Removing Deprecated User Accounts across multiple Subscriptions

Removing Deprecated User Accounts across multiple Subscriptions

This article is contributed. See the original author and article here.

Deprecated accounts are the accounts that were once deployed to a subscription for some trial/pilot initiative or some other purpose and are not required anymore. The user accounts that have been blocked from signing in should be removed from subscriptions. These accounts can be targets for attackers finding ways to access your data without being noticed.
The Azure Security Center recommends identifying those accounts and removing any role assignments on them from the subscription, however, it could be tedious in the case of multiple subscriptions.


 


Pre-Requisite:

  Az Modules must be installed

 – Service principal created as part of Step 1 must be having owner access to all subscriptions

 

Steps to follow:


Step 1: Create a service principal



Post creation of service principal, please retrieve below values.


  1. Tenant Id

  2. Client Secret

  3. Client Id



Step 2: Create a PowerShell function which will be used in generating authorization token

function Get-apiHeader{
[CmdletBinding()]
Param
(
 [Parameter(Mandatory=$true)]
 [System.String]
 [ValidateNotNullOrEmpty()]
 $TENANTID,
 [Parameter(Mandatory=$true)]
 [System.String]
 [ValidateNotNullOrEmpty()]
 $ClientId,
 [Parameter(Mandatory=$true)]
 [System.String]
 [ValidateNotNullOrEmpty()]
 $PasswordClient,
 [Parameter(Mandatory=$true)]
 [System.String]
 [ValidateNotNullOrEmpty()]
 $resource
)
$tokenresult=Invoke-RestMethod -Uri https://login.microsoftonline.com/$TENANTID/oauth2/token?api-version=1.0 -Method Post -Body @{"grant_type" = "client_credentials"; "resource" = "https://$resource/"; "client_id" = "$ClientId"; "client_secret" = "$PasswordClient" }
$token=$tokenresult.access_token
$Header=@{
  'Authorization'="Bearer $token"
  'Host'="$resource"
  'Content-Type'='application/json'
  }
return $Header
}




 


Step 3: Invoke API to retrieve authorization token using function created in above step



Note: Replace $TenantId, $ClientId and $ClientSecret with value captured in step 1



 

$AzureApiheaders = Get-apiHeader -TENANTID $TenantId -ClientId $ClientId -PasswordClient $ClientSecret -resource "management.azure.com"

 


 


Step 4: Extracting csv file containing list of all deprecated accounts from Azure Resource Graph


Please referhttps://github.com/MicrosoftDocs/azure-docs/blob/master/articles/governance/resource-graph/first-query-portal.md


Azure Resource graph explorer: https://docs.microsoft.com/en-us/azure/governance/resource-graph/overview


Query:


 

securityresources
        | where type == "microsoft.security/assessments"
        | extend source = tostring(properties.resourceDetails.Source)
        | extend resourceId =
            trim(" ", tolower(tostring(case(source =~ "azure", properties.resourceDetails.Id,
            extract("^(.+)/providers/Microsoft.Security/assessments/.+$",1,id)))))
        | extend status = trim(" ", tostring(properties.status.code))
        | extend cause = trim(" ", tostring(properties.status.cause))
        | extend assessmentKey = tostring(name)
        | where assessmentKey == "00c6d40b-e990-6acf-d4f3-471e747a27c4"

 


 


data.JPG


 


Click on “Download as CSV” and store at location where removal of deprecated account script is present. Rename the file as “deprecatedaccountextract


 

Set-Location $PSScriptRoot
$RootFolder = Split-Path $MyInvocation.MyCommand.Path
$ParameterCSVPath =$RootFolder + "deprecatedaccountextract.csv"
if(Test-Path -Path $ParameterCSVPath)                                                                          
{ 
$TableData = Import-Csv $ParameterCSVPath
}

