How the Microsoft Mission Critical team helped secure AAD

by Scott Muniz | Aug 5, 2020 | Uncategorized

This article is contributed. See the original author and article here.

Hello everyone and welcome to our mind-blowing series of blogs we have lined up to show you the significant impact of the Azure Active Directory Security Features had for one of our SMC customer.

This blog is a cumulative effort from the Mission Critical Team (Altug, Morne, Nibin & Zoheb).

We will be showcasing in detail what efforts our Identity experts in the Mission Critical Team have gone through for one of our customers in MEA. As a result, we achieved an immense overall improvement in their identity security posture.

Let us start first by introducing ourselves:

Morne: I am an Identity Customer Engineer and have been in Microsoft for 2 years. My primary focus is enablement of the Microsoft hybrid cloud and securing Cloud identities along with the optimization and production remediation of Directory Services. I work as a Designated Support Engineer for this customer.

Zoheb: I am an Azure/Identity Solution Engineer and have been in Microsoft for 7 years in different roles (Microsoft Support, PFE & presently SMC) and working as a SMC lead for this customer.

Nibin: I am an Azure/Identity Sr Solution Engineer and have been in Microsoft for 13 years in different roles (Microsoft Support, PFE & presently SMC) and working as a SMC lead for this customer.
Altug: I am a Sr Solution Engineer specializing in the Manageability and Operations realm. I have been in Microsoft for almost 15 years in different roles (Microsoft Support, PFE & presently SMC).

Before we go in more details, we would like to share some Background on the Microsoft Mission Critical methodology that will enable you to better understand this blog series and the way we work.

How the Microsoft Mission Critical team helped secure AAD

To come back to our valuable SMC customer. This customer has an environment of about 25,000 users, was new to Azure Active Directory and ultimately was in the process of exploring as many new features as possible.

The ‘What’

Historically they had to deal with various Security incidents in their environment, which resulted in Identity compromise, phishing, malware attacks etc. They had challenges to Protect, Detect and Respond proactively to these varying levels of compromise.

As our customer’s footprint grew in AzureAD they started observing many similar attack trends in AAD like described below:

1. Hundreds of Risky Sign ins reported every day
2. More than 1 million incorrect username and password attempts in a month (Password Spray attacks)
3. M365 team were detected many phishing emails
4. Many impossible travel alerts detected
5. Many attempts detected from legacy Browser using weak authentication

The ‘How’

Being part of the Microsoft Solution team, we always go above and beyond to support our customers. The first step is always to quickly resolve the reactive issue, subsequently identify the Root Cause, and finally through our Proactive Delivery Methodology making sure this does not happen again.

Below you will now find the chronological flow of our approach to fix some of the issues over a period.

Each topic described will have a separate blog as all these Individual topics require in depth discussion.

1. Risky Sign in’s Process Improvements : We observed that there are hundreds of Risky Sign ins reported every day and our customer wanted to add restrictions which could help secure their users’ Identity.

2. Force MFA by Location: All the users were located only in 1 country but were receiving Authentication attempts from across the globe. Considering this risk, we forced MFA for any authentication attempts for Non-Trusted IP users. (Blog link will be updated once posted)

3. Eliminating weak passwords for organization: They received more than 1 million bad password attempts in a month. We wanted to protect them against this and one of the remediations we followed was to implement Azure AD Password Protection.
   Before enforcing this, they wanted to evaluate the impact, for which we created a custom dashboard that helped them to analyze weak passwords usage in the environment. (Blog link will be updated once posted)

4. Reduction in Privileged Identity Users: This is a basic for any Identity platform to implement the least privilege administration model. We reduced the numbers of High Privileged users from 30 to 9, this will further be improved post implementation of PIM. (Blog link will be updated once posted).

5. MFA Registration for all users: One of the core pillars of our strategy for Identity protection was MFA, we enrolled all users for MFA in quick time which helped us further strengthen the policies. It was critical to ensure that MFA registration happens only from trusted IP’s. (Blog link will be updated once posted)

6. Reducing number of Users synced to AAD: They had more than 60,000 users synced with AAD comparing to the active users which were less than 25,000. This was mainly due to Inactive/Disabled accounts in the On-Premises AD. We collaborated with customers Messaging & Identity team to identify and clean many stale accounts. (Blog link will be updated once posted)

7. PIM for Azure Identity roles: PIM enables you to manage, control, and monitor access to important resources in your organization. We used PIM to Provide just-in-time approvals for privileged access to the Azure AD. (Blog link will be updated once posted)

8. Enabling Internal Application access through Supported Platforms only: We found that legacy browsers were being used to exploit vulnerabilities and to use weak Authentication methods.
   In order to mitigate this concern, we restricted company applications access only through supported Browsers/Apps. (Blog link will be updated once posted)

NOTE: The features and guidelines implemented in this case was specific to this customers requirements and environment, so this is not a “General” guideline to enable any of the mentioned features.

