Microsoft 365 Defender now delivers unified experiences across endpoint, email and collaboration

by Contributed | Mar 2, 2021 | Technology

This article is contributed. See the original author and article here.

Today we are announcing the public preview of the integration of our endpoint and email and collaboration capabilities into Microsoft 365 Defender. Security teams can now manage all endpoint, email and cross product investigations, configuration, and remediation within a single unified portal.  Now is the time to start using this new unified experience in preview and as we move to general availability of the unified experience the previously distinct portals will be phased out.

We are also announcing new and enhanced features only available in the Microsoft 365 Defender portal to help you respond faster such as new unified investigation pages for alerts and specifically email, as well as a brand-new Learning hub surfacing best practice and instructional resources to help you leverage the platform.

Getting familiar with Microsoft 365 Defender and the unified portal

For Microsoft Defender for Endpoint users, existing capabilities are now available within Microsoft 365 Defender. To get started, navigate to security.microsoft.com. You will find everything you are used to in the navigation bar on the left, under “Home” or under Endpoints. Learn what’s changed in our in-depth documentation. 

Figure 1: Endpoint features integrated into Microsoft 365 Defender.  

For Microsoft Defender for Office 365 users, the Threat Management capabilities and email security-related reports are now available in Microsoft 365 Defender under Email & collaboration in the navigation bar. To get started, go to security.microsoft.com. Learn what’s changed in our in-depth documentation. 

Figure 2: Email and collaboration features integrated into Microsoft 365 Defender. 

If you have integrations and connections with SIEM solutions such as Azure Sentinel, these will continue to work and no changes are required. When you are ready to move all of your users to the new experience you can enable automatic URL redirection for Microsoft Defender for Endpoint and automatic URL redirection for Microsoft Defender for Office 365. If you have built custom detections or use device-related queries in Microsoft Defender for Endpoint, follow the links to learn how to migrate them. Compliance-related Office 365 features are available in the Microsoft 365 compliance center.  

There are lots of exciting new areas to explore:

• Unified alerts queue. See prioritized alerts from across your Microsoft 365 security products in a single, unified alerts queue.


• Unified user page. Visualize any user entity in a single dashboard. This new page allows security professionals to investigate every asset related to the user and imports critical information from all your deployed Microsoft 365 security products.


• Unified investigation page. This view provides details for automatic investigation and response including triggering alerts, impacted assets and deep-dive details across your Endpoint and Office 365 environments.


• Learning hub. Leverage official guidance from resources such as the Microsoft security blog, the Microsoft security community on YouTube, and the official documentation at docs.microsoft.com. These resources, articles, videos and how-to guides give you best practices and instructions on how to take advantage of the features in Microsoft 365 Defender.


• Email entity page. A frequent request from customers has been better email investigation capabilities. Now you have a 360-degree view of an email alert integrated with context and related data from across the Microsoft 365 environment. This includes enhancements such as junk mailbox rules, spam confidence levels and authentication and detonation details. 


• Integrated alert detail page. A comprehensive point of view for a specific alert including the alert story, timeline, alert classification, impacted entities, related incidents and more. 


• Role-based access in Microsoft 365 Defender. Microsoft 365 Defender now recognizes RBAC configurations and custom roles from the individual Microsoft 365 solutions and holistically enforces them at the cross-product level. Check out the documentation for more details.


• Threat analytics. Leverage detailed threat intelligence reports from Microsoft security experts to understand the most critical real world threats and actors. Related alerts and incidents in a customer environment are escalated for remediation and recommendations are provided to remediate any vulnerabilities and exposures. Learn more.

We’re excited to hear your feedback as you explore the unified portal and we will continue to update the documentation throughout the preview.  Our mission is to empower you with the most unified extended detection and response (XDR) solution in the industry so that you can focus on what’s important: preventing and remediating threats. 

To read more about the unified portal experience, check out: 

• Overview – Microsoft 365 security center 


• Microsoft Defender for Endpoint in the Microsoft 365 security center 


• Microsoft Defender for Office 365 in the Microsoft 365 security center 

Microsoft 365 PnP Weekly – Episode 116

by Contributed | Mar 2, 2021 | Technology

This article is contributed. See the original author and article here.

In this installment of the weekly discussion revolving around the latest news and topics on Microsoft 365, hosts – Vesa Juvonen (Microsoft) | @vesajuvonen, Waldek Mastykarz (Microsoft) | @waldekm are joined by Porto, Portugal-based MVP, João Mendes – Senior Office 365 Solution/Architect Developer, Storm Technology Ltd | @joaojmendes.     

The episode’s discussion focuses on being familiar with your tools in order to create beautiful apps, the need for a Fluent tutorial, and top features that could be added to SPFx one day and on João’s story-filled career.

The session was recorded on Monday, March 1, 2021.

• Microsoft 365 PnP Weekly – Episode 116

Did we miss your article? Please use #PnPWeekly hashtag in the Twitter for letting us know the content which you have created. 