foreach($Data in $TableData)
{
  #Get resourceID for specific resource 
  $resourceid=$Data.resourceId
  #Get control results column for specific resource
  $controlresult=$Data.properties
  $newresult=$controlresult | ConvertFrom-Json
  $ObjectIdList=$newresult.AdditionalData.deprecatedAccountsObjectIdList
  $regex="[^a-zA-Z0-9-]"
  $splitres=$ObjectIdList -split(',')
  $deprecatedObjectIds=$splitres -replace $regex
  foreach($objectId in $deprecatedObjectIds)
  {   
    #API to get role assignment details from Azure
    $resourceURL="https://management.azure.com$($resourceid)/providers/microsoft.authorization/roleassignments?api-version=2015-07-01"
    $resourcedetails=(Invoke-RestMethod  -Uri $resourceURL -Headers $AzureApiheaders -Method GET)
    if( $null -ne $resourcedetails )
    {        
     foreach($value in $resourcedetails.value)
     {
      if($value.properties.principalId -eq $objectId)
      {
       $roleassignmentid=$value.name
       $remidiateURL="https://management.azure.com$($resourceid)/providers/microsoft.authorization/roleassignments/$($roleassignmentid)?api-version=2015-07-01"
       Invoke-RestMethod  -Uri $remidiateURL -Headers $AzureApiheaders -Method DELETE
      }
     }
    }
    else
    {
     Write-Output "There are no Role Assignments in the subscription"
    }             
   }
}

 


 


References:


https://github.com/Azure/Azure-Security-Center/blob/master/Remediation%20scripts/Remove%20deprecated%20accounts%20from%20subscriptions/PowerShell/Remove-deprecated-accounts-from-subscriptions.ps1


https://docs.microsoft.com/en-us/azure/security-center/policy-reference#:~:text=Deprecated%20accounts%20are%20accounts%20that%20have%20been%20blocked%20from%20signing%20in.&text=Virtual%20machines%20without%20an%20enabled,Azure%20Security%20Center%20as%20recommendations.


 


 

Equipping everyone with the right devices and accessories for hybrid work

Equipping everyone with the right devices and accessories for hybrid work

This article is contributed. See the original author and article here.

Recently, Microsoft unveiled new devices and accessories to help people do their best work from anywhere. The future of work is hybrid. To empower people to thrive in this new world of work, business leaders will need to provide everyone with a plan for enabling that work, as well as spaces and technology that help…

The post Equipping everyone with the right devices and accessories for hybrid work appeared first on Microsoft 365 Blog.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Learn with the Nerds: Power BI Dataflows

This article is contributed. See the original author and article here.

What You’ll Learn:


How to build re-usable, scalable ETL work in the Power BI Service
Learn how Power BI Dataflows can support your team and enterprise BI goals
To understand the role of the Common Data Model and integration with other Azure Data Services, including Azure Data Lake Gen2


 


Register here for Power BI Dataflows with Pragmatic Works 

Azure IoT Edge – A Year In Review

Azure IoT Edge – A Year In Review

This article is contributed. See the original author and article here.

This past March marked the one-year anniversary of the covid-19 pandemic. I found myself reflecting on the changes I’ve gone through, both personally and professionally. One of the bright spots was realizing how much progress our customers have made with Azure IoT Edge and the number of improvements our team has been able to add to the product. Let’s take a moment to celebrate some of the successes in a year that most of us would prefer never happened.


 


Product maturity


COVID has caused a noticeable change in the types of scenarios in which customers are using Azure IoT Edge; however, it hasn’t dampened the market’s embrace of our product. In the past year, we documented over 25 new case studies of customers using Azure IoT Edge in their digital transformation. While these case studies are a sampling of the many customers using Azure IoT Edge, they are a great example of how widely used our product is. There is representation from a gamut of industries including: automotive, banking, energy, farming, healthcare, HVAC, industrial automation, manufacturing, packaging, real estate, recycling, retail, and shipping.


 







































chipalost_0-1619646984450.png chipalost_1-1619646984453.png chipalost_2-1619646984456.png chipalost_3-1619646984458.png chipalost_4-1619646984458.png chipalost_5-1619646984459.png chipalost_6-1619646984460.png
chipalost_7-1619646984461.png chipalost_8-1619646984462.png chipalost_9-1619646984462.png chipalost_10-1619646984463.png chipalost_11-1619646984464.png chipalost_12-1619646984464.png chipalost_13-1619646984465.png
chipalost_14-1619646984465.png chipalost_15-1619646984466.png chipalost_16-1619646984467.png chipalost_17-1619646984468.png chipalost_18-1619646984468.png chipalost_19-1619646984469.png chipalost_20-1619646984470.png
chipalost_21-1619646984471.png chipalost_22-1619646984474.png chipalost_23-1619646984475.png chipalost_24-1619646984476.png chipalost_25-1619646984476.png

 


Azure IoT Edge hit an important milestone in March with the 1.1.0 release. It is our first long term servicing (LTS) release and will only be serviced with fixes to critical security issues and regressions. All other bug fixes and new feature work goes into our rolling feature releases (1.2.0 and greater). The limited number of changes in makes 1.1.0 it our most stable release and ideal for extended periods of use in production.


