Windows 10 – All Things About Application Guard

by Contributed | Jun 16, 2021 | Technology

This article is contributed. See the original author and article here.

Hi IT Professionals,

While working on a Customers ‘requests on Windows Defender Application Guard related to Microsoft Endpoint Manager – Attack Surface Reduction Policies, I could not find an up-to-date and detailed document from internet search. I have ended up digging more on the topic and combining the WDAG information.

Today we would discuss about all things related to Windows Defender Application Guard included features, advantages, installation, configuration, testing and troubleshooting.

Application Guard features could be applied to both Edge browser and Office 365 applications.

• For Microsoft Edge, Application Guard helps to isolate enterprise-defined untrusted sites from trusted web sites, cloud resources, and internal networks defined by administrator’s configured list. Everything not on the lists is considered to be untrusted. If an employee goes to an untrusted site through either Microsoft Edge or Internet Explorer, then Microsoft Edge is kicked in and Edge opens the site in an isolated Hyper-V-enabled container.

• For Microsoft Office, Application Guard helps prevents untrusted Word, PowerPoint and Excel files from accessing trusted resources. Application Guard opens untrusted files in an isolated Hyper-V-enabled container. The isolated Hyper-V container is separate from the host operating system. This container isolation means that if the untrusted site or file turns out to be malicious, the host device is protected, and the attacker can’t get to your enterprise data.

Application Guard Prerequisite for Windows 10 systems:

• For Edge Browser
  
  
  
  • 64 bit CPU with 4 cores
  
  
  • CPU supported for virtualization, Intel VT-x or AMD-V
  
  
  • 8GB of RAM or more.
  
  
  • 5GB of HD free space for Edge
  
  
  • Input/Output Memory Management Unit (IOMMU) is not required but strongly recommended.
  
  
  • Windows 10 Ent version 1709 or higher, Windows 10 Pro version 1803 or higher, Windows 10 Pro Education version 1803 or higher, Windows 10 Edu version 1903 or higher.
  
  
  • Office: Office Current Channel and Monthly Enterprise Channel, Build version 2011 16.0.13530.10000 or later
  
  
  • Intune or any other 3rd party mobile device management (MDM) solutions are not supported with WDAG for Professional editions.
  
  
  
  


• For Office
  
  
  
  • CPU and RAM same as Application Guard for Edge Browser.
  
  
  • 10GB of HD free space.
  
  
  • Office: Office Current Channel and Monthly Enterprise Channel, Build version 2011 16.0.13530.10000 or later.
  
  
  • Windows 10 Enterprise edition, Client Build version 2004 (20H1) build 19041 or later
  
  
  • security update KB4571756
  
  
  
  

Application Guard Installation

Windows 10 Application Guard feature is turned off by default.

§  To enable Application Guard by using the Control Panel-features

             > Open the Control Panel, click Programs, and then click Turn Windows features on or off.

              > Restart device.

§  To enable Application Guard by using PowerShell

                > Run Windows PowerShell as administrator.

Enable-WindowsOptionalFeature -online -FeatureName Windows-Defender-ApplicationGuard

               > Restart the device.

§       To deploy Application Guard by using (Intune) Endpoint Manager

1. Go to https://endpoint.microsoft.com and sign in.


2. Choose Enpoint security > Attack surface reduction > + Create profile, and do the following:
   
   
   
   1. In the Platform list, select Windows 10 and later.
   
   
   2. In the Profile list, select App and browser isolation.
   
   
   3. Choose Create.
   
   
   4. 
      
      

       

      
      
      

       

      
      
   
   
   
   


3. Specify the following settings for the profile:
   
   
   
   1. Name and Description
   
   
   2. In the Select a category to configure settings section, choose Microsoft Defender Application Guard.
   
   
   3. In the Application Guard list, choose: “Enable for Edge” or “Enable for isolated Windows environment” or  “Enable for Edge AND isolated Windows environment”
   
   
   
   

     4.  Choose your preferences for print options, 

         5.  Define Network boundaries: internal network IP ranges, Cloud Resources IP ranges or FQDNs, Network Domains, Proxy Server IP                  addresses and Neutral resources ( e.g Azure signin URLs)

•   Internal network IP range example:

•  Cloud Resources example:

• Network Domains example:

• Neutral resources example:

7. Review and Save
   
   
   
   1. 
   
