Microsoft Authenticator app lock now enabled by default

Microsoft Authenticator app lock now enabled by default

This article is contributed. See the original author and article here.

Howdy folks,

 

We’re always listening to your feedback about Microsoft Authenticator and what we can do to make the app more secure and easier for end users. A few years ago, we released our App Lock feature in response to feedback that you wanted to make sure your app was secured by a PIN or biometric. Last month, we expanded App Lock’s protection. Now, if App Lock is enabled, when you approve any notification, you’ll also have to provide your PIN or biometric.

 

With our latest release, as part of our effort to make your sign-in experience even more secure, App Lock will be enabled by default if you’ve set up a PIN or biometric on your device.

 

authapp1.png

 

Try it out

If you don’t have the Microsoft Authenticator app yet, get it here. You’ll need to be on version 6.4.22+ on iOS to try this out.

 

We’ve been rolling out this feature to iOS TestFlight starting today, and we’ll be gradually rolling out to all users over the next few weeks. The update will come to Android next month.

 

How different notifications will work

Azure AD and MSA MFA notifications

Currently, when the notification arrives on the phone, you can click approve/deny from the lock screen. However, when app lock is enabled, you will have to launch the app (on iOS) or launch a dialog (on Android) before you can click approve/deny, and you’ll also need to provide an additional PIN/bio gesture to successfully authenticate. Thus, even if you leave your phone unlocked on your desk and walk away, a passerby cannot approve the notification for you.

 

authapp2.png

 

Enterprise on-premise MFA notifications that already require a PIN

 

The flow will remain as it is today. After you interact with the notification, you will need to provide your MFA pin (not your device pin). In subsequent approvals, you will have the option to use your device bio gesture instead of your MFA pin.

 

Azure AD and MSA Phone sign-in notifications

 

The flow will remain as it is today.

 

Additional questions

If you have questions, check out our FAQ page.

Also, we want to hear from you! Feel free to leave comments down below or reach out to us on Twitter (@AzureAD)

 

Best regards,

Alex Simons (@Alex_A_Simons)

Corporate VP of Program Management

Microsoft Identity Division

 

Learn more about Microsoft identity:

Announcing General Availability of Unified Labeling in GCC and GCC-H Environments

Announcing General Availability of Unified Labeling in GCC and GCC-H Environments

This article is contributed. See the original author and article here.

 

Unified labeling in Microsoft 365 provides organizations an integrated and consistent approach to creating, configuring, and applying policies to protect information worker data across all locations. The introduction of centralized label management allows IT professionals to administer all these capabilities in one place and not have to configure them across solutions, clouds, and premises. Workloads that can leverage unified labeling such as Azure Information Protection Unified Labeling client and scanner, Office 365 apps, Office for web, SharePoint, OneDrive, MCAS and many more can apply these policies in a consistent manner. Unified labeling was exclusively available for commercial cloud tenants.

 

Unified labeling is now generally available (GA) for Government community cloud (GCC/GCC-H) environments. This release brings data discovery, classification, and protection capabilities to government Microsoft 365 instances.  

 

GCC and GCC-H customers are now able to migrate sensitivity labels and label policies in the Azure Information Protection blade to the new label management portal, Office 365 Security and Compliance Center. Migration of labels is only valid for moving from one label management portal (Azure) to another (Office 365 Security and Compliance Center) within the same tenant. Migration in this case does not include moving labels and labels policies from one tenant (commercial) to another (GCC/GCC-H).

 

Unified labeling is fully aligned with the 100+ sensitive information types that can be found in the Office 365 Security and Compliance center and also supports custom sensitive information types, keyword dictionaries and complex conditions.  

 

At the time of writing this blog, only the Azure Information Protection Unified Labeling client (AIP UL client) and Azure Information Protection Unified Labeling scanner (AIP UL scanner) are available to GCC and GCC-H environments. Other unified labeling workloads such as Office 365 apps, Office for web, SharePoint, OneDrive etc. will be available later.

 

Getting Started

 

New GCC and GCC-H customers: are already enabled for unified labeling; therefore, no action is required.

Existing Azure Information Protection customers: will have to review their business requirements and supported features for unified labeling. Once your requirements are confirmed, administrators will have to activate unified labeling and migrate their label and label policies from the Azure Information Protection Blade in the Azure Portal to the Office 365 Security and Compliance Center, re-create their label condition and deploy a unified supported client.

 

Note: Only Azure Information Protection Unified Labeling client and Azure Information Protection Unified Labeling scanner is only supported for GCC and GCC-H environments at this time.  

 

alsteele_4-1596475684069.png

 

Figure 1: Activate Unified Labeling in the Azure Information Protection blade in the Azure Portal

 

GCC-H Only: Label and Label Policy Migration

 

Existing GCC-H cloud environments require a manual migration of labels and label policies using PowerShell. Commercial and GCC migration methods are not applicable for GCC-H customers. Administrators will have to use the New-Label cmdlet to migrate existing sensitivity labels to the Office 365 Security and Compliance center.

 

Example cmdlet

 

alsteele_5-1596475684077.png

 

Figure 2: Label ID in the Azure Information Protection blade for sensitivity label “Highly Confidential”

 

alsteele_6-1596475684080.png

Figure 3: Protection template ID in the Azure Information Protection blade for sensitivity label “Highly Confidential”

 

New-Label -Name ‘Highly Confidential’ -Tooltip ‘Highly confidential sensitive information’ -Comment ‘Highly confidential sensitive information’ -DisplayName ‘Highly Confidential’ -Identity ‘e554622f-b485-412a-9c99-aa08c5856df8′ -EncryptionEnabled $true -EncryptionProtectionType ‘template’ -EncryptionTemplateId ‘0d9619a-2b0b-41f3-a478-50c8e8ac66eb’ -EncryptionAipTemplateScopes “[‘allcompany@labelaction.onmicrosoft.com’,’admin@labelaction.onmicrosoft.com’]”

 

Azure Information Protection Unified Labeling Client and Scanner

 

Once you enable unified labeling in your organization, you can deploy or upgrade to the new AIP UL client and scanner for Windows to receive unified labeling policies and labels. Upgrading to the AIP UL client has minimal impact as the user interface is practically identical except for the change in the ribbon name from “Protect” to “Sensitivity”. The AIP UL client and AIP UL scanner are at feature parity with commercial cloud releases.