 


Security


Notable security exploits and data breaches continued in the tech industry last year. Azure IoT is a leader in edge security; however, we realize that we cannot rest on our laurels. To that end, we’ve shipped features specifically intended to increase the security posture of Azure IoT Edge.


 


First, we’ve updated the runtime to acquire needed certificates from EST standard infrastructure. Some customers require that certs come from their on-prem PKI infrastructure and leveraging the EST standard allows the product to integrate with compatible infrastructure.


 


Simply allowing customers to create their own certs is not enough. These certs must be protected from tampering, or theft, once on the device. Azure IoT Edge now uses the EST standard to integrate with hardware security modules (eg. TPM) to protect these valuable certs.


 


Just because a device starts off secure does not mean it remains secure. New vulnerabilities are discovered daily. Updating devices is a critical capability in the quest to keep assets protected from the latest threats. IoT Edge already does a great job of allowing customers to update the workload running on a device; however, patching the OS or even updating native components of the runtime was a job left up to the user. No more! Device Update for IoT Hub is in public preview. Customers can update IoT Edge devices, use an IoT Edge device as an update cache for downstream devices, and all of this works in a nested hierarchy often found in ISA 95 networks.


 


Observability


The ability to remotely monitor devices, understand how they are operating, and proactively identify problems is critical for solutions running in production. The IoT Edge runtime is now instrumented to produce metrics like resource consumption, message throughput, and module uptime. There’s a private preview detailing how customers can harvest these metrics and send them to the cloud to create intuitive dashboards, and we’re already working on making this default functionality you get out of the box.


 


chipalost_2-1619708156776.png


 


The support experience has also been improved. Once you realize there is an issue which needs more investigation, customers must collect logs from various components and upload them to the cloud. Now the runtime is smart enough to automatically collect the pertinent logs and upload them on the customer’s behalf via the support-bundle command.


 


Industrial


Over a year ago we undertook a feature set aimed at unblocking industrial customers. We’re now starting to see the benefits of that work. Many industrial customers have ISA 95 networks, a standard that creates a hierarchical topology where networks are layered on top of each other. Devices in one layer can only talk to devices in the previous or subsequent layer. This throws a wrench in IoT Edge solutions because the IoT Edge devices cannot send telemetry, receive updates, or do anything else that requires the internet unless they are in the topmost layer.


 


IoT Edge in a nested configuration allows customers to create a daisy chain of IoT Edge devices that traverses the network hierarchy. The devices in isolated network levels leverage the connection of their parent to eventually gain access to the internet.


 


Nesting of IoT Edge devices doesn’t only solve the industrial problem of ISA 95 networks, it’s useful for any customer who wants to run analytics in any type of hierarchy. For example, a customer in smart buildings could use nested edge for granular optimization of energy usage. An IoT Edge device could be used to run a machine learning model which optimizes energy usage for a single floor. This device could then supply data to a parent IoT Edge device which is running AI that optimizes energy usage for the entire building.


 


Edge analytics


Digital transformation has multiple phases: Connect & Monitor, Analyze & Improve, Transform & Expand. While many customers are still working through the first phase, there are others who have graduated to running analytics on the edge. Azure IoT Edge continues to invest in this area so that we have powerful features available when customers are ready to leverage them. For example, the LTS branch of IoT Edge supports native integration with Nvidia deepstream so that customers can create devices which score AI models on multiple video streams in real time!


 


The development story for edge analytics is also being moved forwards in leaps and bounds. Recently the Percept family of products was announced. These are best in class dev kits which are built on Azure IoT Edge.


