How to use tagging effectively (Part 3)

by Contributed | Jan 19, 2021 | Technology

This article is contributed. See the original author and article here.

Welcome to the third and final blog post in our series on how to use tagging effectively in Microsoft Defender for Endpoint. We hope you’ve enjoyed this series and look forward to your feedback on this topic and what you’d like to see in the future.

Tagging using the API

Microsoft Defender for Endpoint APIs allow you to do many things through scripting to both query and change elements within your Microsoft Defender for Endpoint instance.  As part of this blog on tagging we wanted cover how you can use scripting to apply tags to machines directly using an API.

Within Advanced Hunting you can create a custom detection that runs the query on a regular basis to generate an alert.  You can also enable response actions as a result of this detection to affect the machines contained in the results:

You will notice however that tagging the resultant machines is not one of the options available.  Instead, it is possible to take the advanced hunting query and use it as an input to the script that applies the tag through the API.

Setting up API access

Before you can use PowerShell to query against the API you need to set up the API application in Azure.

In the Azure Active Directory section of https://portal.azure.com you need to click on new App Registration and create a new app:

Once you have completed this part you will be presented with the following screen:

Take a note of the Application ID and the Directory ID, you will need these for your script.  Then click on “View API permissions”.  It is here that you define how the API can be accessed.

1. Select “Add a permission”


2. Click “APIs my organization uses”


3. Type “Windows” into the search box and then select the “WindowsDefenderATP” API

When accessing the API, it is possible to use either user permissions or application permissions.  Using application permissions means that it doesn’t matter who is logged in to run the script and instead utilises the client secret to authenticate against the application.

For the purposes of what we are enabling we need specific permissions set.  We are running an Advance Hunting query so we need the “AdvanceQuery.Read.All” permission and we are also applying a tag to the machine so we need the “Machine.ReadWrite.All”

If you are using this scripting method for other actions, i.e. isolating a machine, then you would need to apply the appropriate permissions.

The final stage of the application registration is to create the client secret that will be used for authenticating.

In the app properties, click onto “Certificates & secrets” and create a new secret:

Then take note of the client secret that is created as you will need this alongside your Application ID and Directory ID for your script:

Now that you have your application created you can use PowerShell scripting to query against it and then write a tag back on the devices in the results.

Using an Advanced Hunting query for your tagging criteria

Advanced Hunting in Microsoft Defender for Endpoint is a powerful query tool that allows you to create complex queries based upon the telemetry that is gathered from the managed endpoints.  When writing these queries, it is possible to enable them as a custom detection, meaning they run at a regular interval and can apply actions against any device presented in the results.  However, there are only certain actions that can be applied against these devices and tagging isn’t one of them:

Therefore, if you want to tag a device based upon a query then you need to utilise the API.  Let’s say for example if you want to tag all devices in a certain subnet, the first step is to create the Advanced Hunting script:

DeviceNetworkInfo

| mvexpand parse_json(IPAddresses)

//| Subnet=IPAddresses.SubnetPrefix

| where IPAddresses contains “192.168.254” and IPAddresses.SubnetPrefix contains “24”

| summarize by DeviceId

| project DeviceId

Obviously, you can use pretty much any Advanced Hunting query in this test file, but it does need to return DeviceID in the results in order for it to be used in the next step.

Run the script first in the portal just to verify it is finding the correct data for you then copy the query into a text file to use as input to your API script.

The script below takes the query text file and then applies a tag of “DataCenter” against the DeviceIDs that are found by the query:

#Script to take a file containing an Advanced Hunting query and then apply a tag to the DeviceID shown in the results

#Replace ‘XXXXXXXXXXXXXXXXXXXX’ with the appropriate IDs relevant to your tenant/application (quotes required)

$tenantId = ‘ XXXXXXXXXXXXXXXXXXXX’

$appId = ‘XXXXXXXXXXXXXXXXXXXX’

$appSecret = ‘ XXXXXXXXXXXXXXXXXXXX’

$resourceAppIdUri = ‘https://api.securitycenter.windows.com‘

$oAuthUri = “https://login.windows.net/$TenantId/oauth2/token“

$body = [Ordered] @{

    resource = “$resourceAppIdUri”

    client_id = “$appId”

    client_secret = “$appSecret”

    grant_type = ‘client_credentials’

}

$response = Invoke-RestMethod -Method Post -Uri $oAuthUri -Body $body -ErrorAction Stop

$aadToken = $response.access_token

$query = [IO.File]::ReadAllText(“c:tempQuery3.txt”); # Replace with the path to your file