 

AIP requires a special configuration for sovereign clouds. Administrators will have to deploy a new registry key to their Windows machines for the AIP UL clients to point to the right sovereign cloud.  

 

alsteele_0-1596477181135.png

Figure 4: Registry settings for Azure Information Protection UL clients

 

Sunsetting Label Management in the Azure Portal and AIP Client (classic)

 

We have a plan to sunset label management in Azure portal and AIP client (classic) for Government cloud customers.  Meanwhile, Government cloud customers who own licenses for AIP will receive continued support for the classic client for 12 months after the general availability of unified labeling for Government cloud. Government cloud customers who may need features that are not yet in the latest release of the unified labeling client can ask for additional extended support for the classic client here before Sept 30 2020. Note: AIP UL scanner management will still be available on AIP portal and will not be deprecated.

 

Additional Information

 

The latest client version with these new capabilities can be found here. For more detailed information, see the version release information.

 

 

 

 

End users can now report “This wasn’t me” for unusual sign-in activity

End users can now report “This wasn’t me” for unusual sign-in activity

This article is contributed. See the original author and article here.

Howdy folks,

I’m excited to announce the General Availability of Azure AD My Sign-Ins—a new feature that allows enterprise users to review their sign-in history to check for any unusual activity. As we discussed in the Public Preview blog post, the My Sign-Ins page empowers users to see:

  • If anyone is trying to guess their password.
  • If an attacker successfully signed in to their account from a strange location.
  • What apps the attacker accessed.

The newest addition to this page allows end users to report “This wasn’t me” or “This was me” on unusual activities. Robyn Hicock, who managed this feature, wrote a guest blog post where she dives into the details on this update. You’ll find her blog post below.

 

As always, we’d love to hear any feedback or suggestions you may have. Please let us know what you think in the comments below or on the Azure AD feedback forum.

 

Best regards,

Alex Simons (@Alex_A_Simons)

Corporate VP of Program Management

Microsoft Identity Division

 

—————————————————–

 

Hi everyone!

 

I’m super excited to share details about the updates we’ve made to the My Sign-Ins page. We heard your feedback during the Public Preview and learned that users want to easily determine whether a sign-in was theirs or not.

 

Unusual activity

We now highlight suspicious activities that we’ve detected with Identity Protection at the top. For example, if a risky sign-in was automatically detected, it would get bubbled up to the top under a new section for “Unusual activity”:

 

SI1.png

 

We also added “This wasn’t me” and “This was me” buttons for unusual activities. If a user chooses “This wasn’t me”, then they would see this dialog:

 

SI2.png

 

They would then be taken to the Security info page to review and update their authentication methods. To learn more about managing security info, check out the blog post for Combined MFA and password reset registration.

 

SI3.png

 

If a user chooses “This was me”, then they would see this dialog:

 

SI4.png

 

The end user feedback will help improve the accuracy of our risk detection systems. We will study the user feedback before allowing user reporting to change the risk states in Identity Protection. You can monitor what your users are choosing by checking the audit logs, and use that information to help you decide whether to confirm or dismiss the risk.

 

Recent activity

If a user doesn’t have any suspicious sign-ins, then they’ll just see the “Recent activity” section. Users can also review their normal sign-ins and report if anything looks strange by clicking “Look unfamiliar? Secure your account”.

 

SI5.png

 

Users can also see if anyone else is trying to guess their password. In that case, they’d see an “Unsuccessful sign-in” like this:

 

SI6.png

 

Searching and Filtering

We also heard your feedback about better filtering to sort through all the noise. Now you can use the Search bar at the top to look at only the “Unsuccessful” sign-ins.

 

SI7.png

 

You can also use the Search bar to filter for other details like the app, browser, location, operating system, etc.

 

Finally, we made My Sign-Ins more mobile-friendly too!

 

SI8.png

 

If you’re curious about your personal email too, we have similar features in the Recent Activity page for consumer Microsoft Accounts at: https://account.live.com/activity – Check it out!

Feedback

As always, we’d love to hear your feedback and suggestions. Please let us know what you think in the comments below or on the Azure AD feedback forum.

 

Thanks!

Robyn Hicock (@Robyn.Hicock)

Senior Program Manager

Microsoft Identity Security and Protection Team

 

Learn more about Microsoft identity:

Azure Marketplace new offers – Volume 81

Azure Marketplace new offers – Volume 81

This article is contributed. See the original author and article here.

We continue to expand the Azure Marketplace ecosystem. For this volume, 111 new offers successfully met the onboarding criteria and went live. See details of the new offers below:

Applications

ALFRED - AI Health Claims Automation.png

ALFRED – AI Health Claims Automation: ALFRED on Microsoft Azure is an automated, end-to-end health and medical claims platform for cashless (planned or emergency) and post-discharge (reimbursement) claims processing with payout in less than 15 minutes.

Amelia.png

Amelia: Amelia is a comprehensive conversational AI agent that listens and interacts with people to solve problems. Able to take on a wide variety of business and engineering tasks, Amelia reads natural language, understands context, applies logic, infers implications, and learns through experience.

Application Access Governance for Dynamics 365.png

Application Access Governance for Dynamics 365: Saviynt’s application access governance solution for Microsoft Dynamics 365 provides segregation of duty (SoD) management and continuous compliance monitoring with intelligent lifecycle management and risk-based access reviews to ensure users have access to the right data at the right time.

AUSIS - AI Underwriting Platform.png

AUSIS – AI Underwriting Platform: Artivatic Data Labs’ AUSIS is an AI-based underwriting automation and instant-decision platform that enables insurance businesses to perform real-time assessment for policyholders for risk, pricing, and policy decisions.

backdrop Powered by Miri.png

Backdrop Powered by Miri: Use Backdrop CMS to create websites ranging from a single administrator’s personal blog to a complex, multi-role e-commerce platform. Backdrop is easily expandable with add-ins, modules, and themes to ensure your website fits your needs.

Bot Foundry in Azure (SaaS).png

Botfoundry in Azure (SaaS): Hosted on Microsoft Azure and powered by Azure Bot Service and Language Understanding (LUIS), Botfoundry enables you to build bots tailored to individual users and global organizations.