 


MQTT


We have heard the desire for an MQTT broker that supports customer defined topics, pub/sub semantics, and existing MQTT devices. Azure IoT Hub and Azure IoT Edge are working together to provide this capability in the cloud and on the edge. The beginning of this functionality is available on the edge in a public preview.


 


Azure IoT Edge on Windows


Windows has a long history of security and best in class manageability. These are key reasons that some customers want to run Azure IoT Edge on a Windows host machine. Unfortunately, using these two products together create issues which are not present when running Azure IoT Edge on Linux. For example, the base image of Azure IoT Edge modules must match the Windows host OS image and RS5 was the only supported OS. Or, partners had to maintain two versions of their modules, both a Linux container and Windows container, to target all Azure IoT Edge devices.


 


Azure IoT Edge For Linux On Windows, a technology in public preview, fixes these issues. It transparently spins up a Linux VM and runs Azure IoT Edge in the context of this Linux VM. Since the VM is transparent, customers continue to manage the Windows host as they would any other Windows device. Partners writing modules for Azure IoT Edge now only have to create and maintain Linux container versions of their modules since Azure IoT Edge now runs in a Linux environment, regardless of the OS used by the host.


 


Supporting features


The very large investments detailed above should not overshadow a handful of smaller point improvements that add critical functionality to Azure IoT Edge solutions.



  • Message priority ensures that high priority messages are synced to the cloud before lower priority messages after a period of no connectivity.

  • Module boot order provides information to the runtime used to try and start modules in a particular order. Please note, that this order is not binding (a module which is started first may take a while to initialize and a subsequent module could begin running before it). Module boot order also does not apply to restarts of individual modules (if the first module crashes, all subsequent modules continue to run and are not restarted with the failed module).  

  • Module twins now support arrays. This provides module authors to more data structures for syncing information in module twins and prevents them from (serializing/deserializing) arrays (into/out of) module twins.


The work produced by the IoT Edge team over the past year is nothing short of amazing. It’s even more impressive when one realizes that it was delivered under such stressful conditions. Lorenzo and I are truly grateful to lead such a talented and motivated team. Working with them has been a highlight in a year where so many people have struggled. We have many more great innovations coming this year, and we can’t wait to see the solutions our customers continue to build with Azure IoT Edge.


 

Sarah Romotsky of Headspace addresses selfcare for national nurses week

This article is contributed. See the original author and article here.

Claire Bonaci 


You’re watching the Microsoft us health and life sciences, confessions of health geeks podcast, a show that offers Industry Insight from the health geeks and data freaks of the US health and life sciences industry team. I’m your host Claire Bonaci. As part of our 2021 nurses week series today, I welcome Sarah Romotsky, from headspace to the podcast, Sarah and I discussed self care and meditation and how it fits into the healthcare industry.  Hi, Sarah, and welcome to the podcast.


 


Sarah Romotsky 


Hi, thanks for having me.


 


Claire Bonaci 


So it is nurses week, and may is also Mental Health Awareness Month, do you mind sharing your background and why you feel like normalizing mental health is so important?


 


Sarah Romotsky 


Sure, I have a unique background, I am a registered dietician, by training, and I spent many years working on helping people change their their eating habits, to adopt healthier lifestyles. And what I kept running into with clients and patients was that there were all these psychological factors were that were at the beneath the surface of why people were eating certain things, why people were acting out certain behaviors around food and health. And I realized unless we really address the the emotional and mental factors that are at play, we can’t really change health overall. And so I’m at headspace to impact health on a much larger scale. So you know, while I still care deeply about getting people to eat a healthy diet, it’s also equally as important to focus on our mental health issues or physical health. And so I think normalizing mental health and conversations about mental health are just so important today, it’s so critical to everyone’s health and your own health and your relationships with others. Whatever that whatever behavior you’re acting out, there’s, it’s important that we address the mental and the emotional struggles below. And I think that’s really important. And that’s we know that mindfulness and meditation can help us improve our mental health, and really help us show up as a better as a better me. And as a better mother, as a better wife, as a better friend, as a better co worker, a better employee, all of these things are crucial. And mental health is really at the core of that.