   
   
   


8. Save, Next.


9. Scope Tags, … Next


10. Choose Assignments, and then do the following:
    
    
    
    1. On the Include tab, in the Assign to list, choose an option.
    
    
    2. If you have any devices or users you want to exclude from this endpoint protection profile, specify those on the Exclude tab.
    
    
    3. Click Save, Create.
    
    
    
    

After the profile is created, and applied to Windows 10 mobile systems, users might have to restart their devices in order for protection to be in place.

§   To Enable Application Guard using GPO

Microsoft Defender Application Guard (Application Guard) works with Group Policy to help you manage the following settings:

• Network Isolation settings ,

Computer ConfigurationAdministrative TemplatesNetworkNetwork Isolation, wildcard “.” could be used

• Application Guard settings (clipboard copying, printing, non-enterprise web content in IE and Edge, Allowed persistent container,  download file to OS Host, Allow Extension in Container, Allow Favorite sync, …)

Computer ConfigurationAdministrative TemplatesWindows ComponentsMicrosoft Defender Application Guard

After the profile is created, and applied to client systems, users might have to restart their devices in order for protection to be in place.

Testing Application Guard

• Testing for Office application.

You could refer to techblog article named “Microsoft Defender Application Guard for Office” of John Barbe for information and testing steps.

• Testing for Edge Browser.

You could test application guard on Standard mode for home users or Enterprise mode for domain users. We are focusing on Enterprise mode testing:

1. Start Microsoft Edge and type https://www.microsoft.com.

After you submit the URL, Application Guard determines the URL is trusted because it uses the domain you’ve marked as trusted and shows the site directly on the host PC instead of in Application Guard.

2. In the same Microsoft Edge browser, type any URL that isn’t part of your trusted or neutral site lists.

After you submit the URL, Application Guard determines the URL is untrusted and redirects the request to the hardware-isolated environment.

Tips:

• To reset (clean up) a container and clear persistent data inside the container:

1. Open a command-line program and navigate to Windows/System32.
   2. Type wdagtool.exe cleanup. The container environment is reset, retaining only the employee-generated data.
   3. Type wdagtool.exe cleanup RESET_PERSISTENCE_LAYER. The container environment is reset, including discarding all employee-generated data.

• Starting Application Guard too quickly after restarting the device might cause it to take a bit longer to load. However, subsequent starts should occur without any perceivable delays.


• Make sure to enable “Allow auditing events” for Application Guard if you want to collect Event Viewer log and report log to Microsoft Defender for Endpoint

• Configure network proxy (IP-Literal Addresses) for Application Guard:

Application Guard requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as 192.168.1.4:81 can be annotated as itproxy:81 or using a record such as P19216810010 for a proxy with an IP address of 192.168.100.10. This applies to Windows 10 Enterprise edition, version 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune.

Application Guard Extension for third-party web browsers

The Application Guard Extension available for Chrome and Firefox allows Application Guard to protect users even when they are running a web browser other than Microsoft Edge or Internet Explorer.

Once a user has the extension and its companion app installed on their enterprise device, you can run through the following scenarios.

1. Open either Firefox or Chrome — whichever browser you have the extension installed on.


2. Navigate to an enterprise website, i.e. an internal website maintained by your organization. You might see this evaluation page for an instant before the site is full loaded. 

3. Navigate to a non-enterprise, external website site, such as www.bing.com. The site should be redirected to Microsoft Defender Application Guard Edge.

