AuthorJulian Rasmussen

Using the new Sensitivity labels in Teams and SharePoint

These days the preview of Sensitivity labels in Microsoft Teams and SharePoint is rolling out, and I got the new feature up and running in my tenant allready!

If you have been waiting on this feature you may have noticed that the rollout came in stages and is taking some time to be rolled out.

After opt-in to the preview feature by following the guide lines from docs.microsoft.com. You can start creating your new Sensitivity labels tailord for Office 365 groups, SharePoint sites and Microsoft Teams.

Head into Compliance center and create a new label and set the settings you want to test! In my case i created two new labels (naming is for test and to make it easy for me to divided these two :))

Basicly now you finally can block untrusted devices to gain access to higly confidential information stored within SharePoint or Teams – AND also prevent guests to be invited into the site.

For this to be working you need to be using Intune aswell so that company devices such as computers, laptops and mobile devices can be marked as compliant devices.

A usefull scenario also for this is when you only allow Limited, web only access to site or team then you block downloads from untrusted devices such as kiosk, home computers etc.

What do you think of this new feature?

I can`t wait to be going production with this!

How do I know all my users are enabled for and using MFA?

More and more organizations is taking advantage of using MFA for their users and there is no reason for them not to since it`s free for all Office 365 users and also for all Azure AD users if you are not using the Office 365 services. But after you enable it for your users, are you sure everyone is enabled?

You may have seen at the Secure Score that not all users are registred for MFA, and if you do so you have users with no MFA! So these users may be victims for bruteforce attacks so it`s super important to remediate all users to see how everything is configured! Some of the users with no MFA maybe legit and should not have it.

So let`s dig into the materials for a second or two.

First thing is that there is a “Secure Score” check for MFA registered users that will show you how many of your users which are not registered (if any)

If you have any users in that list it would not show who the users are so we need to go deeper in the material to retreive this status.

So to get the list of users who don`t have setup MFA you need to run this PowerShell command with the AzureAD PowerShell module loaded.

Connect-MsolService

Get-MSOLUser -all | where {$_.StrongAuthenticationMethods.methodtype -eq $null} | Select Displayname,UserPrincipalName,BlockCredential,LastPasswordChangeTimestamp,UserType |Out-GridView

And now that we have found all users we can check them out why they don`t use MFA and make sure that they use it 🙂

Further on we can check what method users are using when authenticating with MFA. For this I use this script located in Technet PowerShell archives HERE

If you have deployed MFA the Conditional Access way (recommended) you will see that the MFA status on all user are set to “Disabled” but the method is set to what the user are using.

Have checking status on your users! 🙂

SharePoint Online PowerShell module

To install, update og uninstall the SharePoint Online PowerShell module there are some few simple PowerShell commands you can use.

First of all, set your Execution policy to restricted

Get-ExecutionPolicy #for checking the current ExecutionPolicy setting
Set-ExecutionPolicy -ExecutionPolicy  Unrestricted

Install

 Install-Module -Name Microsoft.Online.SharePoint.PowerShell

Check current version

Get-Module -Name Microsoft.Online.SharePoint.PowerShell -ListAvailable | Select Name,Version

Update

Update-Module -Name Microsoft.Online.SharePoint.PowerShell

Uninstall

Uninstall-Module -Name Microsoft.Online.SharePoint.PowerShell

Ignite – some of the news I got first day

So! Day one at Ignite is over and what a day! A lot of new features, services and everything.

But Imust say, arriving from Norway – EVERYTHING IS SO BIG here in USA!

Anyhow – Here is a short summary from me of some (few) new features and services that where unvailed at the keynotes and some sessions

There are much more also that I did not cover in this post!