$url = “https://api.securitycenter.windows.com/api/advancedqueries/run“

$headers = @{

    ‘Content-Type’ = ‘application/json’

    Accept = ‘application/json’

    Authorization = “Bearer $aadToken”

}

$body2 = ConvertTo-Json -InputObject @{ ‘Query’ = $query }

$webResponse = Invoke-WebRequest -Method Post -Uri $url -Headers $headers -Body $body2 -ErrorAction Stop

$response2 =  $webResponse | ConvertFrom-Json

$results = $response2.Results

$machine = $results.DeviceId

#Take the results from the query and parse through them to apply a tag to each DeviceID

Foreach ($machine in $machine)

{

#Comment sleep statement out if only planning to modify a small number of devices

Start-Sleep -Seconds 3

$url = “https://api.securitycenter.windows.com/api/machines/” +$machine+ “/tags”

$headers = @{

    ‘Content-Type’ = ‘application/json’

    Accept = ‘application/json’

    Authorization = “Bearer $aadToken”

}

$tag= @{

  ‘Value’ = ‘Datacenter’

  ‘Action’ = ‘Add’

}

#Output

$body3 = ConvertTo-Json -InputObject $tag

$webResponse = Invoke-WebRequest -Method Post -Uri $url -Headers $headers -Body $body3 -ErrorAction Stop

}

We have used the “add” action in this script, but you could just as easily delete tags through this method as well (assuming they haven’t been set via the registry). Simply replace ‘Add’ with ‘Remove’.

The other thing to watch out for is API limits. Due to resource constraints, we limit the amount of API calls that can be made to 100 per minute and 1500 per hour.  To avoid this, a sleep value has been applied to the script to put a pause in after each API call. Obviously, this can be removed to speed things up if the number of machines you are modifying does not hit this limit.

I have talked to you in this part of the blog about how to use scripting against the API, but there is also a great article by Tomer Brand talking about how to achieve this using Microsoft Flow (or Power Automate as it is now), where the same concepts can also be applied to Logic Apps.

We hope you’ve gotten value from this blog series on how to use tags effectively in Microsoft Defender for Endpoint. Make sure to check out Part 1 and Part 2 in the series. We welcome your feedback and questions and look forward to hearing from you.

Steve Newby (@steve_newby) and Miriam Wiesner (@miriamxyra)

Program Managers @ Microsoft Defender for Endpoint Product Group

(Credit also to Thorsten Henking for some of the API scripting input)

All you need to know about automatic email forwarding in Exchange Online

by Contributed | Jan 19, 2021 | Technology

This article is contributed. See the original author and article here.

We realize that many customers have genuine business requirements to configure automatic email forwarding. On the other hand, email forwarding may lead to data leakage. For example, if we have a compromised account, the attacker might create a forwarding rule for a particular mailbox, and the user might be unaware that their mail is being forwarded. This is a very common tactic used when accounts are compromised.

It is therefore important for administrators to know all mailboxes that have forwarding enabled and where the mail is been forwarded to. We have various insights and alerts that help administrators monitor such activities, but prevention is always better than the cure. In this blog post, we thought to revisit (and update) various auto forward controls, how they work together and how they can help you achieve a requirement of allowing automatic forwarding for users who really need this feature.

Various ways to set up forwarding

Before discussing how to control automatic forwarding, let’s review a few different ways in which automatic forwarding can be setup:

• A forwarding rule can be setup within the Rules wizard in Outlook on the desktop. User can set this Automatic forwarding from Outlook > File > Manage Rules and Alerts. Using Outlook on the web, this can be done using Inbox rules.


• Using Outlook on the web (OWA) the user can also set the ForwardingSmtpAddress parameter on the mailbox. This option is available via Settings > Mail > Forwarding.


• Users can also set auto forward using Power Automate (used to be called Microsoft Flow).


• Administrators can configure forwarding from the properties of the mailbox from Exchange Admin Center. This option is available under “Manage Mail flow settings” in classic EAC, or user properties in the preview version of EAC. Configuring automatic forwarding from the properties of the mailbox will populate the ForwardingAddress parameter on the mailbox.


• Administrators can also configure forwarding from Microsoft 365 Admin Center. Configuring forwarding from Microsoft 365 Admin Center will set the ForwardingSmtpAddress parameter on the mailbox (but will show if ForwardingAddress is populated).

