If your Microsoft 365 tenant like mine is located in a region that not`s include your country then this is how you should configure your tenant to get the data as close to you as posible!
(if Microsoft has opened a Datacenter in your country of course :))
Why move your data?
There are several improvements by getting your data moved to a closer datacenter.
Improved latency to the services
Data stored in your own country
Still have DR capabilities outside of your country if infrastructure failes
Multi-geo capabilities to many more closeby countries for your staff
The latency improvements are incredible! I have noticed this when using a SharePoint Online site located in Europe vs. In my home country Norway. The latency against Norway was much much better and when using the service it feels much more “snappy”.
Creating a new Microsoft 365 tenant for everyone living in Norway will create the data store in Norway aswel for the services
Exchage Online
SharePoint Online
Microsof Teams
When to do it?
Microsoft has released a table of when the Request period for requesting a move of data, take a look here to have a look for your country!
For us in Norway this means that we need to opt-in by the end of October to be migrated and get our core customer data at rest in Norway.
When will your data be moved?
A catch with all this is that Microsoft says that they may use 24 months to move your data! TWO years for migrating it to new datacenters.. But that said, it can happend faster. After you request a move of data, Microsoft will plan to move your company data as soon as operational constraints allow.
How to request a move of data?
It`s quite easy to request a move of data!
Head in to “Settings -> Organization profile -> Data residency” and check the checkmark and “Save changes” then wait 🙂
To look at where your data is at the moment head into the “Data location” in the same menu under Organization profile and have a look 🙂
In this post I want to go through some steps that I think is quickest method to get started with Microsoft Endpoint Manager. This will not cover ALL the features but it will give you an quickstart to the service.
For instance, what shold you start with?
To be honest, start with something easy and creates quick ROI (Return of investment) and that could be more than just how to get my money back – rather it could mean that your infrastructure is getting more secure.
So to start with something “easy” let`s kick it of with mobile devices. Many companies does not have any Mobile device management in place and their Cloud services is available for EVERYONE to attache to. So let`s start with demanding compliant devices and closing the door for others!
Requirements: Microsoft 365 E3 / E5 or EMS E3 / E5 or Intune licenses
Devices Android devices will work straight “out of the box” with Intune but to be able to join iOS/iPadOS Devices to Intune we need to generate and apply a “Apple MDM Push certificate”.
Let`s start with the Certificate for Apple devices (this certificate is also needed for MacOS devices). The only thing you need here is an Apple ID and follow the guide from “Devices -> iOS enrollment -> Apple MDM Push Certificate”. When this is in plnace we can procede.
When it`s created you have a valid Certificate for the next 365 days. That means that you need to remind your self to renew the certificate every year! When the certificate expires your intune services will stop against Apple devices.
So what is a compliant device?
A compliant device is a device registred to Intune and has passed the Compliance policy that you have created.
The policy can contain several “settings” that must be enabled or set on your device for it to be marked as “Compliant Device”. For iOS/iPadOS we have at the moment (04.04.2020) 17 settings we can check to validate the device and for Android 19 settings (04.04.2020).
Here is a simple set of compliant device policies for Android and iOS.
iOS/iPadOS Comliance.
Navigate to “Devices -> iOS -> Compliance policies” and create a new policy. Give it a name, set some settings and click create. In this policy i have just put on two settings, “block Jailbroken devices” and “Require password to unlock device”
Hit Create and go to “Assignments”, in this menu we will assign the policy to all users so that everyone that tries to enroll their device will get the policy. (this is the same step for both iOS and Android).
Android Compliance
Navigate to “Devices -> Android -> Compliance policies” and create a new policy. Give it a name, set some settings and click create. In this policy i have just put on two settings, “block Rooted devices” and “Require password to unlock device”
And like the iOS policy we need to assign it to all users, so head in to Assignents after creating the policy and assign it to all users.
Block devices that are not compliant
To block users from connecting with other devices we will use Conditional Access to prevent devices that are not enrolled in your organization. The policy is created from the Microsoft Endpoint Manager portal under “Endpoint security -> Conditional Access. Create a new policy and name it “Require compliant devices”
The policy looks like this and will of course not block the Intune enrollment portal 😊
Users and groups
Include all users and create exclution for users you want to exclude from the policy
Cloud Apps or actions
Include “All cloud apps” and click on “Exclude” and search after “Microsoft Intune Enrollment”
Conditions
Device platforms, configure it and choose Android and iOS from the list.
Access controls
Grant access and choose “Require device to be marked as compliant”
Now you can enroll your first device, i`ll show it with an iPad her, but first you need to downlod the Company Portal to your iPad.