CareFlow Vitals - electronic observations system.png

CareFlow Vitals – electronic observations system: CareFlow Vitals is an observation and decision-support system designed to improve patient safety and outcomes. It calculates early warning scores, monitors and analyzes patient vital signs to identify deteriorating conditions, and provides risk scores to trigger escalation pathways.

CARSURE-Auto & Vehicle Damage Assessment & Claims.png

CARSURE – Auto & Vehicle Damage Assessment & Claims: Available on-premises or in the cloud, CARSURE is an AI-based platform for vehicle damage estimation and for assessment and claims automation. It eliminates the need for physical inspection by detecting damage using photos, video, or guided mobile tools.

Cloud PAM for Azure, Azure AD and Microsoft 365.png

Cloud PAM for Azure, Azure AD, and Microsoft 365: Saviynt’s Cloud Privileged Access Management (Cloud PAM) solution provides privileged access to Microsoft Azure consoles and workloads and Azure Active Directory, along with tenant administration for Microsoft 365 applications, Azure services, and more.

Conversational AI for Healthcare.png

Conversational AI for Healthcare: Hyro’s conversational AI for healthcare seamlessly transforms troves of data into conversational interfaces powered by natural language understanding (NLU), simplifying the patient journey across channels such as websites, applications, and call centers.

Conversational Analytics.png

Conversational Analytics: Data Semantics Pvt. Ltd.’s Conversational Analytics platform on Microsoft Azure enables voice assistants and chat messengers to report real-time key performance indicators (KPIs) from business intelligence dashboards, CRM, ERP, and IT service management applications.

Covid_19_Assessment.png

COVID-19_Assessment: By providing a patient-centric care team model, dClinic’s private healthcare blockchain (PHB) and COVID-19 assessment platform help break down the traditional barriers of one-on-one interactions and data silos in healthcare.

Delair ai - Visual Intelligence for Infrastructure.png

Delair.ai – Visual Intelligence for Infrastructure: The delair.ai platform rapidly and repeatedly analyzes imagery of enterprise assets to help improve reliability, manage projects, and lower operating costs. The AI-powered solution enables companies to manage, view, analyze, and collaborate around digital twins of assets.

Delphix Masking for Azure (3TB).png

Delphix Masking for Azure (3TB): Delphix masking for Microsoft Azure enables you to find, mask, and govern up to 3 terabytes of sensitive data to maintain compliance in non-production environments. Secure relational databases, cloud-native data sources, and files for use by development and test teams.

Desk To Go.png

Desk To Go: Accessible via any device, Desk To Go is a virtual desktop solution hosted on Microsoft Azure. Work from anywhere with access to all your files as if you were right in front of your computer. This app is available in Portuguese, Spanish, and English.

DgSecure.png

DgSecure: DgSecure data provisioning monitors access to elements containing raw, sensitive data; provides thorough identity inventory and classification of sensitive data; and delivers back-end automation of data subject requests for privacy standards, such as CCPA and GDPR.

DNS Server (IaaS) for Ubuntu 18.04 LTS.png

DNS Server (IaaS) for Ubuntu 18.04 LTS: Tidal Media offers an Ubuntu 18.04 LTS image configured with DNS Server (IaaS), providing security-, performance-, and operations-related insights into the DNS infrastructure of your organization by collecting, analyzing, and correlating analytic and audit logs and other related data from DNS servers.

Dotclear CMS powered by MIRI.png

Dotclear CMS powered by MIRI: Written in PHP, the Dotclear content management system on Microsoft Azure respects web standards based on open-source solutions with multilingual interface and publishing capabilities.

EcoStruxure for Healthcare.png

EcoStruxure for Healthcare: EcoStruxure for Healthcare is an IoT-based platform designed to help healthcare facilities of all sizes improve operational efficiency and patient safety and satisfaction through modernized infrastructure management.

eDiscoveryPro - Prosecution Innovation Software.png

eDiscoveryPro – Prosecution Innovation Software: Data Vision Group LLC’s eDiscoveryPro is a scalable, highly secure application that complies with the FBI’s Criminal Justice Information Services. eDiscoveryPro enables district attorney’s offices to facilitate the transformation of paper-based workflows to digital processes.

ESPOCRM powered by MIRI.png

EspoCRM powered by MIRI: EspoCRM on Microsoft Azure provides companies and organizations with actionable insights that can help them enhance products and services, build and maintain fruitful relationships with customers, boost revenue, and drive business growth.

ExpectID.png

ExpectID: IDology’s ExpectID enables you to find and approve legitimate identities while also deterring fraud. It completes identity verification with as little as a name and an address, allowing you to quickly validate customer identity to drive revenue and perform appropriate due diligence.

ExponentCMS powered by MIRI.png

ExponentCMS powered by MIRI: Exponent CMS is an open-source content management system written in PHP and designed to help site owners develop and easily manage dynamic websites without having to code web pages or manage site navigation.

Fathym Low-Code Framework.png

Fathym Low-Code Framework: The Fathym Low-Code Framework enables developers to host, manage, and deploy data-driven applications that are tool-, platform-, and cloud-agnostic. It reduces development time by applying best-practice workflows for cloud infrastructure automation and app orchestration.

Firebird SQL RDBMS on Windows Server 2016.png

Firebird SQL RDBMS on Windows Server 2016: Cloud Infrastructure Services offers this image of Firebird, an open-source SQL relational database management system, configured on Windows Server 2016. Firebird offers ANSI-standard SQL features, concurrency, high performance, and powerful language support for stored procedures and triggers.

Firebird SQL RDBMS on Windows Server 2019.png

Firebird SQL RDBMS on Windows Server 2019: Cloud Infrastructure Services offers this image of Firebird, an open-source SQL relational database management system, configured on Windows Server 2019. Firebird offers ANSI-standard SQL features, concurrency, high performance, and powerful language support for stored procedures and triggers.

FreePBX 15 supporting commercial add-on modules.png

FreePBX 15 supporting commercial add-on modules: Build a cloud phone system, a call center, a traditional PBX with desk phones, or a fully software-based experience using WebRTC or softphones with FreePBX on Microsoft Azure. FreePBX includes a strong core-feature set and a large ecosystem of add-on modules.

Frogmi Store Operations.png

Frogmi Store Operations: Frogmi is a task management solution for retail that enables store managers, supervisors, and quality control personnel to perform store audits that automatically trigger tasks to support areas and then track the resolution of those tasks.