Azure Arc

Azure Synapse Analytics

Power Automate (Flow)

  • MS Flow is getting new name
  • Gives you ability to create autmations against applications which are missing API`s

Power Virtual Agents

  • Bot or “Chat” agent on websites
  • Together with Power Automate you can fill contacts schemes from a chat on a website directly into your on-prem crm system (which are missing API)

Microsoft 365

  • Project Cortex
    • Based on AI
    • Creates a Enterprise wiki automatically with the use of AI
    • Creates a “Knowledege” card on word shortnings and links you to the “Knowledge Center”
    • Greate for new employees or just as a company wiki
  • MS Stream uses AI to remove background noice on videos
  • MS Teams uses AI to remove backgrouds or bluring them
  • Fluid Framework
    • Collaboration between Outlook, MS Teams chat, PowerPoint ++
  • Office.com is more important for end-users than ever – a onestop for all services
  • Office.com gets ability to be customized with themes, company branding etc.
  • OneDrive gets filesize increased to 100GB pr. file
  • All files in OneDrive now has Delta-sync

SharePoint

  • In Search you now can edit resultspage and configure how the result is presented
  • SharePoint Homesites is in GA
  • Content Auditing
    • Highligt of changes in versions
    • Scheduled publishing of pages
    • Multi-lingual support
  • SharePoint Spaces goes Public preview arround q1 2020 (somehow togheter with Edge Chromium)
  • Modern term-store

Security & Compliance

  • Unified labes is even more unified
    • Labeled Teamsites, MS Teams and files are now the same
    • Auto labeling si based on content on a complete site
  • Information barrier
    • Based on classifications (labels) you can block out a whole department or group of people from certain areas
    • That said, Finance investors can get blocked out from the auditors filespaces for exapmle.

Edge Chromium

  • Browser in GA Q1 2020
  • Will get a Fast Track “track” to help companies embrace it

Managed Meeting Rooms

  • Monitoring of equipment in the rooms like monitors, cameras, microphones etc.
  • In Private preview right now!

On my way to Ignite!

Enroute! I`m on my way to Orlando as we speak (write). I`m so exited to meet the HUGE community which are present at Microsoft Ignite and can`t wait to meet friends and new people in the community. That said there are mucho to-do this week!

I`m arriving my hotel late Sunday and preparing to head into OCCC EARLY to try to get a space for Sataya`s keynote in The Hub at OCCC.

Game plan!

  • Get my luggage
  • Check in at MS Ignite at Orlando airport (rumors says there is almost no queue there)
  • Grab an Uber straight to the hotel
  • Go to sleep fast
  • Get up early and head directly over to OCCC
  • Enjoy Ignite! 🙂

That said – i have thought about how to store, use and structure all the information and knowledge i get this week.

My plan is to use One Note for taking notes on stuff from sessions and all over – Use Microsoft To-Do to add task that i need to follow up on and LinkedIn for connecting with all the great community people and ofcourse use Twitter to follow the great speakers and people i meet at the conference.

Ignite is 7 days away – it’s a problem!!

Well.. it’s not that big of a problem, or yes it is! There is to many sessions I want to be at at the same time. As a first timer at Ignite this will be alot of fun and i’m looking forward to meet alot of people and learn much new stuff!

So over to the problem, I have added all the sessions i want to experience and i now have up to 8 sessions at the same time at almost all hours theough out the week. So now the work of fixing my schedule for the week. Good thing is that we can watch almost all content on video on demand after the conference 🙂

Even tho its my frist time to ignite, i have some tips!

  1. Arrive early to your sessions
  2. Have some break time between your sessions.
  3. Wear good and comfy shoes
  4. Keep hydrated
  5. Meet people and have fun!

Hope to you at ignite this year!

Block AdHoc subscriptions in Office 365

To block users from creating trial and adhoc subscriptions for Office 365 services or even PowerPlatform services you can turn a switch and block it.

Set-MsolCompanySettings -AllowAdhocSubscriptions $false

To check if this is set to “False” for your tenant you can run this

Get-MsolCompanyInformation |fl AllowAdhocSubscriptions 

Sensitivity labels available in Outlook Web

The first step into enabling the use of Unified labels in Office Web apps is here! Today i got the “Sensitivity” bar enabled in my tenants.