More detail on Extension for Chrome and Firefox browser is here: Microsoft Defender Application Guard Extension – Windows security | Microsoft Docs

Troubleshooting Windows Defender Application Guard

The Application Guard known issues are listed in the following table:

I would hope the information provided in this article is useful.

Until next time.

Reference:

• https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview


• https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard


• https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip


• Testing scenarios with Microsoft Defender Application Guard (Windows 10) – Windows security | Microsoft Docs


• Microsoft Defender Application Guard Extension – Windows security | Microsoft Docs


• Microsoft Edge and Microsoft Defender Application Guard | Microsoft Docs


• Use a network boundary to add trusted sites on Windows devices in Microsoft Intune

First Impressions of the Azure Percept DK

by Contributed | Jun 16, 2021 | Technology

This article is contributed. See the original author and article here.

Unboxing

As an MVP in the UK and after a fair bit of complaining and questioning of the Microsoft IOT team about the release dates of the Azure Percept into the UK/EU markets they offered to loan me one. Obviously I said YES! and a few days later I got a nice box.

So opening the box for a look inside and you are presented with a fantastic display of the components that make up the Azure Percept Developer Kit (DK). This is the Microsoft Version of the Kit and not the one available to buy here from the Microsoft Store which is made by Asus. There are a few slight differences but I am told by the team they are very minor and won’t affect it’s use in any way, but the kit you get and it’s abilities for such a low cost is very impressive.

Lifting the kit out of the box and removing the foam packaging for a closer look we can see that it’s a gorgeous design and with my Surface Keyboard in the back of the image you can see that the design team at Microsoft have a love of Aluminium (Maybe that’s why there is a delay for the UK they need to learn to say the AluMINium correctly :beaming_face_with_smiling_eyes:).

80/20 Rail

The kit is broken down into 3 sections all very nicely secured to an 80/20 Aluminium rail, now as an engineer that spent many years in the Automotive industry this shows the thought put into this product. 80/20 is an industry standard rail which means that when you have finish playing with your Proof Of Concept on the bench you can easily move to the factory and install with ease and no need for special brackets or tools.

Kit Components

Like I said the kit is made up of 3 sections all separate on the rail and with the included Allen key you can loosen the grub screws and remove them from the rail if you really want. Starting with the main module this is called the Azure Percept DK Board and is essentially the compute module at will run the AI at the edge, the next along the rail is the Azure Percept Vision SoM (System on a Module) and this is the camera for the kit and lastly is the Azure Percept Audio Device SoM.

Azure Percept DK Board

The DK board is an NXPiMX8m processor with 4GB memory and 16GB storage running the CBL-Mariner OS which is a Microsoft Open Source project on GitHub Here on top of this is the Azure IoT Edge runtime which has a secure execution environment. Finally on top of this stack is the Containers that hold your AI Edge Application Models that you would have trained on Azure using Azure Percept Studio

The board also contains a TPM 2.0 Nuvoton NCPT750 module which is a Trusted Platform Module and this is used to secure the connection with Azure IoT Hub so you have Hardware root of trust security built in rather than relying on CA or X509 certificates. The TPM module is a type of hardware security module (HSM) and enables you to the IoT Hub Device Provisioning Service which is a helper service for IoT Hub that means you can configure zero-touch device provisioning to a specified IoT hub. You can read more on the Docs.Microsoft Page

For connectivity there is Ethernet, 2 USB-A 3 ports and a USB-C port as well as WiFi and Bluetooth via Realtek RTL882CE single-chip controller. The Azure Percept can also be used as a WiFi Access Point as part of a Mesh network which is very cool as your AI Edge Camera system is now also the factory WiFi network. There is a great Internet of Things Show explaining this in more detail than I have space here.

Although this DK board has WiFi and Ethernet connectivity for running AI at the edge it can also be configured to run AI models without a connection to the cloud, which means your system keeps working if the cloud connection goes down or your at the very edge and the connection is intermittent.