Controlling automatic forwarding

Administrators have several methods to prevent and regulate automatic forwarding of emails outside the organization:

External email forward control using Outbound spam filter policy

Recently released, this feature is available in Security & Compliance portal under Outbound spam filter policy (to get the exact portal page, go here). As you see in the following screenshot, there are three possible options. The default configuration is “Automatic system-controlled.” Other options are Off and On. “Off” means auto forward is disabled and “On” means auto forward is enabled.

Note: If you see the option is set as “Automatic system-controlled”, most probably you have not configured the setting at all. For tenants where the setting is left at “Automatic system-controlled”, as we continue to move the service toward being more secure by default, this setting will be enforced and behave as “Off” (forwarding disabled). This enforcement process has started in phases and very soon, all tenants will get this setting enforced. Therefore, “Automatic system-controlled” will behave as “Off” and automatic forwarding will not work. Our recommendation is that all customers should configure the policy as appropriate for their organization and enable external auto forwarding only for the users who really need it (by leaving the default policy in disabled state, creating a different policy that allows forwarding and then assigning it to specific mailboxes only). If for your tenant, “Automatic system-controlled” still does not block email forwarding, you should make this change as soon as possible (as soon, it will).

Advantages of this method:

• It blocks all types of auto forwarding including ForwardingAddress and ForwardingSmtpAddress mailbox parameters.


• Blocks redirect rules configured using Outlook.


• A NDR is sent back to the mailbox that configured auto forwarding to external user if the policy is set to block automatic forwarding for that mailbox. The NDR will contain the following diagnostic information:

Remote Server returned ‘550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7550)’

• Easier to configure and administrators can selectively allow/block external auto forwarding for a few or all mailboxes.

Disadvantages of this method:

• Forwarding using Power Automate (Flow) is not covered as of now. To block external forwarding which is setup using Power Automate, follow the steps mentioned in our Email exfiltration controls for connectors article.

Block automatic forwarding using Remote Domains

This option is available under the Mail flow tab in the new Exchange Admin Center preview:

Advantages of this method:

• This setting can block auto forward rules configured using Outlook inbox rules as well as Outlook on the web options (ForwardingSmtpAddress parameter)

Disadvantages of this method:

• Does not block forwarding set from the properties of the mailbox by the administrator using EAC (ForwardingAddress parameter)


• This blocks auto forward to the specific remote domain. There is no granular control – cannot allow forwarding for certain users, and block for others.


• The user is not notified that their auto forwarded message is dropped, no rejection (NDR) is sent.

Block auto forward using a transport rule

You can create a transport rule from Exchange Admin Center > Mail Flow > Rules to block automatic forward:

Advantages of this method:

• Allows granular control on conditions and actions.


• Admins have the option to send rejection message (NDR).

Disadvantages of this method:

• Matches auto forward messages based on message class (IPM.note.forward). The Outlook web app forwarding (ForwardingSmtpAddress) or forwarding set by the admins on the properties of the mailbox (ForwardingAddress) have normal message class (IPM.Note), so transport rules won’t block them.


• Difficult to manage at times when too many transport rules are configured.

Hiding auto forward options using Role Based Access Control (RBAC) RBAC

While this is not really a method of blocking forwarding, it is related in a way that it can help remove forwarding options from users if they are using Outlook on the web.

Advantages of this method:

• In OWA, users simply do not see the option to setup forwarding in their mail options

Disadvantages of this method:

• Does not remove the option in Outlook desktop.


• Any forwarding that was already configured will continue to work.

Overview

If you want to quickly compare various methods, you can refer to the following table:

What happens if auto forward is controlled in multiple places mentioned above?

One question we encounter frequently is, how all these techniques work together? What if auto forward is blocked in one of the above methods but allowed in another? For example, auto forward is blocked by a remote domain setting or a transport rule but allowed in Outbound spam filter policy; what happens? The answer to that is that a restriction in one place will restrict auto forward for all.

For example:

• Automatic forwarding is On (allowed) in the Outbound spam filter policy.


• Automatic forwarding is disabled for the remote domain.

Will the automatically forwarded message be blocked by the remote domain? Yes, remote domain would block automatic forward as would an Exchange transport rule.

Depending on what you want to achieve, you can use combination of above features. There’s no one size fits all option. You can implement all four options if you really want, depending on your requirement. For example, the remote domain option controls the recipient domain and comes handy if you want to restrict auto forwarding for all except a few external domains. Outbound spam filter policies on the other hand can control the sender. If you want to allow external auto forwarding for only a few mailboxes (users with genuine business requirements to configure automatic forwarding) and block external auto forwarding for everyone else, Outbound spam filter policy is most preferred. Or you can use combination of these two options if you want to allow auto forwarding only for few mailboxes and to only a few external domains. Here is another example which is slightly more complex:

Let’s say you have the following requirements:

• By default, automatic forwarding should be blocked.