FrontAccounting powered by MIRI.png

FrontAccounting powered by MIRI: FrontAccounting on Microsoft Azure is a web-based accounting system for the entire ERP chain written in PHP and using MySQL. It enables users to submit purchase orders, maintain supplier accounts, send payments, and generate financial reports.

Gender Fitness.png

Gender Fitness: Gender Fitness helps raise awareness of the gender balance in your meetings and delivers valuable insight into inclusion and participation. The application links to your organization’s Office 365 calendars and provides a simple two-question survey to attendees for each meeting.

Geolog.png

Geolog: Based on the Epos data management infrastructure, Geolog on Microsoft Azure offers petrophysical and geological analysis tools, well data management, and robust data integration.

GetSimpleCMS powered by MIRI.png

GetSimpleCMS powered by MIRI: Designed for small organizations and individuals who need a small-to-midsize website, GetSimpleCMS makes content management adaptable to users’ needs by creating suitable designs for tablets, desktops, smartphones, and other devices.

Gitea - Git Server for Ubuntu 18.04.png

Gitea – Git Server for Ubuntu 18.04: Gitea is a powerful and easy-to-maintain self-hosted Git service. It supports Git revision control and provides other collaborative features, including bug/issue tracking, development wiki pages, and code review.

Graphnet CareCentric - shared care record.png

Graphnet CareCentric – shared care record: CareCentric integrates detailed information from acute hospitals, mental health and community organizations, general practices, and social care into a single digital care record available to clinicians and care professionals.

Helpdesk.png

Helpdesk: SteadyPoint Solutions’ Helpdesk is an IT service management system for assisting service desks with IT and non-IT trouble tickets. Designed to help small and medium-sized enterprises take their office experience to the next level, Helpdesk makes collaboration simple with the familiar Office 365 look and feel.

Hexator.png

Hexator: Intended for software developers, web coders, and administrators, Hexator is an online tool for hexadecimal encoding and decoding. Hexator encodes and decodes data from binary or text format to hexadecimal via copy and paste or file upload.

I&D PORTAL.png

I&D PORTAL: The I&D Portal platform for the financial sector streamlines business processes to help companies embrace digital transformation and reduce the costs, time, and resources associated with maintaining security control and compliance.

InMobi Telco AdCloud-in-a-box.png

InMobi Telco AdCloud-in-a-box: InMobi offers end-to-end cloud-based ad operations for global telecommunications companies (telcos) and mobile OEMs. Telcos can set up an internally managed ad operation to monetize devices, users, and data, while mobile OEMs can utilize a device monetization suite run by InMobi.

Insignia Gatekeeper.png

Insignia Gatekeeper: Gatekeeper from Insignia Medical Systems automatically copies your picture archiving and communication system (PACS) and radiology information system (RIS) medical images to your Microsoft Azure environment, protecting against local disasters and malicious attacks with secure, write-once Azure storage.

KALE LOGISTICS UPLIFT PORT COMMUNITY SYSTEM.png

KALE LOGISTICS UPLIFT PORT COMMUNITY SYSTEM: Port Community Systems (PCS) from Kale Logistics Solutions enables secure information exchange between public and private stakeholders, improving the efficiency of seaports and airports. PCS optimizes, manages, and automates port processes by connecting transport and logistics chains.

KeePass Password Safe on Windows Server 2016.png

KeePass Password Safe on Windows Server 2016: Cloud Infrastructure Services offers this image configured with the open-source KeePass software. KeePass encrypts passwords and other sensitive information, such as documents, ATM PINs, and credit card numbers, using a master password or key file to secure the KeePass database.

Managed Backup Services.png

Managed Backup Services: Integrity Partners offers a managed service of dedicated backups for Office 365, including Microsoft Exchange Online, OneDrive for Business, SharePoint Online, and Microsoft Teams. Manage and monitor backups via web or mobile.

Mantis powered by MIRI.png

Mantis powered by MIRI: Miri Infotech offers a version of Mantis Bug Tracker, an open-source bug-tracking system, preconfigured for running on Microsoft Azure. Features include tracking issues through a simple web-based interface; custom notifications; project management graphs; and time tracking.

MedDream.png

MedDream: DICOM Viewer by MedDream, a Softneta company, is a vendor-neutral medical image application that can be installed on Azure. The app integrates with patient portals, telemedicine systems, electronic health records, and any picture archiving system (PACS), including MedDream PACS, Orthanc, and more.

MediaWiki - Wikipedia Server on Ubuntu 18.04 LTS.png

MediaWiki – Wikipedia Server on Ubuntu 18.04 LTS: Tidal Media offers an Ubuntu server image configured with MediaWiki, a free and open-source wiki server. MediaWiki is a powerful, scalable software package and a feature-rich wiki implementation that uses PHP to process and display data stored in a database, such as MySQL.

Medium Sentinel Services Scope.png

Medium Sentinel Services Scope: Integrity Partners Sp. z o.o. will deploy Microsoft Azure Sentinel in your environment so you can implement it in your security operations center (SOC). Receive cloud-native SIEM, enhanced security visibility across cloud and on-premises environments, and more.

Microsoft SQL Server Developer for Ubuntu 18-04.png

Microsoft SQL Server 2019 Developer for Ubuntu:18-04: Ntegral’s database container image contains Microsoft SQL Server 2019 Developer Edition on Ubuntu 18.04. It includes all the functionality of Enterprise Edition but is licensed for use as a development and test system, not as a production server.

Microsoft SQL Server Enterprise for Ubuntu18-04.png

Microsoft SQL Server 2019 Enterprise for Ubuntu:18-04: Ntegral’s database container image contains a bring-your-own-license version of Microsoft SQL Server 2019 Enterprise Edition on Ubuntu 18.04. Enterprise Edition is ideal for apps requiring mission-critical in-memory performance, security, and high availability.

Microsoft SQL Server Express for Ubuntu 18-04.png

Microsoft SQL Server 2019 Express for Ubuntu:18-04: Ntegral’s database container image contains Microsoft SQL Server 2019 Express Edition on Ubuntu 18.04. Express Edition is freely downloadable and distributable.

Microsoft SQL Server Standard for Ubuntu 18-04.png

Microsoft SQL Server 2019 Standard for Ubuntu:18-04: Ntegral’s database container image contains a bring-your-own-license version of Microsoft SQL Server 2019 Standard Edition on Ubuntu 18.04. Ntegral packages applications following industry standards and monitors all components and libraries for vulnerabilities and updates.