You can find the DataSheet for the Azure Percept DK Board Here

Azure Percept Vision

The image shows the Camera as well as the housing covering the SoM which can be removed, however it will then have no physical protection so not the best idea unless your fitting into a larger system like say a Kiosk. However if you need to use it in more extreme temperature environment removing the housing does improve the Operating temperature window by a considerable amount 0 -> 27C with Housing and -10 -> 70C without! remember that on hot days in the factory but also consider this when integrating into that Kiosk…

The SoM includes Intel Movidius Myriad X (MA2085) Vision Processing Unit (VPU) with Intel Camera ISP integrated, 0.7 TOPS and added to this is a ST-Micro STM32L462CE Security Crypto-Controller. The SoM has onboard 2GB memory as well as a Versioning/ID Component that has 64kb EEPROM which I believe is to allow you to configure the device ID at a Hardware level (please let me know if I am way off here!) this means the connection from the module via the DK Board all the way up to Azure IoT Hub is secured.

The Module was designed from the ground up to work with other DK boards and not just the NXPiMX8m but the time of writing this is the reference system, but you can get more details from another great Internet of Things Show

As for ports it has 2 camera ports but sadly only one can be used at present and I am not sure at the time of writing if the version from ASUS has 2 ports but looking at images it looks identical, I am guessing the 2nd port is a software update away allowing 2 cameras to be connected maybe for a wider FoV or IR for night mode.

Also on the SoM are some control interfaces which include:

2 x I2C

2 x SPI

6 x PWM  (GPIOs: 2x clock, 2x frame sync, 2x unused)

2 x Spare GPIO

1 x USB-C 3 used to connect back to the Azure Percept DK Board.

2 x MIPI 4 Lane(up to 1.5 Gbps per lane) Camera lanes.

At the time of writing I can not find any way to use any of these interfaces so I am assuming as this is a developer kit they will be enabled in future updates.

The Camera Module that is included is a Sony IMX219 Camera sensor with 6P Lens that has a Resolution of 8MP at 30FPS at a Distance of 50 cm -> infinity, the FoV is a generous 120-degrees diagonal and the RGB sensor colour is Wide Dynamic Range fitted with a Fixed Focus Rolling Shutter. This sensor is currently the only one that will work with the system but the SoM was designed to use any equivalent sensor like say an IR sensor or one with a tighter FoV with minimal hardware/software changes, Dan Rosenstein explains this in more detail in the IOT Show linked above.

The Blue knob you can see at the side of the module is so that with the DK you can adjust the angle of the Camera sensor which is held onto the aluminium upstand with a magnetic plate so that it’s easy to remove and change.

You can find the DataSheet for the Azure Percept Vision Here

Azure Percept Audio

The Percept Audio is a two part device like the Percept Vision, the lower half is the SoM and the upper half is the Microphone array consisting of 4 microphones.

The Azure Percept Audio connects back to the DK board using a standard USB 2.0 Type A to Micro USB Cable and it has no housing as again it’s designed as a reference design and to be mounted into your final product like the Kiosk I mentioned earlier.

On the SoM board there are 2 Buttons Mute and PTT (push-To-Talk) as well as a Line Out 3.5mm jack plug for connecting a set of headphones for testing the audio from the microphones.

The Microphone array is made up of 4 MEM Sensing Microsystems Microphones (MSM261D3526Z1CM) and they are spaced so that they can give 180 Degrees Far-field at 4 m, 63 dB which is very impressive from such a small device. This means that your Customizable Keywords and Commands will be sensed from any direction in front of the array and out to quite a distance. The Audio Codec is XMOS XUF208 which is a fairly standard codec and there is a datasheet here for those interested.

Just like the Azure Percept Vision SoM the Audio SoM includes a ST-Microelectronics STM32L462CE Security Crypto-Controller to ensure that any data captured and processed is secured from the SoM all the way up the stack to Azure.

There is also a blue knob for adjusting the angle the microphone array is pointing at in relation to the 80/20 rail and the modules can of course be removed and fitted into your final product design using the standard screw mounts in the corners of the boards.