• Automatic forwarding to an external domain contoso.com should be allowed for all users.


• Allow users Jack and Jill to also be able to forward to northwindtraders.com, but no one else.

There are multiple methods to achieve this, the following is one such solution:

• Keep the new external forwarding control under Outbound spam filter policy setting to “On”.


• Disable automatic forward for default * domain in remote domain setting.


• Create a new remote domain for contoso.com and northwindtraders.com and allow automatic forward for these remote domains.


• Create a transport rule to block auto forward from all to northwindtraders.com but put an exception for users Jack and Jill.


• As transport rule will not block forwarding set using Outlook on the web (ForwardingSMTPAddress parameter) you can use RBAC rule to stop users from creating auto forward setting from OWA.

But wait, there is more!

To protect you further from attackers if a user mailbox is compromised (and for whom external automatic forward could be enabled without their knowledge), a new Email Forward Alert Policy has been released recently which is available under Alert Policies of our Security & Compliance portal. It is called “Suspicious Email Forwarding Activity.” This new alert will track all “forwarding scenarios” and detects when a user has automated the sending of messages external to the organization​. Once we find any suspicious activity, we will alert the tenant administrator once per day as long as the user continues to forward to that external recipient​. This policy has a Medium severity setting. Although it is rare, an alert generated by this policy may be an anomaly. Administrators should always check to confirm whether the user account is compromised. A screenshot of the policy:

A sample alert sent to the administrator:

That’s it for now! Hope you find this helpful. I also want to take a moment to thank Mike Brown, Nino Bilic for reviewing this.

Arindam Thokder

“Making risk less risky” ? – The Intrazone podcast

by Contributed | Jan 19, 2021 | Technology

This article is contributed. See the original author and article here.

“When you store your data in the Microsoft Cloud, achieving compliance becomes a shared responsibility between you and Microsoft.” [tweet]
― Martina Grom, co-founder of atwork and Microsoft MVP/RD.

What risks await without a compliance plan in place, or the tools to implement it, or the trust of partners, vendors, and employees? In one word: many. You can make risk less risky for your organization. By managing the who and what of data access, with awareness and adherence to policy, you forge a path with fewer risky business outcomes.

In this episode, Chris and I talk with Martina Grom (Co-founder, atwork and Microsoft MVP/RD) and Christophe Fiessinger (Principal program manager, Microsoft) about the role compliance plays in regards to information and communication governance. We dig into compliance strategy, technology like Microsoft 365 Compliance Manager, DLP, sharing, and more – with a nice dose of proven tips and tricks from two subject matter experts who know how to navigate the risky waters of security, governance, and keeping your information safe.

By tuning in, may you move your compliance score up many, many points.

Listen to podcast below at your own (minimized) risk:

https://html5-player.libsyn.com/embed/episode/id/17520329/height/90/theme/custom/thumbnail/yes/direction/backward/render-playlist/no/custom-color/247bc1/

Subscribe to The Intrazone podcast! And listen to episode 60 now + show links and more below.

Intrazone guests and co-hosts – clockwise, starting on the left: Christophe Fiessinger (principal program manager | Microsoft) [guest], Chris McNulty (director | Microsoft) [co-host], Martina Grom (co-founder atwork and Microsoft MVP/RD [guest], and little Mark Kashman (senior product manager | Microsoft) [co-host].

Links to important on-demand recordings and articles mentioned in this episode:  

• Hosts and guests
  
  
  
  • Martina Grom | Twitter | LinkedIn | atwork.at | blog.atwork.at | delegate365.com | governancetoolkit365.com [guest]
  
  
  • Christophe Fiessinger | Twitter | LinkedIn | [guest]
  
  
  • Mark Kashman |@mkashman [co-host]
  
  
  • Chris McNulty |@cmcnulty2000 [co-host] 
  
  
  
  


• Articles and sites
  
  
  
  • Microsoft Compliance Manager + compliance score [documentation]
  
  
  • Visit your Microsoft 365 compliance center: https://compliance.microsoft.com
  
  
  • Microsoft Docs – The home for Microsoft documentation for end users, developers, and IT professionals. 
  