Minimum Sentinel Services Scope.png

Minimum Sentinel Services Scope: Integrity Partners Sp. z o.o. will perform a minimal deployment of Microsoft Azure Sentinel in your environment, performing remote monitoring and optional threat hunting. Receive cloud-native SIEM, enhanced security visibility across cloud and on-premises environments, and more.

MiO - PoS, Agent Sales & Video Branches.png

MiO – PoS, Agent Sales & Video Branches: MiO from Artivatic Data Labs is an integrated, video-based insurance platform designed to support digital branch applications for insurance policies, brokers, point-of-sale connections to customers, lead generation, and policy distribution.

MistServer Streaming Media Toolkit for Ubuntu.png

MistServer Streaming Media Toolkit for Ubuntu: Tidal Media offers an Ubuntu server image configured with MistServer, an open-source streaming-media toolkit for over-the-top (OTT) internet streaming. MistServer allows you to take any media from any location using any method, and deliver it to anyone, anywhere, in any format.

Mix.png

Mix: Nuance’s Mix is a platform for creating advanced conversational experiences for chatbots and interactive voice response systems. With one tooling platform across the full software development lifecycle, enterprises gain greater control, accelerated development time, and increased business agility.

Nuvepro Cloud Labs.png

Nuvepro Cloud Labs: Cloud Labs from Nuvepro Technologies Pvt. Ltd. is a marketplace and software-as-a-service platform that provides hands-on labs for fast and effective learning. Use the self-service portal to rapidly deploy and access a sandbox environment configured with a technology stack and compute power on a cloud of your choice.

NVIDIA Image for AI - Optimized for PyTorch.png

NVIDIA Image for AI – Optimized for PyTorch: Deploy on Microsoft Azure a virtual machine configured with NVIDIA’s PyTorch distribution, certified for maximum performance on NVIDIA GPUs and easy access to NVIDIA NGC. NGC is a hub for GPU-optimized software for deep learning, machine learning, and high-performance computing.

NVIDIA Image for AI - Optimized for TensorFlow.png

NVIDIA Image for AI – Optimized for TensorFlow: NVIDIA’s GPU-optimized TensorFlow container included in this image will fast-track your end-to-end AI deployment and development process. Supported Azure virtual machine instances are NCv2, NCv3, and ND series.

NVIDIA Image for AI using GPUs.png

NVIDIA Image for AI using GPUs: NVIDIA NGC is a hub for GPU-optimized software for deep learning, machine learning, and high-performance computing. Containers from NGC require this image, and the supported Microsoft Azure virtual machine instances are the NCv2, NCv3, and ND series.

October CMS powered by MIRI.png

October CMS powered by MIRI: This offer from Miri Infotech contains a hardened image of October CMS, a content management system designed to make website creation, design, and editing faster and more intuitive. October CMS is based on the PHP programming language and the Laravel web application framework.

Omeka powered by MIRI.png

Omeka powered by MIRI: This offer from Miri Infotech contains a hardened image of Omeka, an open-source content management system for cultural institutions such as libraries and museums. Omeka is written in PHP and uses the Zend web application framework.

Opensource Social Network (OSSN) on Ubuntu 18.04.png

Opensource Social Network (OSSN) on Ubuntu 18.04: This ready-to-run software offered by Tidal Media allows you to create a social networking website. The quick-deployment image will launch Open Source Social Network (OSSN) on Ubuntu 18.04.

pivotx Powered by Miri.png

pivotx Powered by Miri: This virtual machine offered by Miri Infotech contains PivotX CMS, open-source software used for maintaining blogs, online journals, and other frequently updated websites. PivotX CMS is written in PHP and uses MySQL or flat files as a database.

Python escaper.png

Python escaper: PythonEscaper by Glueo is an online tool for software developers and administrators who need to update a string in Python code and want to avoid the tedious work of doing it manually. PythonEscaper supports escaping and unescaping string literals.

Quick Decisions, SAP Business One en Power BI.png

Quick Decisions, SAP Business One in Power BI: Streamline your SAP Business One decision-making with Innovación Orientada al Cliente’s pre-built dashboards in Microsoft Power BI. Dashboard categories cover sales, sales details, purchases, inventory, and accounts receivable. This offer is available only in Spanish.

RiskCenter360.png

RiskCenter360: RiskCenter360 from Evertec enhances risk-management and fraud-prevention strategies with intuitive analytical tools, robust rules, and an analyst-friendly environment console for addressing alerts. This app is available in Spanish, Portuguese, and English.

RiskMaster Creatio.png

RiskMaster Creatio: RiskMaster Creatio makes risk-registration and risk-management processes easy and transparent. It can be used to manage a particular risk type, such as customer complaints, or a group of risks, such as operational risks. English and Russian software interfaces are available.

Seenic AI Platform.png

Seenic AI Platform: Seenic AI, a proprietary visual AI platform from Everseen, blends AI and computer vision to aid retail stores. Seenic AI scans data and video of processes performed by humans, creates a digital blueprint of those processes, and shapes them for better outcomes.

Seequent Central.png

Seequent Central: Seequent Central, a geoscience model management solution, helps geologists and geophysicists visualize, track, integrate, and manage data from a centralized environment hosted on Microsoft Azure.

SentryOne SQL Sentry.png

SentryOne SQL Sentry: SQL Sentry from SentryOne is a scalable solution for database performance monitoring and for migrating and optimizing Microsoft SQL Server workloads on Microsoft Azure. SQL Sentry includes an intuitive environmental health dashboard, flexible alerting, and more.

SepiaCMS.png

SepiaCMS: SepiaCMS by Sepia Solutions serves as a multi-site marketing platform with multilingual support and integrated modules for portal management. Customers can design with drag-and-drop tools and manage an unlimited number of domains in one place.

Serendipity Powered by Miri.png

Serendipity Powered by Miri: This virtual machine offered by Miri Infotech contains Serendipity, a PHP-powered blog engine. Although the default package is designed for the casual blogger, Serendipity offers an expandable framework and can be used with professional applications.

Servian VisualCortex.png

Servian VisualCortex: With its intuitive self-serve interface and AI toolbox, VisualCortex from Servian harvests data from your cameras or video archive to provide insights on safety and security. Configure VisualCortex over your CCTV arrays or any combination of cloud or edge-compute setups.

