TagOffice 365

Get your data to your home country!

If your Microsoft 365 tenant like mine is located in a region that not`s include your country then this is how you should configure your tenant to get the data as close to you as posible!

(if Microsoft has opened a Datacenter in your country of course :))

Why move your data?

There are several improvements by getting your data moved to a closer datacenter.

  • Improved latency to the services
  • Data stored in your own country
  • Still have DR capabilities outside of your country if infrastructure failes
  • Multi-geo capabilities to many more closeby countries for your staff

The latency improvements are incredible! I have noticed this when using a SharePoint Online site located in Europe vs. In my home country Norway. The latency against Norway was much much better and when using the service it feels much more “snappy”.

Creating a new Microsoft 365 tenant for everyone living in Norway will create the data store in Norway aswel for the services

  • Exchage Online
  • SharePoint Online
  • Microsof Teams

When to do it?

Microsoft has released a table of when the Request period for requesting a move of data, take a look here to have a look for your country!

https://docs.microsoft.com/nb-no/Office365/Enterprise/request-your-data-move#when-can-i-request-a-move

For us in Norway this means that we need to opt-in by the end of October to be migrated and get our core customer data at rest in Norway.

When will your data be moved?

A catch with all this is that Microsoft says that they may use 24 months to move your data! TWO years for migrating it to new datacenters.. But that said, it can happend faster. After you request a move of data, Microsoft will plan to move your company data as soon as operational constraints allow.

How to request a move of data?

It`s quite easy to request a move of data!

Head in to “Settings -> Organization profile -> Data residency” and check the checkmark and “Save changes” then wait 🙂

To look at where your data is at the moment head into the “Data location” in the same menu under Organization profile and have a look 🙂

S for Security in EMS – Microsoft Intune

So this is the third post in my blog post series “S for Security in EMS” and I will try to cover some Microsoft Intune benefits and quick-wins meaning how to quickly get started with Intune and to gain some benefits right the way. 

First, what is Microsoft Intune?  

Microsoft Intune is an cloud based mobile device manager, this does not mean that MS Intune only can be used for 

Celular phones and tablets. All devices can be enrolled into Intune and by requireing this of your users we can start protecting business data with other tool-sets like Conditional Access, Information Protection and so on. 

When users enroll their devices into intune (that can be Windows, macOS, Android or iOS) the device goes through an “Compliance policy” that you have configured to “measure” the device and stamp it as compliant or non-compliant based on evaluations against the the compliance policy.  

Image result for microsoft intune compliance

So why is Intune so important for the Security part within the EMS Suite? Well! When your device is added to Intune and gone through the Compliance policy marking the device as an Compliant device we can use that status with for example Conditional access to deside on what services a user can access based on compliant device or not.  

Furter on we can with the MDM deploy software like Antivirus/Antimalware (if you don`t use Microsoft Defender ATP :)), deploy Windows 10 security baselines where you can controll several services within Window 10 (https://docs.microsoft.com/en-us/intune/protect/security-baseline-settings-mdm-all?pivots=mdm-may-2019).  

And the last but not least, you have an inventory of devices that can access your enterprise data and applications! Thats a big value to have in your pocket! 🙂 

S for Security in EMS – Overview
Part 1 – S for Security in EMS – Azure AD Premium
Part 2 – S for Security in EMS – Information Protection
Part 3 – S for Security in EMS – Microsoft Intune
Part 4 – S for Security in EMS – Advanced Threat Analytics
Part 5 – S for Security in EMS – Cloud App Security

Block AdHoc subscriptions in Office 365

To block users from creating trial and adhoc subscriptions for Office 365 services or even PowerPlatform services you can turn a switch and block it.

Set-MsolCompanySettings -AllowAdhocSubscriptions $false

To check if this is set to “False” for your tenant you can run this

Get-MsolCompanyInformation |fl AllowAdhocSubscriptions 

Sensitivity labels available in Outlook Web

The first step into enabling the use of Unified labels in Office Web apps is here! Today i got the “Sensitivity” bar enabled in my tenants.

Sorry for the Norwegian text in the picture, as “Følsomhet” is the Norwegian word for “Sensitivity”

To get started with Sensitivity labels – head over to Microsoft 365 Security portal and open the “classification” menu.

From there head in to “Sensitivity” and create a label.

Next – choose the tab for Label Policies and publish the label you created.

When testing the feature, remember to only publish the label to your self so that you not enable all users in your company to use and test it. 🙂

5 tips to get more secure in Office 365

So if you are using Office 365 you should consider use/enable these 5 features which you have free of charge within your Office 365 subscription.

These tips are the first thing i enable for my customers (if they are not enabled already of course)

So let`s dig into the features! – All of the features are FREE!

1. Enable MFA for your user

This is a simple thing to do and in 5 steps it`s enabled both for your end-users and for your admin accounts.

Ref: https://docs.microsoft.com/en-us/office365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide#manage-mfa-settings-in-the-new-microsoft-365-admin-center

2. Block malicious files types

The next one is almost as simple as the first one and is enabled in just a few minutes.