  
  • Microsoft Tech Community Home
  
  
  • Stay on top of Office 365 changes
  
  
  • Listen to other Microsoft podcasts
  
  
  
  


• Events
  
  
  
  • Microsoft 365 Friday California (Jan.22.2021) | SharePoint Saturdays
  
  
  • Microsoft Ignite (Mar.2-4.2021)
  
  
  • Collab365 GlobalCon5 (Mar.16-17.2021)| Twitter
  
  
  • SharePoint Fest Virtual Workshops (ongoing)
  
  
  • CollabDays events (ongoing)
  
  
  
  

Subscribe today!

Listen to the show! If you like what you hear, we’d love for you to Subscribe, Rate and Review it on iTunes or wherever you get your podcasts.

Be sure to visit our show page to hear all the episodes, access the show notes, and get bonus content. And stay connected to the SharePoint community blog where we’ll share more information per episode, guest insights, and take any questions from our listeners and SharePoint users (TheIntrazone@microsoft.com). We, too, welcome your ideas for future episodes topics and segments. Keep the discussion going in comments below; we’re hear to listen and grow.

Subscribe to The Intrazone podcast! And listen to episode 60 now.

Thanks for listening!

The SharePoint teams want you to unleash your magic, creativity, and productivity – and be compliant about it all. And we will do this, together, one compliance score point at a time.

The Intrazone links

• Show page


• Apple Podcasts


• Google Play Music


• Spotify


• Pandora


• Stitcher


• Overcast


• TuneIn


• RadioPublic


• iHeart


• RSS

+ Listen to other Microsoft podcasts at aka.ms/microsoft/podcasts.

Left to right [The Intrazone co-hosts]: Chris McNulty, director (SharePoint, #ProjectCortex – Microsoft) and Mark Kashman, senior product manager (SharePoint – Microsoft).

The Intrazone, a show about the Microsoft 365 intelligent intranet (https://aka.ms/TheIntrazone)

Azure Marketplace new offers – Volume 108

by Contributed | Jan 19, 2021 | Technology

This article is contributed. See the original author and article here.

7 tips for safe online meetings and collaboration with Microsoft Teams

by Contributed | Jan 19, 2021 | Technology

This article is contributed. See the original author and article here.

Remote and hybrid work has become the new norm for many employees across the globe as day-to-day collaboration continues to be accomplished virtually. With this shift to online communication, how can you ensure that you’re collaborating safely?

Queue Microsoft Teams! Whether you’re hosting virtual meetings, carrying out daily group and 1:1 chat, sharing documents, or coauthoring in a document in real-time – Teams enables safe and secure collaboration!

Tip 1: Control who can join your Microsoft Teams meetings directly and present

Meeting organizers can change participant settings for a specific meeting through the Meeting options web page. In Teams, go to your Calendar, select a meeting, and then select Meeting options. From here you can determine settings like who needs to be admitted to the meeting and who can bypass the lobby to join it directly. Additionally, you can decide which participants are able to join with the presenter role to present out content and who should join as standard attendees. Another helpful control for large meetings is the ability to prevent attendees from unmuting themselves – this is particularly useful when the meeting will be led by specific participants while the rest of the audience will be listening in. Note that your organization controls the default participant settings.

Tip 2: Minimize Teams meeting disruptions by muting individual or all meeting attendees

In order to prevent meeting disruptions, intentional or accidental, as a meeting organizer you have the ability to mute individual attendees or all meeting attendees. If an attendee happens to leave their microphone unmuted while being away, you can easily mute that participant from the participant pane. During large meetings led by designated speakers, such as a town hall or lecture, the ability to mute all attendees ensures your presenters won’t be accidentally interrupted.

Tip 3: Determine who can present content or share their screen in your Teams meeting

As the meeting organizer, you can determine who has the ability to present out content or share their screen within the meeting. Prior to the meeting start, we discussed above how this can be accomplished via Meeting options. Once your meeting has begun, you can select a participant via the participant pane to determine whether they have the presenter role or are a standard attendee. This can be especially useful when you have outside participants attending your meeting who may only need the presenter role temporarily.

Tip 4: End your Teams meeting for everyone in attendance at once

As the meeting organizer, sometimes the meeting needs to end at your discretion without allowing participants to remain. Ending a meeting for all attendees is often applicable in large-meeting settings such as a town hall, lecture, or webinar class to ensure attendees don’t remain in the meeting. Once a meeting has wrapped up, instead of clicking Leave, select the dropdown located next to it and click End Meeting. You can also access this by going into your meeting controls, click more options (…) , and select End Meeting. This will end and close the meeting for everyone in attendance.