You can find the DataSheet for the Azure Percept Audio Here

Connecting it all together

As you can see in the images all 3 main components are secured to the 80/20 rail so we can just leave them like this for now while we get it all set-up.

First you will want to use the provided USB 3.0 Type C cable to connect the Vision SoM to the DK Board and the USB 2.0 Type A to Micro USB Cable to connect the Audio SoM to one of the 2 USB-A ports.

Next take the 2 Wi-Fi Antennas and screw them onto the Azure Percept DK and angle them as needed, then it’s time for power the DK is supplied with a fairly standard looking power brick or Ac/DC converter to be precise. The good news is that they have thought of the world use and supplied it with removable adapters so you can fit the 3-Pin for the UK rather than looking about for your travel adapter. The other end has a 2-pin keyed plug that plugs into the side of the DK.

Your now set-up hardware wise and ready to turn it on…

Set-up the Wi-Fi

Once the DK has powered on it will appear as a Wi-Fi access point, inside the welcome card is the name of your Access point and the password to connect. On mine it said the password was SantaCruz and then gave a future password, it was the future password I needed to use to connect.

Once connected it will take you thru a wizard to connect the device to your own wi-fi network and thus to the internet, sadly I failed to take any images of this set as I was too excited to get it up and running (Sorry!).

During this set-up you will need your Azure Subscription login details so that you can configure a New Azure IoT Hub and Azure Percept Studio. This will then allow you to control the devices you have and using a No-Code approach train your first Vision or Audio AI Project.

Training your first AI Model

Clicking the Vision link on the left pane to start training our first vision model.

Once this is created you will be shown the Image Capture pane where you can set-up the capturing of images, as you can see here I have set-up the IoT Hub to use and the Percept device to use on that Hub. I have then ticked the Automatic Image Capture and set this to capture an image every 30 seconds until it has taken 25 image. This means that rather than clicking the Take Photo button I can just wave my objects front of the Camera and it will take the images for me, I can then concentrate on the position of the objects rather than playing with the mouse to click a button. Also the added advantage is that when you have the Vision Device mounted in your final product and it’s out at the Edge in your Factory or store you can remotely capture the images over a given timespan.

The next pane will show a link out to your new Custom Vision project and it’s here that you will see the images captured and you can tag them as needed.

If you click into the project you will then be able to select Un-Tagged and Get Started to tag the images and train a model. I have just got the camera pointing into space at the moment for this post but you get the idea.

Now you click into each of the images in turn and as you move the mouse around you will see it generates a box around objects it has detected, you can click one of these and give that object a name like say ‘Keyboard’ once you have tagged all the objects of interest in that image move onto the next image.

If however the system hasn’t created a region around your object of interest don’t fret just left mouse click and draw a box around it, then you can give it a name and move on.

On the right of the image you will see the list of objects you have tagged and you can click these to show those objects in the image to check your happy with the tagging.

When you move to the next image and select a region you will notice the names you used before appear in a dropdown list for you to select, this ensures you are consistent with the naming of your objects in the trained model.

When you have tagged all the images and don’t forget to get a few images with none of your objects in so that you have no trained Bias in your AI model you can click the Train button at the top of the page.

It seems tedious but you do need 15 images tagged for each object minimum but ideally you will want many more than that, it’s suggested 40 to 50+ is best and from many angles and in many lighting conditions for the best trained model. The actual training takes a few minutes so an ideal time for that Coffee break you have earned it!.

When the training is complete it will show your some predicted stats for the model, here you can see that as I have not provided many images the predictions are low so I should go back and take some more pictures and complete some more tagging.

At the top you can see a Quick Test button that allows you to provide a previously unseen image to the model to check that it detects your objects.

Deploy the Trained Model

Now that we have a trained model and you are happy with the prediction levels and it’s tested on a few images you can go back to the Azure Percept Studio and complete the deploy step. This will send the Model to the Percept device and allow it to use this model for image classification.