Hope this helps,

Altug, Morne, Nibin & Zoheb

Introducing new privacy controls with the Microsoft Graph

by Scott Muniz | Aug 4, 2020 | Uncategorized

This article is contributed. See the original author and article here.

Privacy is a fundamental human right. “We are committed to providing products, information, and controls that let you choose how your data is collected and used.” Brad Smith, President & Chief Legal Officer

In May (skip below to read the announcement) we announced our plans to provide more granular privacy controls with the Microsoft Graph. 

The hundreds of millions of users of Microsoft 365 cloud services form part of the core of Microsoft Graph. The users’ data is carefully managed, protected, and with proper authorization, made available by Microsoft Graph services to drive productivity and creativity in businesses. As ubiquitous the user’s data is in Microsoft Graph, data derived from the user’s social interactions is particularly interesting. It provides intelligent insights that can answer questions such as the following:

• “Who should this user contact for information on this topic?”
• “Which documents are most interesting to this person?”

For administrators who wish to enable granular control over where intelligent insights are available to their employees, these new controls provide you the ability to configure the visibility of Graph-derived insights, between users and other items in the Graph (such as documents or sites) across apps and services in Microsoft 365.  Learn more about Graph-based insights at https://docs.microsoft.com/en-us/graph/social-intel-concept-overview?view=graph-rest-1.0#why-integrate-with-document-based-insights.

Learn more about how to configure the new Microsoft Graph privacy controls at https://docs.microsoft.com/en-us/graph/insights-customize-item-insights-privacy?view=graph-rest-1.0.

Announced in May 2020

The Microsoft Graph is the gateway to data and intelligence in Microsoft 365, providing a unified programmability model that you can use to access the tremendous amount of data in Microsoft 365, Windows 10, and Enterprise Mobility + Security.  Over the next several weeks we’re excited to introduce new innovation to help you achieve more with Microsoft Graph capabilities.

In Microsoft 365 we’re committed to privacy and control – and we’re continuing to invest in those principals with new Microsoft Graph privacy controls of document-based insights.

Across Microsoft 365 applications and services, intelligence is pervasive – whether deep learning or reasoning across activities and relationships – intelligence in Microsoft 365 is designed to help its users achieve more… 

At the center of Microsoft 365 is content, such as documents, email messages, conversations, and more.  With the amount of data expected to double year over year, information overload is often a reality.  This is where the Microsoft Graph shines.  Time is something we can’t make more of, but we can make more with it.  Document-, email-, calendar-, and user- based insights help save time and boost productivity, helping employees make more of their time.

One of the first applications to deliver these rich insights was Office Delve, powered by the Office Graph – technology which calculated relationships between people and content from Exchange, OneDrive, SharePoint, and more. Along with the Office Graph and Delve, we also delivered shared set of privacy settings, which control both insights and Delve user experience.

As the Office Graph continued to evolve, it has become a more independent, mature, and powerful service, and a part of every Microsoft 365 experience, eventually evolving to the Microsoft Graph. Given this evolution, we’ve disjoined the privacy story for two independent pieces, providing the flexibility to fine-tune item in the Graph and Delve.

Today we’re pleased to announce a set of robust new privacy settings which provides you the ability to configure the visibility of Graph-derived insights, between users and other items in the Graph (such as documents or sites). This new setting will apply similar restrictions as the original Delve settings, but decoupled from Delve. This means that you can disable the Delve app through the existing controls, but allow other insights-based experiences such as Discover in OneDrive and Suggested Sites in SharePoint Home to still provide assistance.

For organizations that need to disable item insights for all its users, we are introducing a new “isEnabledInOrganization” parameter, which allows you to disable item insights across the entirety of your organization; however, if you only need to disable item insights for a subset of employees, we’re introducing an additional “disabledForGroup” setting – an ID of one security or O365 Azure AD group.

This new setting will allow security group administrators more flexible management options using the available tools in Azure Active Directory, disabling item insights for all members of select groups. Both parameters can be configured using new MSGraph methods.

While delivering these new privacy settings we’ll respect both the existing Delve settings and these new item-insights settings, applying the strictest of them. This means that during transition phase a user is considered as opted out if either the user was opt out by Delve controls or item insights settings.

As we continue to provide more granular privacy controls, we’ll also introduce new user level controls, to provide individuals control  over the visibility of their own item insights, unless otherwise specified by other admin-facing settings such as “isEnabledInOrganization” or “disabledForGroup”.  At the time of release, we will also support migration of pre-existing Delve settings into new user control.

Bookmark this article to keep up to date on our commitment to privacy via the Microsoft Graph.