 


Claire Bonaci 


And I’m curious, so you started out as a dietitian, what made you want to go to a meditation company, it seems like such a large jump, obviously, it does play a role. But I’m curious how you ended up at headspace.


 


Sarah Romotsky 


It is quite a large jump and not clear to a lot of my family why I was making that move to begin with. But it made sense to me and it still does. You know, nutrition is just is one eating behavior. That’s it’s it’s really important that we have healthy eating behaviors. And nutrition is a really big core that of course. And exercise is also one of those established behaviors that we know is helpful in having a healthy lifestyle. But to me, meditation and mindfulness are equally as important. They’re the research is there on meditation and mindfulness. And so I started meditating with headspace, before I was employee headspace during actually when I was having some serious problems with my postpartum depression after my child, and I started meditation and I realized, wow, I’m, I’m eating all this healthy things, I’m exercising, but I’m still not really taking care of my mind in the right way. Those two things weren’t really comprehensive enough. And then I added mindfulness and meditation to my routine. And I really felt a profound change in how I was showing up in the world and my emotional and my physical health. And so I decided that you know, while I still love nutrition, I there’s another healthy behavior out there that I really want to help promote. And it all runs together. There’s, you know, meditation and mindfulness can be mental mindfulness can be incorporated to many aspects of our of our lifestyle, you can have integrate mindfulness into eating, we have a whole course on mindful eating, you can have the just the act of being present and aware and having compassion can be added to everything we do at every part of our day. And so, to me, going to headspace a meditation company was just a was just looking at health on a larger scale, and still working on promoting healthy behaviors. And I will, at dinner parties, I still tell people about gluten and I talk about mindfulness because it’s they’re equally as important.


 


Claire Bonaci 


Well, I think that’s so interesting that you just bring up that parallel between one being healthy and whether that comes just with eating well and exercising. But that side piece of your mental health is just as important as your physical health. So I think that’s honestly forgotten many times. So that is, that’s great that you brought that parallel, and you brought it up just a little bit about the healthcare industry. So how do you think meditation and self care fits into the healthcare industry, especially with the noting that this week is nurses week?


 


Sarah Romotsky 


Yeah. You know, I think self care used to be one of those like luxuries that only people who worked a certain amount or put in invested certain amount could could have the luxury of self care. And we used to think of self cares, you know, bubble baths, and maybe massage or maybe reading a book. But those still totally can be self cared. But my message in our message is headspace is self care is not a luxury, it’s a necessity. And the research shows that meditation and mindfulness in the form of self care is one that can truly have huge impact on mental and physical health, reduce stress, reduce anxiety, depression, improve sleep, better management of chronic conditions. I mean, these are things that have been proven in the research that mindfulness can affect and so while certainly take all the bubble baths you want, it’s really important that we think about other other ideas of self care that can that can truly improve our mental health Who would ever thought that sitting and doing deep breathing for 10 minutes was actually a necessity, right? Like, I don’t know if we’ve ever would have really thought that as a culture, but I think we’re getting to that place. And especially with a pandemic, we’re all really realizing how important it is to develop those self care routines. And when it comes to National Nurses week, I mean, I can’t think of health care professionals that are more in need and deserving of taking that time for self care when you care for others all day. And many of them also care for family members at home, too, when they come back from work. It can be hard to find that time for yourself. But it is so needed, we often fall to the bottom of the list of priorities, you know, of everything we need to do the day but it is the most needed, because that’s how we can show up the best for everyone around us. And so 10 minutes a day of meditation, 10 minutes, even three times a week, can really have such a great impact on your health, because the stressors and the triggers in our life are never are not going to go away. The pandemic might go away, but we’ll still have jobs we’ll still have children will still have finances will still have work. But it’s how we respond to those stressors that are really important. And so finding a self care routine that can really help you react better to those stressors is what’s key. But I think that we should expand the idea of self care and really think about how that can fit into modern mainstream medicine and health care today.


 


Claire Bonaci 


I 100% agree with everything you said you made some really great points. I think definitely, especially with the pandemic happening, people really realize that their mental health is completely affected by what’s going on in the world, and especially what’s going on at home when everything switched to virtual. Think just so much pressure, so much added stress was put on everyone no matter kind of what role you’re in, but especially in the healthcare industry, especially those frontline workers and those nurses and doctors. I know you briefly mentioned just the the research on that. Do you have any research that says that this would help with prevention of kind of healthcare events or just help overall in the healthcare space?