Then you stat the application and sign in – then starts the enrollment of the device.
Sign-in
setup device
Apply profile
Enrolled!
When that`s completed the device is registred in the Device pane in Microsoft Endpoint Manager Admin Center and you`ll see complance status on it.
That`s it! Now you have a new requirement for all users, they need to enroll their devices (mobile devices) within Microsoft Endpoint Manager to gain access to cloud resources!
Many people wonder what Microsoft Endpoint Manager is and how to quickly gain value to their company by using it.
In this post i will
give you some quick information on what it is and later on create a how to get
started quckly with Microsoft Endpoint Manager!
So what is Microsoft
Endpoint Manager?
Some people are saying “It`s the new name of Intune” and that`s not what it is at all! or Intune is in there, but it`s so much more.
MS Endpoint Manager is a tool set witch are combining several solutions and gives you “One place to manage” several infrastructure services. To name them:
Microsoft Intune (ofcourse :))
Microsoft Endpoint Configuration Manager (SCCM)
Windows Autopilot
Desktop Analytics
Microsoft Defender ATP
Azure Active Directory
By doing this Microsoft achieves a ground breaking new management solution for us that gives us ability to manage all major platforms like Windows devices, Apple devices, Linux distros and Android devices.
So to be clear,
Microsoft Intune or Microsoft Endpoint Configuration Manager (SCCM) will not be
discontinued! They both will live their life but be combined with Microsoft
Endpoint Manager.
So what do you need
to start using Microsoft Endpoint Manager?
You need to have either Intune licenses or SCCM licenses and you also need to have Azure Active Directory Premium P1 to utilize Azure AD Conditional Access.
I will in the next blogpost come up with a brief guide om how to get started using Microsoft Endpoint Manager and quickly gain usage of yours EMS package!
Last but not least
in my blog post series “S for Security in EMS” is about Microsoft
Cloud App Security!
Microsoft Cloud App
Security is a CASB (Cloud access security broker) service delivered by
Microsoft that will give you several features to protect your data, users and
cloud services. MCAS is giving you a great insight on
Shadow IT visibility
Cloud applications usage
Notifications when users take advantage of new Cloud applications
Dive into specific applications, users or ip addresses
Microsot Cloud App
Security comes in two editions – Microsoft Cloud App Security and Office 365
Cloud App Security
With both editions you can easily upload your firewall logs to MCAS and get a analysis on what users are using of Cloud applications from your office network or you can configure reverse proxy features with Conditional Access and MCAS giving you great insight on what applications users are using with Azure AD integration and files shared across other services outside of Office 365.
When creating a new
snapshot report (aka firewall log upload) the data goes through several steps
like file parsing, data analysis and then the report is created.
This is a sample on
how the report could look like and what can be discovered.
Note that here you
see Open Alerts on Cloud applications users are using, how many GB of data is
being uploaded to what applications and much more!
Next up you also get
som pritty nice alerting out of the box.
There is 26 enabled
policies that will govern your environment looking for leaked credentials,
multiple failed logons, imposible travel and much more
Take a look here at
some alerts on imposible travel
The alert gives us
rich information on IP addresses, country, what service is used and witch user
are affected. A great tool to investigate a account breach!
Some of the policies available
That in mind!
Microsoft Cloud App Security or Office 365 Cloud App Security is a greate tool to use within your organization!
So this is the third post in my blog post series “S for Security in EMS” and I will try to cover some Microsoft Intune benefits and quick-wins meaning how to quickly get started with Intune and to gain some benefits right the way.
First, what is Microsoft Intune?
Microsoft Intune is an cloud based mobile device manager, this does not mean that MS Intune only can be used for
Celular phones and tablets. All devices can be enrolled into Intune and by requireing this of your users we can start protecting business data with other tool-sets like Conditional Access, Information Protection and so on.
When users enroll their devices into intune (that can be Windows, macOS, Android or iOS) the device goes through an “Compliance policy” that you have configured to “measure” the device and stamp it as compliant or non-compliant based on evaluations against the the compliance policy.
So why is Intune so important for the Security part within the EMS Suite? Well! When your device is added to Intune and gone through the Compliance policy marking the device as an Compliant device we can use that status with for example Conditional access to deside on what services a user can access based on compliant device or not.
And the last but not least, you have an inventory of devices that can access your enterprise data and applications! Thats a big value to have in your pocket! 🙂
Even tho
Azure Information Protection is included within the EMS package i would
recomend using the Office 365 Unified Labeling insted.
Those labels
which can be eather Sensitivity or Retention labels and capabilities comes with
in the Office 365 E3 or Office 365 E5 license.