Tip 5: Create a team with increased security

If any of the content stored or discussed within the team may be considered business sensitive, such as financial details or classified project information, it’s best practice to apply increased protections to that team to ensure the content security. This can be accomplished by creating a new team and applying an IT-created sensitivity label. When applying a sensitivity label to your team, it automatically applies the configured protections to the team.

When creating a new team, on the sensitivity and privacy pane select the dropdown under Sensitivity to select an IT-created sensitivity label to apply to the team. As a reminder, it’s always best to check with your organization or IT department on how sensitive business information should be stored.

Tip 6: Create a private channel

Sometimes you need to share sensitive information within a team to specified team members only, such as project details or strategic planning, that doesn’t require holistic team protection. Rather than creating a new team, you can create a private channel within an existing team that is only accessible to designated members. This is a great way to provide a security layer to protect sensitive business information without creating a new team.

To create a private channel, go to the team and choose more options (…) and select Add channel. After providing a name and description, under Privacy select the dropdown arrow to specify the channel is Private – Accessible only to a specific group of people within the team. Once created, you can add additional private channel owners and up to 250 members. As a reminder, it’s always best to check with your organization or IT department on how sensitive business information should be stored.

Tip 7: Help protect sensitive data in Teams
Microsoft Teams supports data protection policies to help protect sensitive information from being accidentally or inadvertently shared. When collaborating in a Teams 1:1 or channel chat, you may have a message return as blocked if that message contains information that meets your organization’s sensitive information policy.

If your message is blocked, within that blocked message you may see a clickable link that says What can I do? If you click that link, a helpfully policy tip created by your organization will display educating you on why content within that message is considered business sensitive. Policy tips are designed to help the sender understand why certain content is considered business sensitive or is best practice not to share.

We hope that these safe online collaboration tips will help you remain productive while having the confidence you’re remaining secure.

2020 The Year of Sustainability Part Two

by Contributed | Jan 19, 2021 | Technology

This article is contributed. See the original author and article here.

As I stand here typing in my very poorly insulated, frigid, dilapidated shack of a garage (affectionately dubbed my “Papaya Boathouse”) in my puffy jacket, surrounded by 10 bicycles and a whitewater kayak among other things (a frequent talking point on the stream of video calls that make up my days), it’s almost laughable how normal it now seems, versus how foreign this scene was a year ago. So much has changed in ways we never could have imagined; our perspectives have been thrown out of whack – which has also presented opportunities.  

The year 2020 was bonkers in many ways, but it was also a huge turning point in Microsoft becoming the worldwide frontrunner in ambitious environmental efforts, as well as being just the beginning, with a lot more that needs to be done, quickly. When I look back on 2020 (and it still feels like a really long March), a few main themes emerge for me around the environmental sustainability landscape.

​​​​​​​

1. Leveling the playing field

Many Microsoft employees joined the Worldwide Sustainability Community in a search for more information, resources, and a community that could be a connection point. The WWSC doubled its membership in 2020 to nearly 4,000 people, and the number of regional chapters in our community also doubled to 26 and counting. 

However, members of the WWSC outside of the central “hubs” of activity (primarily Redmond, but strong chapter locations around the world) have expressed feelings of inequity at being unable to join in person for events and initiatives. With our new virtual world format, everyone, everywhere has a level playing field, and the opportunity to participate equally in the movement. This goes for people outside of the WWSC and outside of Microsoft, as well. With all the hilarity that often ensues with video conferencing in our remote world, there’s also a lot to gain from the equitable involvement opportunities now afforded to all.

2. ​​​​​​​​​​​Rebuilding right

In one of my favorite books, “No Impact Man: The Adventures of a Guilty Liberal Who Attempts to Save the Planet, and the Discoveries He Makes About Himself and Our Way of Life in the Process,” a major theme is about taking away everything, to be able to bring back just what’s important to us. “Eliminating the colossal waste from our lives, responsible for so much of the damage we do to our planetary habitat, does not entail depriving ourselves but just changing some no-longer-functional habits. After all, who would suggest that a world without plastic bags is to be deprived? Who could possibly argue that using plastic bags makes us happier?” This can be applied to what’s happening now; starting by taking away, so we can rebuild with what matters – what’s actually important without all the stuff we thought we needed – and with the corresponding reduction in resource use and degradation.