Skolsynk for Microsoft.png

Skolsynk for Microsoft: Skolsynk for Microsoft is a collaboration between several Swedish teaching aid suppliers. It syncs schools, students, teachers, and groups from Microsoft 365 with teaching material providers. This app is available only in Swedish.

SLM Cost Take-Out.png

SLM Cost Take-Out: SoftwareONE’s SLM Cost Take-Out aims to save your organization money by focusing on increasing operational effectiveness through analyzing software consumption.

Solar Hand Sanitizer Simple.png

Solar Hand Sanitizer Simple: SIMPLE is a solar hand sanitizer for disinfection in public places. Its weather resistance makes it suitable for outdoor conditions as well as indoor spaces. Each dispenser can be powered by a photovoltaic panel and is fully autonomous.

Solteq DataShovel.png Solteq DataShovel: Solteq Oyj’s DataShovel is a next-generation data warehouse automation tool. DataShovel creates a visual model of the data warehouse, making customers’ workflows more agile and efficient.
Subrion CMS powered by MIRI.png

Subrion CMS powered by MIRI: This ready-to-launch virtual machine offered by Miri Infotech contains Subrion CMS, an open-source content management system based on PHP and MySQL. Subrion CMS is used to build websites and is suitable for small projects as well as high-load portals.

Temperature Detector API, Thermoquaesitor.png

Temperature Detector API, Thermoquaesitor: Thermoquaesitor, a cross-browser REST API for apps that use thermal imaging, detects the temperatures of people’s faces based on photos. For one photo, the API may return multiple predictions with different probability scores of detected temperatures.

Think ChatBot with Autotask.png

Think ChatBot with Autotask: Think ChatBot from Think AI Consulting Corporation can engage with customers and reduce email volume at your business. Customers can get their ticket status and schedule assignments with the Autotask platform.

Thycotic Secret Server Privileged Access Mgmt.png

Thycotic Secret Server Privileged Access Mgmt.: Thycotic’s flagship privileged access management (PAM) and least-privilege endpoint security offerings are hosted on Microsoft Azure and include Secret Server Cloud, Privilege Manager, and Account Lifecycle Manager.

Tiki Wiki- Content Managenet Groupware.png

Tiki Wiki: Content Management Groupware: This offer from Miri Infotech contains a pre-configured one-click deployment of Tiki Wiki CMS, a free and open-source Wiki-based content management system.

Verisium.png Verisium: Verisium is a marketing IoT platform that connects retail brands with customers through products, regardless of sales channels and geography, by embedding NFC chips and QR codes into products.
Webmin - Easy GUI SysAdmin Server for Ubuntu.png

Webmin – Easy GUI SysAdmin Server for Ubuntu: This ready-to-run Ubuntu image from Tidal Media contains Webmin, a web-based interface for Unix system administration. Webmin removes the need to manually edit Unix configuration files and lets you manage a system remotely or from the console.

Webmin - Easy GUI SysAdmin Server on LINUX Centos.png

Webmin – Easy GUI SysAdmin Server on LINUX Centos: This offer from Tidal Media contains Webmin on the CentOS Linux platform. Webmin is a web-based interface for Unix system administration. Using any modern web browser, you can set up user accounts, Apache, DNS, file sharing, and more.

Consulting services

Azure Data Analytics Foundation- 4-Wk PoC.png

Azure Data Analytics Foundation: 4-Wk PoC: In this proof of concept, Data-Driven AI will conduct discovery workshops with stakeholders and deliver a modern data platform on Microsoft Azure that’s ready for advanced analytics, machine learning, and big data transformations.

Azure Data Analytics Optimization 5-Day Assessment.png

Azure Data Analytics Optimization 5-Day Assessment: Let Enimbos help you optimize data collected from your Microsoft Azure infrastructure. Enimbos bases its approach on four areas: ingestion and data preparation, data management and quality, machine learning and AI, and data visualization and reporting.

Azure Kubernetes Service- 2- Week Workshop.png

Azure Kubernetes Service: 2- Week Workshop: In this workshop, Applied Cloud Systems will teach the fundamentals of Docker and Kubernetes and enable capabilities for deploying, scaling, and updating applications on Microsoft Azure Kubernetes Service.

Azure Machine Learning- 2-Week Proof of Concept.png

Azure Machine Learning: 2-Week Proof of Concept: In this proof of concept, Softcrylic will work with your team to scope and implement a predictive analytics business use case using your data in a private and secure Microsoft Azure virtual network. The outcome will be operational machine learning models that meet your expectations.

Azure Sentinel Workshop and Deployment (Free).png Azure Sentinel Workshop & Deployment (Free): In this free engagement, Hydra Security will help your organization get started with Microsoft Azure Sentinel and security analytics by deploying and configuring an Azure Sentinel instance and integrating up to three supported log sources.
Azure Virtual WAN plus Fortinet- 2 weeks assessment.png

Azure Virtual WAN + Fortinet: 2 weeks assessment: Microsoft Azure Virtual WAN can provide low-latency secure routing and help your business reduce costs and complexity. In this offer, ANS Group Limited will deliver Azure Virtual WAN along with Fortinet SD-WAN capability.

CAF Ready Transformation- 10-Week Implementation.png

CAF Ready Transformation: 10-Week Implementation: Contino will provide the customer with a self-service, Microsoft Cloud Adoption Framework-aligned Microsoft Azure landing zone. Contino will upskill the customer’s engineering employees so they can take over at the conclusion of the engagement.

Cloud and DC Transformation Advisory 1 Hour Briefing.png

Cloud & DC Transformation Advisory 1 Hour Briefing: Insight Direct (UK) Limited will provide an overview of its services and how you can benefit from them. These include discovery workshops, a hybrid cloud assessment, and proof-of-concept and migration services. This offer is available in Swedish.

Comprehensive Azure Review 1 Week Assessment.png

Comprehensive Azure Review 1 Week Assessment: IFI Techsolutions will analyze your Microsoft Azure environment, evaluate your resources, and help you adopt best practices to ensure that you get the most value out of your cloud investment.