 


Sarah Romotsky 


Yeah, there’s been, you know, there’s so many studies out there on the benefits of meditation. And then also headspace has 27 published studies itself that have really looked at the efficacy of our product, on on mental health and emotional well being. But you know, there’s one study that showed that using headspace can reduce stress in 10 days by 14%. Another one with healthcare workers specifically showed reduce burnout with nurses. And so the best thing about headspace is that there it’s available for you at anytime you need it right in between a shift. I know a lot of healthcare professionals who use headspace right before rounds with their team. I mean, there’s so many different ways you can utilize it. And there’s so many different types of content. The benefit is all of them are based in science and based in the authentic practice of meditation,


 


Claire Bonaci 


when definitely, especially in the healthcare space, especially addressing burnout, I think we always talk about clinician burnout, but this is like a clear, actionable way to help reduce that. And what are some actions or takeaways that you want to leave our listeners with?


 


Sarah Romotsky 


Yeah, I mean, I think there’s three things. Number one, meditation is for everyone. You don’t need to be you don’t need to have a diagnosis, a mental disorder, you don’t need to have a chronic condition, but you can and have had those and also find benefit. Anyone can do it. The second my second thing I want people to know is that it doesn’t have to be daily. And to give it time, it’s not a you know, just like let’s say trying to be on a weight loss journey. You can’t eat a salad and then expect next day to see the pounds change on your scale. And it’s the same thing with meditation you really need to put in the time be consistent with it but you will get to a point where you feel you feel that change you feel different. There’s a difference there that you can, you might not be able,it may not be tangible, but you Like I said, maybe before you used to scream at people in traffic, maybe you know, six weeks later of using headspace and meditation, you feel a little bit more resilient to some of those stressors that usually would really get under your skin. So that’s my second thing. It doesn’t have to be daily, it just has to be consistent. And, and the third thing would be that this is a legitimate practice that healthcare leaders, business leaders, medical experts, scientists, doctors are on board with, because the research is there. So headspace works with healthcare organizations, like the American Medical Association, and others, because they know that meditation can improve your health and well being


 


Claire Bonaci 


even the first point that you made about it is for everyone, I do think that there’s still kind of a weird, taboo stereotype around meditation. And honestly, myself, I was a convert, I did not meditate up until probably last few years. And once I switched to it, I did notice the difference. And I did realize, yes, this is for everyone. This is not just for someone that’s diagnosed with a condition. It really is for anyone in everyone. And I want to thank you again, Sarah, for being part of the podcast, I have one final question for you something a little fun. What is one unexpected kind thing that someone did for you or your family during the pandemic?


 


Sarah Romotsky 


I love that question. You know, you don’t often sit and think, Hmm, what did what did people done for me? And I love that question. And I, the first thing that comes to mind is, um, have a really wonderful neighbor Lupita. And the other day, I had flowers on my doorstep. And it was and it said, you know, to Sarah from Lupita, and I was, wait, it’s not my birthday. It’s not Mother’s Day, like, what would this is, and I realized, it’s because she’s probably watched me every day for the last nine months a year during this pandemic struggle. I mean, we’re gonna put it up in front of our house, she’s watched me, you know, try to shove my kids into the car or watch my four year old run down the street without holding hands, or, you know, watch probably my, my baby run out without any underwear on diapers on you know, and like, she’s, she’s seen, she’s been so close to my life for the last nine months, because we’ve all been home that she’s probably seen, you know, front and center, the what’s been happening in my family, and what’s been happening is just what’s happening in everyone’s family. We’re making it work. We’re trying our best. And just the fact that she just put flowers on my doorstep for no specific reason. But no even caught note note to say why but I know it’s because she has seen and knows and understands and appreciates what we’re going through what I’m going through as a working mom.


 


Claire Bonaci 


this is real life. This is what life is right now, and we’re all getting through it together. So, again, thank you so much, Sarah, and hopefully everyone takes this as a sign to go get headspace and start meditation.  Thank you all for watching. Please feel free to leave us questions or comments below. And check back soon for more content from the HLS industry team.