End of support for non-secure cipher suites in Microsoft Cloud App Security

by | Aug 18, 2020 | Uncategorized | 0 comments

This article is contributed. See the original author and article here.

Co-authored with @Itamar Falcon

Microsoft Cloud App Security is removing non-secure cipher suites to provide best-in-class encryption, and to ensure our service is more secure by default. As of Oct 1, 2020,  Microsoft Cloud App Security will no longer support the following cipher suites.  From this date forward, any connection using these protocols will no longer work as expected, and no support will be provided. 

 

Non-secure cipher suites: 

  • ECDHE-RSA-AES256-SHA       
  • ECDHE-RSA-AES128-SHA       
  • AES256-GCM-SHA384       
  • AES128-GCM-SHA256       
  • AES256-SHA256       
  • AES128-SHA256   
  • AES256-SHA 
  • AES128-SHA 

 

 Support will continue for the following suites: 

  • ECDHE-ECDSA-AES256-GCM-SHA384:  
  • ECDHE-ECDSA-AES128-GCM-SHA256:  
  • ECDHE-RSA-AES256-GCM-SHA384:  
  • ECDHE-RSA-AES128-GCM-SHA256:  
  • ECDHE-ECDSA-AES256-SHA384:  
  • ECDHE-ECDSA-AES128-SHA256:  
  • ECDHE-RSA-AES256-SHA384:  
  • ECDHE-RSA-AES128-SHA256  

 

What do I need to do to prepare for this change? 

Customers should ensure that all client-server and browser-server combinations are using supported suites in order to maintain the connection to Microsoft Cloud App Security. 

 

Components that may be affected by this change include: 

  • SIEM Agent – Customers can use any supported cipher suite as described above.  
  • Microsoft Cloud App Security API – Custom applications and code that are utilizing the Microsoft Cloud App Security API must utilize supported suites to continue functioning. If unsure whether applications function with a supported suite, customers can test by authenticating to our dedicated API endpoint: https://tlsv12.portal-rs.cloudappsecurity.com. 
  • Apps configured with Conditional Access App Control – If customers are using Conditional Access App Control for any web or native client applications, they must verify that these applications are not using the deprecated suites; access to apps that use non-secure cipher suites and relevant controls will no longer work. 
  • Log collector – No changes are needed if no modification was done to the provided docker. 

 

For additional inquiries please contact support. 

– Microsoft Cloud App Security team 

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Submit a Comment