You can now click the View Device Video Stream and see if your new Model works.

Final Thoughts

Well hopefully you can see the Azure Percept DK is a beautifully designed piece of kit and for a Developer Kit it is very well built. I like the 80/20 system and this make final integration super easy and I hope the Vision SoM modules allow the extra camera soon as a POC I am looking at for a client using the Percept will need a night IR camera so seems a shame to need 2 DK’s to complete this task.

The unboxing to having a trained and running model on the Percept is less than 20 minutes, I obviously took longer as I was grabbing images of the steps etc but even then it a pain free and simple process. I am now working on a project for a client using the Percept to see if the Audio and Vision can solve a problem for them in their office space, assuming they allow me I will blog about that project soon.

The next part of this series of blogs will be updating the software on your Percept using the OTA (Over-The-Air) update system that is built into the IoT Hub for Device Updates so come back soon to see that.

As always any questions or suggestions if you have spotted something wrong find me on Twitter @CliffordAgius

Happy Coding.

Cliff.

Microsoft 365 Developer Podcast – Azure Event Hub and Rich Notifications with Ayca Bas

by Contributed | Jun 16, 2021 | Technology

This article is contributed. See the original author and article here.

Links from the show:

• Get Microsoft Graph change notifications delivered through Azure Event Hubs


• Set up change notifications that include resource data


• Build session recording

Microsoft News

• Automate and manage Azure AD tasks at scale with the Microsoft Graph PowerShell SDK


• Application Insights Azure DevOps Release Annotations Implementation Update


• Microsoft Teams: Change notifications extended for federated chats


• Microsoft Build 2021




• Visual Studio Code at Build 2021


• Microsoft 365 Developer playlist


• All Sessions




• Join us to see what’s next for Windows

Community Links

• PnP Modern Search web parts v4.2.0 released!


• List Expiring Application Credentials – Graph.Community Samples

Basic Authentication and Exchange Online – June 2021 Update

by Contributed | Jun 16, 2021 | Technology

This article is contributed. See the original author and article here.

It’s been a few months since our last update on Basic Authentication in Exchange Online, but we’ve been busy getting ready for the next phase of the process: turning off Basic Authentication for tenants that don’t use it, and therefore, don’t need it enabled.

We have millions of customers who have Basic Auth enabled in their tenant, but only use Modern Auth. Many of them don’t know Basic is enabled, and the risks that it presents – so we are going to do our bit to help secure their data by turning it off for them.

Over the last few months, we have been building the supporting process and tools we need to do that at scale, and now we’re ready to start rolling it out.

The Process

As we’ve said before, we’re only currently planning to turn off Basic Auth for those customers who are not using it. For customers that use still Basic for some or all the affected protocols*, we are not touching authentication settings for those protocols (for the time being).

(*as previously announced these are: Exchange Web Services (EWS), POP, IMAP, Exchange ActiveSync (EAS), Remote PowerShell (RPS) , Outlook (EWS + MAPI, RPC, and OAB) and SMTP AUTH)

We have been busy analyzing Basic Auth usage data for our customers and now have a solid understanding of who uses it and who does not. And we’re going to start turning it off for those who are not using it.

The process is: We’ll randomly select customers with no usage in any, or all affected protocols, send them a Message Center post informing them that in 30 days we’re going to turn off Basic Auth. 30 days later, we’ll turn it off and send another Message Center post to confirm it was done. Customer protected… check!

We’ve already done this for a pilot set of tenants so we feel good about how this works, but before we scale up we wanted to build a tool to help our customers just in case we get it wrong. Why would we get it wrong? Well, very low usage is hard to detect if connections are rare, and some customers might even suddenly start using Basic auth. On that note….

You should know that we can’t really tell if Basic auth usage is legitimate usage, or an account that has already been compromised – we just see this as someone logging in to the mailbox, and in this case will not disable the protocol. Now therefore is another great moment to plug the Azure AD Sign-In log, as it can help surface ‘unexpected’ usage.