As always, if you need help on an issue, want to share a discovery, or just want to say: “Job well done”, please reach out to Vesa, to Waldek or to your Microsoft 365 PnP Community.

Sharing is caring!

Azure Blueprints vs Azure Resource Manager template specs

by Contributed | Mar 2, 2021 | Technology

This article is contributed. See the original author and article here.

Hello folks,

I’ve had a few conversations lately with IT pros and operations folks that made me think that there may be a disconnect or some confusion about the role of Azure blueprints and ARM templates specs.

There were comments like “are blueprint still even a thing?” and “I’m not bothering with Blueprints since templates specs are almost here.”

Maybe I’m missing the meaning of these interactions. Or there is a disconnect. I’m not 100% sure, however, if there is a chance that someone in the community is confused, I decided to cover the difference and when you would them. We’re not going to take you through the creation of each of these since there are many tutorials and resources available online already.
For example:

• Azure Friday: An overview of Azure Blueprints


• Build a cloud governance strategy on Azure


• Managing Blueprints as Code


• Deep dive into Implementing governance at scale through Azure Policy – BRK3085

The same can be said for ARM Templates Specs

• Azure Resource Manager template specs (Preview)


• ARM Template Specs deep dive


• Tutorial: Create a template spec with linked templates (Preview)

So, let’s start.

What Is Azure Blueprints?

In any enterprise you always have teams that are responsible for defining what and how resources are deployed in your environment. (on-prem, in the cloud or in both).  Your networking team defines the network design, the IP addressing, the routing…  Your security team defines what services are allowed, who has access… Your legal department may have requirements for compliance such as where you can deploy your resources…  You get the picture.

Without any tools to allow you to tie all these requirements together you end up with a deployment process that can take a long time because every teams wants and needs to sign-off on your deployment.  And it makes it difficult to replicate since in most cases its tied together with custom scripting.

Azure Blueprint allows you to create a way to package all these components together and makes it super easy to “stamp” your blueprint on any environment dev, test, prod or other.

There are samples available here

What is Azure Resource Manager (ARM) Templates Specs?

One of the greatest problems when managing your infrastructure as code (IaC) with Azure templates is marrying the need for manageable, secure, versions-controlled way while sharing templates.  You can use GitHub, or any other “repo”, however if you’re deploying linked templates for example the link requires either a publicly accessible point or a shared access signature to a blob therefore making them secure is more problematic.

Template Specs is a new resource type for storing ARM templates in a resource group.  The purpose of doing that is to allow more efficient sharing, deployment, and control of the Templates shared within an organization.  In effect your templates become a first party resource type stored in your subscription.  They can be standalone or modular, thus providing you with a very flexible way to deploy them.

And yes, Templates Specs also includes an RBAC (Role based access control) but it’s to control who has access to the template itself and what I can do with it (Read access, vs contributor access for example). Not RBAC in terms of controlling what is the access of the resource deployed by said template.

Conclusion

Now that we’ve covered what both Blueprints and Templates Specs are, we understand that:

• Yes, Azure Blueprints are still a thing and you should be investigating them in your own environment if you’re not already, to ensure all your deployments conform to all the requirements of your organization.


• Azure Resource Manager Template Specs will NOT displace the need for Blueprints since they server a completely separate purpose.

I can even see in the future, Azure Blueprint pointing at Templates Specs as artifacts within a blueprint.

There you have it folks.  Let me know in the comments below if you’d like us to cover specific subjects.

Cheers.

Pierre

Customer Offerings:Device Protection w/ Microsoft Endpoint Manager & Microsoft Defender for Endpoint

by Contributed | Mar 2, 2021 | Technology

This article is contributed. See the original author and article here.

Introduction 

Welcome to another customer offering article to inform you about how to configure, setup, and deploy endpoint protection policies which include protective measures from Microsoft. In this article, we will present Premier Services Offerings WorkshopPLUS – Device Protection with Microsoft Endpoint Manager and Microsoft Defender for Endpoint.

Offering Overview 

With customers needing a deployment solution to push out Microsoft security policies and configurations, this offering will address this and more. This Premier offering builds on the fundamental security components and features of any Microsoft Endpoint Configuration Manager environment such as RBAC or role-based administration, Endpoint Protection​, Exploit Guard, Application Guard, Microsoft Defender for Endpoint, BitLocker Drive Encryption, and Compliance Settings. With this new customer offering, we were able to provide a 3-day hands on training in a live demo tenant to meet and exceed customer expectations. 