Sorry for the Norwegian text in the picture, as “Følsomhet” is the Norwegian word for “Sensitivity”

To get started with Sensitivity labels – head over to Microsoft 365 Security portal and open the “classification” menu.

From there head in to “Sensitivity” and create a label.

Next – choose the tab for Label Policies and publish the label you created.

When testing the feature, remember to only publish the label to your self so that you not enable all users in your company to use and test it. 🙂

5 tips to get more secure in Office 365

So if you are using Office 365 you should consider use/enable these 5 features which you have free of charge within your Office 365 subscription.

These tips are the first thing i enable for my customers (if they are not enabled already of course)

So let`s dig into the features! – All of the features are FREE!

1. Enable MFA for your user

This is a simple thing to do and in 5 steps it`s enabled both for your end-users and for your admin accounts.

Ref: https://docs.microsoft.com/en-us/office365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide#manage-mfa-settings-in-the-new-microsoft-365-admin-center

2. Block malicious files types

The next one is almost as simple as the first one and is enabled in just a few minutes.

Navigate to “protection.office.com” and authenticate, go to “Threat Management” and “Policy” then click “Anti-malware”. Edit the default policy and og to settings, under “Common Attachment Types Filter” set the toggle to “On” – your done! 🙂

3. Use a separate account for administrative tasks

A simple thing to do – if you have administrative privilege’s on your account you should create a separate admin account which is protected with MFA of course. This can also be mitigated using the paid service Azure AD Privileged Identity Management – more on that service i a later blogpost

4. Block Auto-forwarding on email accounts

By blocking auto-forwarding on email accounts you mitigate the attack vector which is when a account is breached and the bad guys setting up forwarding of emails to gain information about the company and how people collaborates. This is the start of a advanced phishing attack.

Ref: https://support.office.com/en-us/article/stop-auto-forwarding-emails-in-microsoft-365-f9d693ba-5c78-47c0-b156-8e461e062aa7

5. Use Secure score to improve security

Secure Score is a simple and fun way to fix and improve your company security. The results are tailored to your Office 365 implementation and you`ll get scored on how many improvements you configure.

So to wrap up this blog post – All these features are free! It will take you under 1 hour to implement and your company is a lot more secure!

Automated Investigation & Response

The Automated Investigation & Response feature under Threat management in Security & Compliance admin portal is a pritty new and amazing feature in Office 365.

To use this feature you need to have “Office 365 Advanced Threat Protection Plan 2” licenses witch you can purchase standalone or it`s included in the Office 365 E5 license and yes – you need to be a “Global Administrator” or “Security Administrator” to configure the service. Once configured you can also use “Security Reader” or “Security Operator” to see whats happening.

Have a look here to see all capabilities within “Advanced threat protections”.

So over to Automated Investigation & Response (AIR) – have a look at this screenshot

As we see her we have two detection on-going which waiting on user action. The first one in the picture is automatically found by the system and the second one is a email which I reported through the “Message Report” add-in for Outlook which are deployed to all users (Both Outlook and Outlook Web).

In the overview of the case (the one i reported) we see what`s going on with the message, the Trigger alert, what threats  who where found, how many emails are “infected” and which users that have the infected email in their mailbox (could be a mass-phishing attack)

When we navigate to the Email tab we see what section of the email that are found malicious and in this case the Advanced Threat Protection has matched the URL to a malicious URL

Moving to the Action tab – we are given several a big tool belt meaning that we can do a soft delete from the users mailboxes (in this case only one user, but if this malicious email was delivered to 100 users we can in one click remove the email from the users mailboxes) and block the URL in Safe Links.

So this was very short on how to easily use AIR in your tenant if you have the right license.

© 2019 IdefixWiki

Theme by Anders NorénUp ↑