Comprehensive Azure Review 2 Week Implementation.png

Comprehensive Azure Review 2 Week Implementation: Consultants from IFI Techsolutions will conduct a 360-degree review of your Microsoft Azure environment, analyzing it for cost savings, resource optimization, end-to-end security, and high availability so you can get the best value out of your Azure investment.

Data Estate Modernisation- 10 weeks implementation.png

Data Estate Modernization: 10 weeks implementation: In this engagement, Nordcloud’s experts will define a data operating model and implement an initial data platform for ingesting, managing, and analyzing data on Microsoft Azure.

Development Project- Marketing, Sales, and Service.png Development Project: Marketing, Sales, and Service: Iterbi Consulting provides companies with a marketing, sales, and service digital transformation strategy tailored to their needs. It offers seamless personalized communication with clients to influence their decision-making and drive quicker transactions.
Digital Connectivity Check- 2 Week Assessment.png

Digital Connectivity Check: 2 Week Assessment: Before you can reap the benefits of the cloud, you need to know whether your network can handle the traffic. A solution architect from ANS Group Limited will conduct an assessment and detail any required changes to your network architecture.

ExpressRoute and connectivity- 2 week Assessment.png

ExpressRoute & connectivity: 2 week Assessment: In this assessment, an ANS Group Limited solutions architect will help you validate your current network and determine what changes are required for you to be able to deliver Microsoft Azure ExpressRoute connectivity.

GreenPages Cloud Xcelerator Program.png GreenPages Cloud Xcelerator Program: GreenPages’ Cloud Xcelerator Program is a series of three workshops paired with a reference architecture implementation that includes a cloud opportunity assessment, a cloud readiness assessment, and a minimum viable cloud proof of concept that leverages the Cloud Xcelerator Platform.
HPE Accelerator Workshop for Cloud - SAP, 2 Days.png

HPE Accelerator Workshop for Cloud – SAP, 2 Days: Hewlett Packard Enterprise’s workshop will define a strategy and a timeline for your SAP-to-Azure migration. Topics will include economic modeling, SAP consolidation priorities, and key SAP operating requirements for Microsoft Azure.

Implementation Project.png Implementation Project: Iterbi Consulting provides a marketing, sales, and service digital transformation tailored to your needs. Learn how to deliver a personalized, omnichannel customer experience while driving successful digital transformation in your organization.
ISV-SaaS Consulting Offer - 1 Week Workshop.png

ISV/SaaS Consulting Offer – 1 Week Workshop: Whether you want to migrate and modernize an app in the cloud or transfer workloads between clouds, LANcom Technology’s DevOps team will review your product and provide recommendations using industry best practices.

ISV-SaaS Consulting Offer - Free 4 hour Assessment.png

ISV/SaaS Consulting Offer – Free 4 hour Assessment: Book a call with LANcom Technology in this free four-hour assessment. LANcom Technology’s DevOps team will carry out an initial assessment of your software and empower you with a high-level overview on the benefits of migrating your development to the cloud.

Managed Services & Enablement.png Managed Services & Enablement: Iterbi Consulting’s managed services and marketing, sales, and service enablement provide mass content production to achieve your goals. Outsourcing with Iterbi enables your team to focus on essential tasks to hit performance targets. This offering is available in English and Russian.
Modern App With Kubernetes 1 Week Proof Of Concept.png

Modern App with Kubernetes 1 Week Proof Of Concept: In this proof of concept, IFI Techsolutions consultants and architects will work closely with you to modernize, monitor, and scale your application using Microsoft Azure Kubernetes Services.

Nordcloud - Data Enablement- 3 days workshop.png

Nordcloud – Data Enablement: 3 days workshop: Nordcloud’s workshop will allow business and technical stakeholders to understand the opportunity of building a data platform on Microsoft Azure. Nordcloud will define an operating model and select initial use cases for the implementation.

Nordcloud's CAF - 3 Days Workshop.png

Nordcloud’s CAF – 3 Days Workshop: In this workshop, Nordcloud will define an operating model to enable secure, agile, and cost-efficient use of Microsoft Azure across your organization. Nordcloud’s workshop is aligned with the Microsoft Cloud Adoption Framework roadmap.

Public Sector ExpressRoute- 2 Weeks Assessment.png

Public Sector ExpressRoute: 2 Weeks Assessment: ANS Group Limited will deliver Microsoft Azure ExpressRoute along with Fortinet SD-WAN capability so organizations can attain secure connectivity to the cloud while having access to public-sector networks such as PSN and HSCN.

SAP on Azure Assessment - 6 week.png

SAP on Azure Assessment – 6 week: Fast-track your journey to SAP S/4HANA on Microsoft Azure with this assessment from Fujitsu. The assessment will provide you with application and architecture recommendations, a migration plan, a business case, and more.

Windows Virtual Desktop- 3 Week Implementation.png

Windows Virtual Desktop: 3 Week Implementation: In this engagement, Applied Cloud Systems will establish a pilot implementation of Windows Virtual Desktop for up to 50 users in preparation for production deployment. This engagement will allow for a work-from-home experience similar to being in the office.

Take your communications to the next level with new offerings in Microsoft Teams

Take your communications to the next level with new offerings in Microsoft Teams

This article is contributed. See the original author and article here.

In recent months, the shift to remote and hybrid work has catalyzed organizations of all sizes, and across every industry, to rethink how their people and teams communicate and collaborate.

The post Take your communications to the next level with new offerings in Microsoft Teams appeared first on Microsoft 365 Blog.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Microsoft Defender ATP Daily Operation – Part 1

Microsoft Defender ATP Daily Operation – Part 1

This article is contributed. See the original author and article here.

 

Hello IT Pros,

I have combined the information for Security Team who monitor, respond and manage ATP Portal on a daily basis. Please check it out and give your feedback.

===================

ALERT MANAGEMENT

The Alert response could be done as follows:

 

Change Status of Alert (by your IT Security Team Member)

Alert Status

AlertActionManage AlertStatus

 

New

In Progress

Resolved

Alert Classification

AlertActionManage AlertClassification

true/false

       

tantran55_1-1596459568602.png

 

ALERT SUPPRESSION RULE

Defender ATP lets you create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization.

  • Suppression rules can be created from an existing alert. They can be disabled and reenabled if needed.
  • The rule will not affect existing alerts already in the queue, prior to the rule creation.
  • The rule will only be applied on alerts that satisfy the conditions set after the rule is created.

