Blog Posts about this in the past, but Microsoft continue to innovate and develop new technologies that can simplify an organisation’s data classification journey.

GDPR
The European Union introduced a new regulation called GDPR in 2016. There is a new

Wikipedia: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Data Protection Directive).

The European Union’s GDPR regulation was a big step in forcing organisations to consider implementing and controlling personally identifiable information.

In Ireland some of the core unequally identifiable attributes could be as follows.
-PPS – Personal Public Service Number
-Driving License
-Passport
-Mobile Phone Number
-Date of Birth

The unequally identifiable attributes mentioned above are directly related to individuals.

When it comes to an organisation’s intellectual property, how is this their data protected. It could be for example.

-Milk – The ingredients and process of manufacturing and distributing milk
-Bread – The ingredients and process of manufacturing and distributing bread
-Beer – The ingredients and process of manufacturing and distributing beer

Data Classification and protection is such a critical requirement for any organisation, and most organisations find it difficult, on where to begin their data classification journey. Not knowing where to begin a data classification journey can often pause or completely halt an organisation’s data classification journey. Microsoft have developed multiple solutions to try and speed up and enhance an organisation’s data classification journey.

A lot of organisations are not aware of the amount of compliance technologies, machine learning, and artificial intelligence that Microsoft Purview can provide, and organisations are typically licensed for these services and not using them.

The way forward: DORA sets a benchmark

DORA is expected to be published in the Official Journal of the European Union by the end of 2022 after final adoption by the European Parliament and other procedural steps are completed. Following the publication, there will be a 24-month implementation period before the rules enter into force, therefore, the rules under DORA will apply as of late 2024 at the earliest—thus allowing Microsoft and financial institutions to ensure compliance with the new rules ahead of that time. During the implementation period, the Regulatory Technical Standards (RTSs) will also be under development to facilitate DORA’s implementation. The RTSs are expected to be completed ahead of DORA application.

The key requirements under DORA cover the following: ICT risk management, ICT-related incident reporting, digital operational resilience testing, and oversight of critical ICT providers. The legislative framework will also require compliance by critical ICT third-party service providers.

At Microsoft, we support our financial services customers and will continue doing so under DORA implementation—specifically, but not limited to the following key areas:

• ICT risk management: DORA establishes a comprehensive management mechanism of ICT risks with which financial entities would be required to comply—including the identification, protection and prevention, detection, response, and recovery of such risks in scope. Microsoft already provides a broad set of built-in ICT risk management capabilities in our services today. This includes, by way of example: Microsoft Defender for Cloud, Microsoft 365 Service Health Dashboard, and Microsoft Secure Score.
• ICT-related incident reporting: DORA will harmonize the classification of incidents while streamlining the reporting processes to develop a more systematic approach to monitor, control, and follow-up on such incidents. DORA foresees a coordinated approach to ICT incident reporting and tackling reporting overlaps such as the NIS2 Directive. Microsoft provides such capabilities, such as with Microsoft Defender. 
• Digital operational resilience testing: DORA introduces digital operational tests that should be conducted on critical ICT systems and applications on an annual to triennial basis (regarding advanced threat-led penetration testing). This new testing approach will bolster the testing capabilities of financial entities—fostering timely recovery and business continuity. Microsoft already enables customers to do so through our penetration program. Learn more about the Microsoft Cloud Penetration Testing Rules of Engagement program.
• Oversight of critical ICT providers: DORA foresees a communication mechanism between financial regulators and ICT critical service providers for the management of ICT third-party risks. Microsoft already partners closely with its customers and has ongoing and rich engagement with regulators—including audit and regulatory examinations. We think such processes should include inter-agency cooperation amongst other regulators not limited to Europe. For example, alignment and communication among the Bank of England and the United States Regulators (FDIC, OCC, Federal Reserve), would be helpful from a regulatory oversight perspective, drive synergies, avoid fragmentation, and maintain a level of clarity and communication that would benefit regulators and Microsoft alike.
  
  Legacy on-premises data classification

Typical vendors like Broadcom (formally Symantec), Forcepoint (formally WebSense), McAffee, did a really good job of analysing on-premises data stores like ; file shares, sql databases, exchange servers. But these vendors were unable to bridge the gap between on-premises workloads and cloud workloads, most organisations work in a hybrid environment and host data between on-premises infrastructure and private or public cloud services.

Microsoft Windows Information Protection (WIP), previously known as enterprise data protection (EDP). Was a service that Microsoft introduced to provide data loss prevention services on Windows 10\11 devices. This service was quite difficult to configure and provide meaningful insights and recommendations to organisations. Microsoft then deprecated Windows Information Protection in July 2022.

What is the point or how effective is data protection without data classicisation?

Modern data classification

https://www.microsoft.com/en-ie/security/business/microsoft-purview

Microsoft have bridged the gap between on-premises and cloud workloads with technologies that help organisations define their unique sensitive information using technologies like:
-Advanced e-Discovery
-Data Map and Data Catalog
-Auto-classification
-Microsoft Purview Insider Risk Management policies
-Microsoft Purview Insider Risk Management
-Microsoft Defender for Cloud Apps
-Microsoft Purview document fingerprinting

Microsoft Classifiers
A Microsoft Purview trainable classifier is a tool you can train to recognize various types of content by giving it samples to look at. Once trained, you can use it to identify item for application of Office sensitivity labels, Communications compliance policies, and retention label policies.

Creating a custom trainable classifier first involves giving it samples that are human picked and positively match the category. Then, after it has processed those, you test the classifiers ability to predict by giving it a mix of positive and negative samples. This article shows you how to create and train a custom classifier and how to improve the performance of custom trainable classifiers and pre-trained classifiers over their lifetime through retraining

Microsoft currently have 59 trainable classifiers such as
– Wire Transfer
– Profanity
– Money Laundering

Custom classifiers can also be created for an organisation’s bespoke requirements.

Microsoft Endpoint Data Loss Prevention

Microsoft Windows Information Protection was a terrible service and it did not take long for Microsoft to retire the service.

Microsoft finally got it right, Microsoft Endpoint Data loss prevention is a superb service.

Ref: https://learn.microsoft.com/en-us/microsoft-365/compliance/endpoint-dlp-learn-about?view=o365-worldwide