No Impact man was later made into a documentary

3. Bring on the new administration

With president-elect Joe Biden calling climate change the “number one issue facing humanity,” things are looking a lot more hopeful for the United States rejoining the game for global cooperation and leadership on environmental issues. Mr. Biden’s Plan for Climate Change and Environmental Justice includes making US electricity production carbon-free by 2035 and having the country achieve net-zero emissions by the middle of the century. There are already efforts of cooperation across parties to point to, that have flown under the radar. In September, Democrats and Republicans cooperated on a bill to cut the use of hydrofluorocarbons (HFCs), a family of gases commonly used as refrigerants, which includes some of the most powerful greenhouse gases known to science. The same month, the Senate passed a bill called the Bipartisan Wildlife Conservation Act intended to improve species conservation and protect vital ecosystems.

4. The plant-based revolution

The science is clear that the meat and dairy industry is the single greatest factor in deforestation, water pollution, and a top contributor to climate change, putting us into the Earth’s sixth mass extinction. The conversion of land for beef production and animal feed is a leading cause of deforestation in many tropical regions, including in the Amazon. One of the US’s, and much of the world’s, most serious and persistent threats to clean drinking water is pollution from factory farm runoff. And there is endless evidence that the meat industry is one of the leading causes of climate change. If cattle were their own nation, they would be the world’s third-largest emitter of greenhouse gases. 

Project Drawdown identifies plant-rich diets as their #4 top solution to reaching the point of drawing down carbon from our atmosphere. This is to speak nothing of the ethical travesties of inflicting these traumas on billions of sentient beings, including the workers, and the consistent evidence of the health concerns, with higher risks for heart disease, cancer, diabetes, and premature death (if you have not seen the movie Gamechangers, you have to watch it next!). 

Plant-based diets have both environmental and health benefits

While getting all our nutrition from plants is, for most people, not actually challenging, it’s certainly not what is convenient, cheap, accessible, and – most importantly – accepted as normal in many parts of the world, and especially in the United States. Until 2020! 2020 has seen a massive rise in plant-based products served in fast food chains, making it just as convenient to choose the planet-and moral-friendly option as the destructive one. See this massive list of chains serving the stuff! And in Singapore, cultured meat has been approved for consumers for the first time!! This is huge! So, while eating fluffy animal cadavers still abounds, this 2020 momentum has got me giddy, and I’m so excited to watch its progression.

2020 The Year of Sustainability

by Contributed | Jan 19, 2021 | Technology

This article is contributed. See the original author and article here.

It is fair to say that 2020 has been disruptive, and nowhere is that more evident than in the acceleration of the climate crisis. 2020 was another year for the record books: the Artic is now 12 degrees F warmer on average than it was in 1990, an area the size of Connecticut was lost to historic wildfires in California alone, and global biodiversity is in freefall as the next mass extinction quickens. The list goes on and on but for all the bad news, there was some good too: 2020 saw Microsoft step forward with several bold new commitments, promising to leverage its vast resources to create solutions and drive sustainable change across the entire economy and we felt this acutely in the Worldwide Sustainability Community (WWSC) as new members and new questions flooded in.Wildfires raging in California

As I look back at 2020, I see it as the year sustainability was finally elevated to its rightful place as an essential part of Microsoft’s corporate strategy and slowly but surely, its very culture.

On January 9, 2020, I walked up to the microphone at the company’s first all-team meeting of the year and asked our CEO Satya Nadella, “How will you make sustainability a core cultural value at Microsoft? How will you make sustainability the next accessibility?” He essentially replied, “Stay tuned – we’re gonna have a lot more to say about this soon.”

Satya was foreshadowing January 15th, a mere 6 days later, when Microsoft unveiled its game-changing carbon negative announcement. I was sitting in the front row in Building 99 that day, wondering what was about to happen. I watched as Satya, Amy, Brad, and Lucas took the stage to tell the world, “Those of us who can afford to move faster and go further should do so,” and that Microsoft would lead the way by leveraging its resources to make sustainable change happen faster, in line with the best available science. 

Watching President and Chief Legal Officer Brad Smith give a master class in carbon scope calculations was a sure sign things were different. As Vox, put it, “Climate change has moved out of the public relations department, into the C-suite, and down to the shop floor.” It was a turning point not only for Microsoft but for the overall debate on what role the private sector could play in addressing the climate crisis, where so many governments had failed to act.

At Microsoft, this moment represented something even more important: the awakening of our company’s ecological consciousness. This was a moment many of us in the WWSC had been working towards for years. 

WWSC Earth DayThe carbon announcement was just the beginning and was quickly followed by three more sustainability commitments throughout the year: ecosystems in April (just in time for the 50^th anniversary of Earth Day, the birth of the modern environmental movement!), waste in August, and water in October. The sum of these announcements was that Microsoft would become a carbon negative, zero waste, water positive company that protected more land than it used for all of its operations by 2030. Sustainability would now be an indispensable part of Microsoft’s future; the company was proudly taking a leadership role and would create scalable tech solutions others could use too.