You can choose to suppress alerts on this machine or suppress alert in entire organization

        

tantran55_2-1596459568605.png

 

tantran55_3-1596459568611.png

 

tantran55_4-1596459568624.png

 

Detection Rule

(Customized Detection Rule by running Query)

Action applied to threat detection once it is discovered

·         With the query in the query editor, select Create detection rule and specify Detection name, Frequency — interval for running the query 1-24hrs, Alert title — title displayed with alerts triggered by the rule, Severity level, Category,Description, Recommended actions —enter your comment on  additional actions that responders might take in response to an alert

·         Save

Suppression Rule

 

You can create an alert suppression condition   based on : File SHA1, File name – wildcard supported, Folder path – wildcard supported, IP address, URL – wildcard supported, Command line – wildcard supported

·         Select the Trigerring IOC (Indicator of Compromise)

·         Specify the action and scope on the alert

 

Indicator of compromise (IoCs)

Indicator of compromise (IoCs) is used for detection and for blocking

You could create IoC based on file hash, External IP address, URL

 

All ATP documents are at : https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection

 

Create indicators for files

You can prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file (.exe and .dll file), you can block it. This operation will prevent it from being read, written, or executed on machines in your organization.

 

There are two ways you can create indicators for files:

  • By creating an indicator through the settings page
  • By creating a contextual indicator using the add indicator button from the file details page

Prerequisite:

  • The Defender Antimalware client version must be 4.18.1901.x or later.
  • Windows 10, version 1703 or later.

 Important

  • The allow or block function cannot be done on files if the file’s classification exists on the device’s cache prior to the allow or block action
  • Trusted signed files will be treated differently. Microsoft Defender ATP is optimized to handle malicious files. Trying to block trusted signed files, in some cases, may have performance implications.

 

Create an indicator for files from the settings page

  1. In the navigation pane, select Settings > Indicators.
  2. Select the File hash tab.
  3. Select Add indicator.
  4. Specify the following details:
    • Indicator – Specify the entity details and define the expiration of the indicator.
    • Action – Specify the action to be taken and provide a description.
    • Scope – Define the scope of the machine group.
  5. Review the details in the Summary tab, then click Save.

 

Create a contextual indicator from the file details page

One of the options when taking response actions on a file is adding an indicator for the file.

 

Create indicators for IPs and URLs/domains (preview)

Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs, through Windows Defender SmartScreen for Microsoft browsers, and through Network Protection for non-Microsoft browsers or calls made outside of a browser. You can now allow or block IPs, URLs, or domains through the settings page or by machine groups.

Prerequisites:

  • URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see Protect your network.
  • The Antimalware client version must be 4.18.1906.x or later.
  • Supported on machines on Windows 10, version 1709 or later.
  • Ensure that Custom network indicators is enabled in Microsoft Defender Security Center > Settings > Advanced features. For more information, see Advanced features.

 

Important:

Only external IPs can be added to the indicator list.

For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge leverages Network Protection to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS).

For all other processes, web protection scenarios leverage Network Protection for inspection and enforcement:
NOTE:

  • Full URL path blocks can be applied on the domain level and all unencrypted URLs
  • There may be up to 2 hours latency (usually less) between the time the action is taken, and the URL and IP being blocked.
  • There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked.

 

Create an indicator for IPs, URLs, or domains from the settings page

  1. In the navigation pane, select Settings > Indicators.
  2. Select the IP addresses or URLs/Domains tab.
  3. Select Add indicator.
  4. Specify the following details:
    • Indicator – Specify the entity details and define the expiration of the indicator.
    • Action – Specify the action to be taken and provide a description.
    • Scope – Define the scope of the machine group.
  5. Review the details in the Summary tab, then click Save.

 

Import a list of IoCs

You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details.

Download the sample CSV to know the supported column attributes.

  1. In the navigation pane, select Settings > Indicators.
  2. Select the tab of the entity type you’d like to import indicators for.
  3. Select Import > Choose file.
  4. Select Import. Do this for all the files you’d like to import.
  5. Select Done.
  • Make sure the setting for Cusotm Network Indicator setting was turned on if we have  IoC items configured by IP addresses, Url, Domain Name:

tantran55_5-1596459568629.png

 

Threat & Vulnerability Management dashboard

You can use the Threat & Vulnerability Management capability in Microsoft Defender Security Center to:

  • View exposure and configuration scores side-by-side with top security recommendations, software vulnerability, remediation activities, and exposed machines
  • Correlate EDR insights with endpoint vulnerabilities and process them
  • Select remediation options, triage and track the remediation tasks
  • Select exception options and track active exceptions

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights

 

Exposure score

See the current state of your organization’s device exposure to threats and vulnerabilities.

Several factors affect your organization’s exposure score: weaknesses discovered in your

devices, likelihood of your devices to be breached, value of the devices to your

organization, and relevant alerts discovered with your devices. The goal is to lower

the exposure score of your organization to be more secure. To reduce the score,

you need to remediate the related security configuration issues listed in the

security recommendations.

Configuration score

See the security posture of the operating system, applications, network, accounts and

security controls of your organization. The goal is to remediate the related security

configuration issues to increase your configuration score. Selecting the bars will take

you to the Security recommendation page.

Weakness

The Weaknesses page lists down the vulnerabilities found in the infected software running

in your organization by listing the Common Vulnerabilities and Exposures (CVE) ID, the severity,

Common Vulnerability Scoring System (CVSS) rating, prevalence in your organization,

corresponding breach, and threat insights.

Indicator of compromise (IoCs)

Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response).

 

Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to.

 

To Group Machines based on OS, Name Prefix, …

  • Settings
  • PermissionsDevice Groups
  • Add New Device Group
  • ….    

tantran55_11-1596460232541.png

 

  • User Access
  • Assign Azure AD User Group to Role
  • Apply changetantran55_7-1596459568638.pngAdding Custom Role for ATP Service:

You could add multiple different custom roles based on different permission sets:

  • View Data
  • Active Remediation Action
  • Alert investigation
  • Live response.

To Add a Role:

  • Settings
  • PermissionsRoles
  • Add item, …

tantran55_8-1596459568642.png

 

tantran55_9-1596459568649.png

  • Add Azure AD User Group to Roles:

tantran55_10-1596459568652.png

  • Save

 

I hope the information is useful to your daily operation of ATP

 

Cheers!