Why should
you use Unified labels you say?
Well, in my
opinion you should keep it as simple as posible for your users therefore by
embracing the Unified labels within Office 365 users don`t have to think about
using a labeling client to manage their labels. Unified labels are built into
Office applications both web and installed ones and also embeded into the
mobile applications. That meaning users can label on any device with
application.
When using
Azure Information Protection internal IT department of your company need to
roll out the AIP Client to all machines and drawbacks here is that web
applications and mobile applications are not eligable for this client.
So!
Start with
creating some labels from Security & Compliance center and play arround
crating watermarks, encryption and deploy to test users at first to be able to
test your policies.
Head into https://protection.office.com/ and
navigate to “Classifications -> Sensitivity labels” and from her
create a new label
Follow
through with the wizard
And when
going through the Wizard you need to take some descisions on what the policy
should do.
Encryption
Yes or no and what
permissions should be set automatically to your files.
Should the access to the
file expire on a givven date or days after encryption
Allow offline access to
files could be convenient for some.
Should the content be
watermarked?
Add DLP policy from the
Entpoint (Windows Information protection WIP).
Use this label to protect
Office365 groups (Teams and SharePoint sites also)
Here you can choose if the
created SharePoint site, Teams or Office 365 Group should be have
restricted access from unmanaged devices and such.
Use Autolable based on
conditions
This feature require E5
You can automatically lable
documents with for example Norwegian passport number is written in a
document.
Thats it!
You have created your first label – quite easy.
But before
going big-scale you need to evaluate how your company should label documents.
General, Confidential, Higly confidential and so on.
My best tip there is to create a table on the labels you think you need and describe the “rules” of when to apply the labels. Like financial data should maybe be labels highly confidential while some company flyers should have “General”.
Since Enterprise Mobility + Security (EMS) is a core component of Microsoft 365 services you need to understand what services is present within the EMS package. In the same way that Microsoft 365 services comes with a E3 or E5 service level does EMS also that. I will try to give a easy and understandable overview of all the core components of EMS within the next 5 blog posts.
We will dig into all the main topics that you se in the table below.
In the table below
you will see the difference between the EMS E3 and EMS E5
Service
EMS E3
EMS E5
Azure AD Premium
P1
P2
Azure Information
Protection
P1
P2
Microsoft Advanced
Threat Analytics
Incl.
Incl.
Microsoft Intune
Incl.
Incl.
Cload App Security
Incl.
By now you probably
trying to figure out on some questions;
Do I need EMS in my
organisation?
Witch EMS
subsctiption do I need?
Should we move to
Microsoft 365 subscriptions?
The short answered for this is; Yes, depends and maybe. Not much of an answer but if you stay put on the next few blog posts, I will walk through the services on what it does and what it can be used for to make it a little easier to choose the right licenses for your organisation.
So lets talk about
“Security Defaults” a bit, this new feature in AzureAD who replaces
“Baseline policies: ” in the Conditional Access pane within Security
in AzureAD.
First of all – the
baseline policies where in preview and could be changed before the feature went
GA so we cant blame anyone of the service changing before production.
The Baseline
policies gave us remediaton of MFA and and blocking of legacy authentication
within 4 policies that everyone could use within Conditional Access, these four
policies where free so no cost and that sweet!
Baseline Policy: Require MFA for admins (Preview)
Enabled MFA to all administrator roles within AzureAD
Baseline Policy: End user protection (Preview)
Enabled MFA registration to all users and required MFA for users with leaked password or other risky signins.
Baseline Policy: Require MFA for Service Management (Preview)
Require MFA for accessing the Azure Portal, Azure PowerShell modules or Azure CLI
Blocked the usage of legacy authentication on all services (such as pop, IMAP, native android clients etc.
For a good time now
we cound enabled one or more of those 4 baseline rules – but that ends! At
February 29th 2020 Microsoft will discontinue the use of Baseline policies so
if you are using some of them you need to enable Security Defaults in AzureAD.
Head into
portal.azure.com -> Properties -> Security Defaults and enable it.
Please not that if
you have license for using Conditional Access (Azure AD Premium P1) you cannot
a Conditional Accessrule without disabling Security Defaults.
And if you have
Azure AD Premium P1 you should be creating the Conditional Access rules
manually and that gived you several advantages such as exclude users, pinpoint
to some cloud apps or exclude them and set other requiremets aswel.
Best practice says that you should always have a “Break the glass administrator” account who is excluded from all the Requirements – but please note! That account need to be monitored and high security alerts should be raised every time the account is used.