The sleeping giant had finally woken. The number of customer requests asking how Microsoft could help them be more sustainable went from a slow trickle to a raging torrent in the blink of an eye. 

In many ways, this represents a new beginning: the hardest work lies ahead, and the window of time to do it is rapidly closing. At the current rate, our global civilization will spend its remaining carbon budget in 7 short years, by 2027, representing how many more greenhouse gases we can emit into the atmosphere before we pass a tipping point likely to be a civilization ender. To put this in perspective: while Microsoft promises to be carbon negative by 2030 (pulling more carbon out of the atmosphere than it emits annually), the target date is three years after we’ve exhausted the planetary budget. 

Global carbon emissions are still rising despite commitments made by most countries at the Paris Agreement in 2015

Microsoft’s total carbon emissions (16 million metric tons in 2019) represent .04% of the global annual total (40 billion metric tons). Even with the best of intentions, Microsoft is too small in the scheme of things to move the needle on our own. This is why such a big part of Microsoft’s strategy here is to empower customers, partners, and even competitors (we’re all Earthlings, after all) with new solutions themselves to create a wave of sustainable change across the entire economy.

Despite the grim reality that most things are moving in the wrong direction and we are running out of time, there are encouraging signs of progress. I can see interest sparking in other companies, companies that are looking to us for answers and for help. I see this progress happening every day from the conversations happening in our Worldwide Sustainability Community, watching as employees educate each other and point each other to answers to questions that weren’t even being asked six months ago. ​​​​​​​

2020 was, without a doubt, the year of sustainability at Microsoft. It’s fair to say that 2021 will be an important year for translating our corporate commitments into actionable change, something all employees have an important role to play in and precisely why we founded the WWSC. 

We are now 10% of the way into our 2030 journey – the next 90% will need to be about education, innovation, and most importantly, action in rapid succession. It will need to happen at hyper-scale: any solutions we develop need to be highly scalable to address truly planetary sized challenges within the timeframe. I believe the fastest way to make this happen is culture change at Microsoft, the first wave of which has begun, initiated both from the bottom-up grassroots and now, the top-down leadership. Where we meet in the middle is where we get the most inertia. 

In 2021, we will need to take action to translate Microsoft’s commitments into real change – and we need your help. The Worldwide Sustainability Community was founded on the belief that everyone has something meaningful to contribute and you don’t need sustainability in your job title to drive change in this space. This reinforces that it is incumbent on all of us to apply our growth mindset and be constant learners when it comes to sustainability. We must grow our knowledge in this area so that we can take full advantage of the opportunity that lies before us. Only then will we understand how to leverage the vast resources of a trillion-dollar technology company to help solve the world’s most pressing environmental challenges.

Microsoft 365 PnP Weekly – Episode 110

by Contributed | Jan 19, 2021 | Technology

This article is contributed. See the original author and article here.

In this installment of the weekly discussion revolving around the latest news and topics on Microsoft 365, hosts – Vesa Juvonen (Microsoft) | @vesajuvonen, Waldek Mastykarz (Microsoft) | @waldekm, are joined by Erwin van Hunen (Valo Intranet) | @erwinvanhunen – MVP, Father of PnP PowerShell, and Lead Architect at Valo Intranet in Sweden.

How do you end up owning a PnP open source project?  Start by making and sharing something that makes your own life easier.  In Erwin’s case, create a little PowerShell module in 2014.   Now, 60 Million PowerShell Cmdlets are executed each day.  Subsequent discussion focuses on who, why, where, how to use PnP PowerShell.  PnP PowerShell can be used for Microsoft Teams and Planner in addition to SharePoint.  Covered off on connectivity, authentication, supportability, roadmap, and on how PnP PowerShell and Microsoft Graph PowerShell are complementary.  Future and present – a multi-Platform PnP PowerShell for Windows, Mac, Linux, Raspberry Pi, Azure Functions, Azure Automation.  PnP.PowerShell v1.00 is releasing this week thanks to contributions from many PnP community members.

This episode was recorded on Monday, January 18, 2020.

• Microsoft 365 PnP Weekly – Episode 110

Did we miss your article? Please use #PnPWeekly hashtag in the Twitter for letting us know the content which you have created. 

As always, if you need help on an issue, want to share a discovery, or just want to say: “Job well done”, please reach out to Vesa, to Waldek or to your Microsoft 365 PnP Community.

Sharing is caring!