Azure - Securing Subscriptions I recently shared a list of things I like to take a look at when adding Azure Subscriptions, and I'd encourage you to check out the Twitter thread for ideas from other folks as well. I'm adding this blog post simply to capture the content for preservation and future additions
Azure Arc - Onboarding Servers with Group Policy As organizations migrate endpoint management to Intune, a common question I get asked is "What do I do with my servers since Intune only supports clients?" Whether you are looking to move away from Active Directory and Group Policy, Microsoft Configuration Manager, or just trying to figure all of this
Azure Automation - Advanced Auditing In Office 365, applying an E5 license with the Advanced Auditing component to a user does not enable all auditable events. For tenants created more than a few years ago, it's possible MailItemsAccessed and Send are not enabled by default, especially if audit events were previously modified. Another important one,
Lab - Server Build Back in May of last year, I started building a new server and had planned to fully share the process of putting it together, setting up the OS, templates, etc. Instead, we had a baby, remodeled and sold our home, moved over 1500 miles, and had job constraints that forced
Archive - Using transport rules as a security tool 💡I'm working on getting the images back for this article, or I may just revamp it when I get a chance. I didn't realize I'd have to pull it from the Wayback machine, so it's missing some stuff :( Introduction At a conference last May, I had an opportunity to facilitate
Intune - Using Access Packages to Enable User Device Enrollment Many organizations use device compliance with Conditional Access to provide protection against MFA capable phishing attacks such as Modlishka, evilginx2, or @mrd0x's browser in the browser attack. This protection works well because Conditional Access uses certificate based authentication with the device and pulls compliance data from Intune, and the attacker
Defender for Endpoint - Implementing ASR Rules Phase 1: Discover and create exceptions To get started, we will create a policy to set all Attack Surface Reduction rules to Audit mode to ensure applications are not impacted. This allows us to gather telemetry data for any applications that might be affected by these rules. Data should be
Intune Intune - Edge in iOS Kiosk Mode Getting a web app to run in Edge in Kiosk mode on iOS has been a journey, so here's a guide on how I did it :) Every example I found online used either a 3rd party app or Safari with a Web Content Filtering policy, but Edge was needed for
Azure AD Azure AD - Integrating Azure AD logs with Azure Monitor Hey, let's ship Azure AD platform logs to a Log Analytics workspace :) For many smaller orgs, this will likely be free, and it provides a huge amount of insights that help facilitate things like removal of Legacy Authentication and fine tuning of Conditional Access policies — Nathan McNulty (@NathanMcNulty) September 29,
Archive Archive - MyStaff - Simplified Administrative Password Reset I am really excited to share this solution! We have had an internal password reset portal that was designed a decade ago, doesn't scale, can't be easily accessed, is not mobile friendly, and doesn't natively support MFA. As we started school this year, thousands of students needed passwords reset, and
Defender AV Archive - Defender AV - Improving Windows Defender Update Efficacy Defender/SCEP ProTip (not from the product team but somebody else that sees how it fucks up): SCCM is the absolute weakest link in AV update distribution for most enterprises. The layers of complexity, lack of monitoring, and general aloofness by staff means it just stays broken. — SwiftOnSecurity (@SwiftOnSecurity) January
OSINT Archive - OSINT - Using Shodan.io to protect your school district https://t.co/vTZO8QvQBx should be used by every K12 sys admin. It's free for the educational sector and it helps identify your external exposure for your network. "net:x.x.x.x/24 port:3389" shows RDP data but there are many other filters which are also useful. — EricArline
Defender for Endpoint Defender for Endpoint - Removable Storage Access Control Who wants to play with Defender for Endpoint's Removable Storage Access Control? Yeah, me neither, but I'm doing it anyway So what is it? Well, it lets us do things like block writing to all removable media except specific ones using serial numbers Microsoft Defender for Endpoint Device Control Removable
Azure Automation Featured Azure Automation - Device Cleanup I'm a huge fan of Azure Automation. If you're an #AzureAD / #M365 Admin and haven't used it before, then this thread is for you. You will need an Azure subscription, but the first 500 minutes/month are free! Here's an example of how to automate Azure AD device cleanup :) Â First,
Free Microsoft 365 E5 Developer Subscription Did you know that you can get a free M365 E5 subscription with 25 user licenses to learn, create automation, and develop applications? I know most folks never get the chance to admin this stuff, so sign up now, and let's walk through this together :) https://developer.microsoft.com/en-us/