Navigate to “protection.office.com” and authenticate, go to “Threat Management” and “Policy” then click “Anti-malware”. Edit the default policy and og to settings, under “Common Attachment Types Filter” set the toggle to “On” – your done! 🙂

3. Use a separate account for administrative tasks

A simple thing to do – if you have administrative privilege’s on your account you should create a separate admin account which is protected with MFA of course. This can also be mitigated using the paid service Azure AD Privileged Identity Management – more on that service i a later blogpost

4. Block Auto-forwarding on email accounts

By blocking auto-forwarding on email accounts you mitigate the attack vector which is when a account is breached and the bad guys setting up forwarding of emails to gain information about the company and how people collaborates. This is the start of a advanced phishing attack.

Ref: https://support.office.com/en-us/article/stop-auto-forwarding-emails-in-microsoft-365-f9d693ba-5c78-47c0-b156-8e461e062aa7

5. Use Secure score to improve security

Secure Score is a simple and fun way to fix and improve your company security. The results are tailored to your Office 365 implementation and you`ll get scored on how many improvements you configure.

So to wrap up this blog post – All these features are free! It will take you under 1 hour to implement and your company is a lot more secure!

Get started with MFA – part two

So in the previously post I went through how to activate MFA for Administrator roles i a really simple and effective way.

In this post we will focus on activating MFA for all regular users. And first off all we need to evaluate who should be activated first or should we activate on all users at the same time and do a evaluation on service accounts! If we enable MFA on for example a serivce account used for scan to email on “multi functional printers” or on a mailbox account witch are used on a thirdparty ticketingsystem (POP/IMAP) we could break those service by just enabling MFA on all users.

My recomandation is when you are more then 30 users in your company you should select a few ambasadeurs who is getting the MFA activated first and can therefore be the power users who can help others with the registration if there is any hick-ups (should not be many).

And to activate MFA for end users I highly recomend to use Conditional Access for

  • all users and exclude a AzureAD Group which contains a “Break the glass Admin” and other service accounts.
  • All cloud apps (no exeptions)
  • Grant Access – but require MFA

Easy like that! And It`s a realy quick solution for your company.

Drawback here is that you need “Azure AD Premium P1” licenses to use Conditional Access and a second drawback is that it`s not scored at the Microsoft Secure Score.

Change language – Office 365 Mailbox

To change the Language for a Office 365 mailbox (Exchange Online), run the following commands:

$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection

Import-PSSession $O365Session

Set-MailboxRegionalConfiguration -Identity “USER” -Language nb-no -LocalizeDefaultFolderName

For full list of cultureinfo classes (Languages) see:
https://msdn.microsoft.com/en-us/library/system.globalization.cultureinfo(VS.71).aspx

Enable/disable Office 365 serviceplans

I was asked today how you can disable and enable individual features included in an Office 365 license (like Exchange Online, Yammer.. etc) from Powershell

Launch Powershell and log on to your tenant (connect-msolservice)

To see which features which is included in a license use the following code:

$lic = Get-MsolAccountSku | Out-GridView -OutputMode Single -Title “Select SKU to look up”
$lic.ServiceStatus

This will show a list of features and their status

Next, if you want to disable Exchange online for one specific user:

$skuid = Get-MsolAccountSku | Out-GridView -OutputMode Single -Title “Select SKU to edit”
$user = Get-MsolUser | ? {$_.isLicensed -EQ $true} | Out-GridView -title “Select user to modify” -OutputMode Single
$Disable_ExchangeOnine = New-MsolLicenseOptions -AccountSkuId $skuid.AccountSkuId -DisabledPlans “EXCHANGE_S_ENTERPRISE”
$Enable_ExchangeOnline = New-MsolLicenseOptions -AccountSkuId $skuid.AccountSkuId -DisabledPlans $null
Set-MsolUserLicense -UserPrincipalName $user.UserPrincipalName -LicenseOptions $Disable_ExchangeOnine

The sku must match the sku assigned to the user you want to change.

servicefeature

Then run this line in the same script to re-enable Exchange Online

Set-MsolUserLicense -UserPrincipalName $user.UserPrincipalName -LicenseOptions $Enable_ExchangeOnline

How to add a user as a Site Collection administrator – Office 365

To add users as site Collection admins follow this procedure:

  1. Connect to the SharePoint admin center
  2. Select User Profile, then Manage User Profiles
  3. Find a profile
  4. Manage Site Collection Owners
  5. Change the primary or secondary site collection administrator
  6. Repeat for every single user

Azure VPN – Change Local Site Public IP

If a Clients Local site public IP changes the VPN tunel betwen Azure and the Local Site will disconnect. To fix this do the following:

Connect to Azure using powershell and run the following command:

New-AzureRmLocalNetworkGateway -Name LocalSite -ResourceGroupName [ClientRG] -Location ‘northeurope’ -GatewayIpAddress ‘[Public wan IP 2.4.6.8]’ -AddressPrefix ‘[LAN IP Net 192.168.1.0/24’

 

(Change the RG and Public wan IP and the LAN IP Net to the correct settings)

© 2020 IdefixWiki

Theme by Anders NorénUp ↑