What the workshop entails

What’s Included 

The content of this offering is a mix of education, administration, compliance, and security best practices at the L200-L300 level. This offering focuses on the breadth of Microsoft Endpoint Configuration Manager, Microsoft Defender for Endpoint, M365 Security (on-prem and in the cloud), and also Intune. The Device Protection with Microsoft Endpoint Manager and Microsoft Defender for Endpoint workshop is a three day engagement where you will learn about configuring a tenant using  labs hosted in the cloud (Microsoft Labs on Demand) with a full M365 E5 license (EMS E5 + M365 E5 + Office 365 E5). Each module contains scenarios that provide students with in-depth expertise, tools, and hands-on experience to help implement and troubleshoot security related concepts as they pertain to Microsoft Endpoint Configuration  Manager. 

Endpoint Protection policies

Areas Covered 

The sections  below sections are covered in detail throughout the three-day offering and expand on each objective to maximize your understanding of each topic and focus area through knowledge transfer modules. 

Introduction to Endpoint Security​ – Overall introduction to security settings and recommendations that can be managed using Microsoft Endpoint Configuration Manager and Intune.

Role Based Access Control – Overview of Role Based Administration Control concept in Microsoft Endpoint Configuration Manager, including the reporting feature.

Endpoint Protection Technologies Overview – Objectives focus on a deeper dive into the technologies that make up Endpoint Protection.

Antimalware Policies – Objectives focus on learning the basic concepts and terminology for Endpoint Protection Antimalware Policies for Microsoft Defender Antivirus.

CAMP and Security Intelligence Updates – Objectives focus on managing Endpoint Protection Definition updates through Configuration Manager. 

Endpoint Protection Alerts and Reporting – Objectives focus on how to configure and use alerts and report notifications within Configuration Manager. 

Endpoint Protection Troubleshooting – Objectives focus on learning troubleshooting techniques for securing endpoints.   

Exploit Guard and Application Guard – Objectives focus on learning about Attack Surface Reduction, Controlled Folder Access, and Exploit and Network Protection. You will also learn how to mitigate security threats using containers by deploying Application Guard.  

Microsoft Defender for Endpoint – Objectives focus on learning how to onboard endpoints to Microsoft Defender for Endpoint using Microsoft Endpoint Configuration Manager and explore basic operational possibilities within Microsoft Defender for Endpoint portal.  

Device Encryption – Learn what is BitLocker and explore modern management possibilities to control device encryption with Microsoft Endpoint Configuration Manager and Intune.  

Compliance settings – Dive deeper into the compliance settings topic, including management possibilities using Microsoft Endpoint Manager (Intune).  

Hands on with Labs on Demand

During this offering there are multiple hands-on labs exercises using Microsoft’s Labs on Demand. Each student will be an administrator of their own demo tenant where they will create and deploy security policies using Microsoft Endpoint Configuration Manager. Once the polices are deployed to another machine, the student will be able to view and test out those policies. The areas are listed below are covered in the lab exercises: 

• Endpoint Security


• Implementing RBAC 


• Endpoint Protection policies


• CAMP and Security Intelligence updates 


• Endpoint protection alerts and reporting 


• Endpoint protection troubleshooting 


• Exploit Guard and Application Guard 


• Microsoft Defender for Endpoint


• Device Encryption 


• Compliance settings 

Creating the configuration file for Endpoints for MDE

Configuring Attack Surface Reduction Rules

Configuring Bitlocker drive encryption in MEM

Objectives

After completing this course, you will understand how to set up, configure, and manage Microsoft Endpoint Configuration Manager Role Based Access​, Endpoint Protection for Microsoft Endpoint Manager, Application Guard and Exploit Guard integration​, Microsoft Defender for Endpoint​, BitLocker Drive Encryption, and compliance settings.

Key Personnel For this Offering 

This course is targeted at IT staff who have already started designing and implementing Microsoft Endpoint Configuration Manager integration with Microsoft Security products and concepts. To ensure that students are successful at the end of this WorkshopPLUS, it is highly recommended they meet the following criteria:​

• Existing knowledge of Microsoft Endpoint Configuration Manager ​


• Moderate knowledge of Windows Platform and Microsoft Security products​


• Basic knowledge of Microsoft Endpoint Manager (Intune)​

Disclaimer 

As of this writing, the above modules are in scope. However, they might change as Microsoft Endpoint Configuration Manager, Intune, Microsoft Defender for Endpoint, and M365 Security are subject to change. 

Follow up and feedback

For further information, please contact your Microsoft Account Representative, Customer Success Account Manager (CSAM), or Service Delivery Manager (SDM).

To improve this or any other workshop, we always consider feedback from you. At Microsoft, achieving a high level of satisfaction among our customers and partners around the world is a core component of our business. For that reason, please don’t hesitate to complete the surveys and provide feedback.

Credit 

Special thanks and credit to the development team:

Anton Tatarkin, Senior Customer Engineer, Intune / EMS / Configuration Manager, Netherlands

John Barbare, Senior Customer Engineer – Cybersecurity, Monitoring Solutions (Sentinel, M365 Defender, MDE, MDI, MCAS), Unites States

Charles Baldridge, Customer Engineer, Configuration Manager, United States