What if we do not spot that new usage , and we disable Basic? What then? Well, that’s where a new tool we’ve been building comes in – a tool that provides self-service re-enablement.

We’ve built a new diagnostic into the Microsoft 365 admin center. You may have seen this before for things like EWS migration throttling, or you read this excellent recent post about it. These diagnostics have proven really popular with customers, so we simply built on that technology.

Self-Service Re-Enablement

If you want to re-enable a protocol that we have disabled for Basic Auth, or want to see what protocols we have disabled, open the Microsoft 365 admin center and click the small green ? symbol in the lower right hand corner of the screen.

Once you do that you enter the self-help system which, (in case you didn’t know) can use some very clever logic to help you find a solution to all kinds of problems. But if you want to get straight to the new Basic Auth self-help diagnostic simply enter the magic phrase “Diag: Enable Basic Auth in EXO”.

(Don’t tell anyone, this is our little secret. Published on one of the most popular blogs we’ve ever had at Microsoft. Shhh.)

Once you do that, you’ll see a page very similar to this:

Once you click Run Tests, the tool will check your tenant settings to see if we have disabled Basic Auth for any protocols, and then display the results.

If we have not disabled Basic Auth for any protocols we’ll tell you just that. But assuming we have done something, you’ll see a list of protocols that are disabled. My tenant has the full set of protocols disabled as you can see from the following:

Now that’s great, you can see what we did, but the best thing is, you can also re-enable the protocols yourself (if you want to). You can simply select the protocol (or a group of protocols, in the case of Outlook), check the box to agree to the warning (you know turning Basic Auth back on is bad right?) and then click Update Settings:

If you want to re-enable another protocol (again – why would you do that…?) re-run the diag and you can do just that.

That’s it – that’s how you can re-enable a protocol if we turn it off as part of this larger security effort. This is the only way to re-enable 8 of the 9 protocols included in the scope of this effort. (Up until the point at which we start to disable Basic Auth for protocols which are in-use – we are still planning on doing that and will have news on that later this year)

The only protocol you cannot re-enable in this way is SMTP AUTH – that’s not a part of this diagnostic because there’s already a lot of diagnostic wizardry available to help you with SMTP AUTH, and you can already switch SMTP AUTH on and off yourself by using the Set-TransportConfig cmdlet. Because unlike the other 8, all we’re doing to disable Basic Auth for SMTP AUTH is Set– SmtpClientAuthenticationDisabled to $False for tenants, and you can just go right ahead and turn it back on if you subsequently decide you need and want to use it.

One other notable difference in behavior with SMTP AUTH compared to the others is that the switch for SMTP AUTH controls Basic and OAuth client submission, they are not individually switchable. You can still enforce the use of OAuth using Conditional Access, but it’s a little more involved than just on or off for Basic, you can read more about authenticated SMTP submission here.

So how are we controlling the use of Basic Auth for the other 8 protocols? Good question, so good in fact we added that to the list of other excellent questions you might have below.

Some Questions and Answers

Why do I need this diagnostic tool? Why can’t I just go look at the Authentication Policies in my tenant and disable/delete them if I do not want Basic disabled for any protocol?

Good question! We are not turning off Basic using Authentication Policies. Therefore, Authentication Policies setting has no effect on the way that we will disable (and you can re-enable) Basic Auth using this diagnostic.

I use Basic Auth still for <insert your device, third party app, home grown app, etc. here> and I do not want you to turn it off!!

As long as your app checks mail or does whatever it does pretty regularly, we’ll consider that ‘active usage’ and not touch the authentication settings for the protocol it uses for the time being.

How exactly is Microsoft turning Basic Auth on or off on a per-protocol level?

We’ve added a new org level parameter that can be set to turn Basic Auth on or off for individual protocols within a tenant. Admins can view the parameter (-BasicAuthBlockedApps) using Get-OrganizationConfig. It’s not something you can change, and the values we store in there aren’t very user friendly, but luckily Exchange Online knows how to read and enforce them. A value of Null there means we’ve not touched your tenant. A value other than Null means we have, and the diagnostic is the way to determine what is disabled there.

I just got the Message Center post but I know I have an app that still needs to use Basic Auth. Please do not turn it off, I don’t want to have to re-enable it.

We are looking to add ‘opt-out of Basic Auth disablement’ functionality to this diag quite soon so you can do just that. The idea is that once you get the Message Center post you can use the diag to say “please don’t disable basic auth for IMAP” for example. And we’ll respect that. However… we strongly encourage you to request an opt-out only for the protocols you know you need, and don’t just ask for them all. Leaving unused protocols enabled for Basic Auth is a huge security risk to your tenant and your data.

When is Microsoft going to start turning off Basic Auth for protocols that we are actively using?

As announced earlier this year we’ve paused that program for now, but it will be coming back, so make sure you keep an eye on the blog and the Message Center for that announcement and keep working to eliminate the need for Basic Auth in your environment!

The Exchange Team

What’s New: Azure Sentinel Update Watchlist UI Enhancements

by Contributed | Jun 16, 2021 | Technology

This article is contributed. See the original author and article here.

This blog post is a collaboration between @Cristhofer Munoz and @JulianGonzalez 

This installment is part of a broader series to keep you up to date with the latest features/enhancements in Azure Sentinel. The installments will be bite-sized to enable you to easily digest the new content.

Introduction

Security operations (SecOps) teams need to be equipped with the tools that empower them to efficiently detect, investigate, and respond to threats across your enterprise. Azure Sentinel watchlists empower organizations to shorten investigation cycles and enable rapid threat remediation by providing the ability to collect external data sources for correlation with security events. Additionally, correlations and analytics help SecOps stay appraised of bad actors and compromised entities across the environment. Incorporating external data and performing correlation across analytics allows security teams to get a better view of their entire infrastructure and take steps to reduce risk.

Due to evolving and constant change in the cybersecurity landscape that we live in, it is very challenging for SecOps to stay appraised of new indicators of compromise.

Azure Sentinel Watchlists provides the ability to  quickly import IP addresses, file hashes, etc. from csv files into your Azure Sentinel workspace.  Then utilize the watchlist name/value pairs for joining and filtering for use in alert rules, threat hunting, workbooks, notebooks and for general queries.

Due to the constant change, security analysts need the flexibility to update watchlists to stay ahead. With that in mind,  we are super excited to announce the Azure Sentinel Watchlist  enhancements that empower security analysts to drive efficiency by enabling the ability to update or add items to a watchlist using an intuitive user interface.

———————————————————————

For additional use case examples, please refer to these relevant blog posts:

Utilize Watchlists to Drive Efficiency during Azure Sentinel Investigations:

Utilize Watchlists to Drive Efficiency During Azure Sentinel Investigations – Microsoft Tech Community

Playbooks & Watchlists Part 1: Inform the subscription owner

https://techcommunity.microsoft.com/t5/azure-sentinel/playbooks-amp-watchlists-part-1-inform-the-sub…

Playbooks & Watchlists Part 2: Automate incident response

https://techcommunity.microsoft.com/t5/azure-sentinel/playbooks-amp-watchlists-part-2-automate-incid…

Please refer to our public documentation for other additional details. 

———————————————————————

Watchlist Updating Functionality

The new watchlist UI encompasses the following functionality:

– Add new watchlist items or update existing watchlist items.

– Select and update multiple watchlist items at once via an Excel-like grid.

– Add/remove columns from the watchlist update UI view for better usability.

How to update watchlist

From the Azure portal, navigate to Azure Sentinel > Configuration > Watchlist 

Select a Watchlist, then select Edit Watchlist Items

Select > Add New, update watchlist parameters

Get started today!

We encourage you to try out the new Wachlist update UI enhancement to drive efficiency across your data correlation.

Try it out, and let us know what you think!