Continuous Export as Trusted Service to Event Hub

by Contributed | Jun 29, 2023 | Technology

This article is contributed. See the original author and article here.

Introduction: 

Have you ever found yourself in a situation where you needed to stream Microsoft Defender for Cloud data to another system? Microsoft Defender for Cloud provides the option of streaming data like recommendations and security alerts, to a Log Analytics workspace, event hub, or another SIEM solution. This capability is called continuous export.

Imagine if the system you want to stream Microsoft Defender for Cloud data is located behind the firewall. How would you go about doing that?  This article teaches you how to accomplish this scenario by configuring export as a trusted service.  

To configure Continuous export as a trusted service, you need to perform the following steps in sequence: 

1. Identify the destination event hub. 


2. Add the relevant role assignments on the destination event hub. 


3. Configure continuous export as a trusted service to use the destination event hub. 


4. Verify data is being exported to the destination event hub. 

The first step is identifying the event hub used to stream data from Defender for Cloud, to the system located behind the firewall.  

Identify the destination event hub  

Event hub provides you with a way to ingest data and integrate with other Azure services, like Defender for Cloud. For the purposes of configuring continuous export to stream data located behind a firewall you can either use an existing event hub or create a new one. 

To learn how to create a new event hub you can start at https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-quickstart-cli. 

After you identify the event hub to be used as the destination for your Defender for Cloud data, you need to grant the continuous export service access the necessary permissions. 

Add the relevant role assignment on the destination event hub 

To add the necessary permissions, perform the following actions: 

1. Navigate to the Event Hubs dashboard.  


2. Click the destination Event Hub. 


3. Select Access Control > Add role assignment > Azure Event Hubs Data Sender.  


4. Click + Select members > Windows Azure Security Resource Provider (like in figure 1). 


5. Select > Review + assign. 

Figure 1. Adding the relevant role assignment on the destination event hub

After you add the relevant permissions to the event hub, you can proceed to the next step of configuring continuous export.  

Configure continuous export as a trusted service to use the destination event hub 

To configure continuous export, you need to have write permissions on the event hub policy. Imagine you wanted to stream data related to recommendations and security alerts in near real-time, to a system located behind a firewall. To achieve this scenario, perform the following actions: 

1. Navigate to the Cloud for Cloud dashboard. 


2. Select Environment settings.  


3. Click the desired subscription.  


4. On the left, select Continuous export. 


5. Select Event hub.  


6. Select Security recommendations and Security alerts.  


7. Under Export frequency select streaming updates. 


8. Ensure Export as a trusted service is selected (like in figure 2). 


9. Choose the destination event hub. 

Figure 2. Ensure that Export as a trusted service is selected

If you need further guidance on how to configure continuous export as a trusted service you can start here.

After you perform these actions, you can optionally verifying that data is being sent to the destination event hub.  

Conclusion: 

Configuring continuous export as a trusted service to event hub, allows you to stream Defender for Cloud data to a system located behind a firewall. For the purposes on this article, I focus on teaching you how to configure continuous export with the portal. However, for large organizations it’s recommended to use something like Azure policy to configure this scenario at scale. To configure continuous export as a trusted service to event hub you can use the following Azure policy: Deploy export to Event Hub as a trusted service for Microsoft Defender for Cloud data. The respective policy definition ID is af9f6c70-eb74-4189-8d15-e4f11a7ebfd4.  

Reviewers:  

Arik Noyman, Principal Group Software Engineering Manager,  

Or Serok Jeppa, Senior PM Lead, 

Sulaiman Abu Rashed,  Software Engineer II 

Microsoft Purview – Paint By Numbers Series (Part 2g) – Recommended Labeling of Files and Emails

by Contributed | Jun 28, 2023 | Technology

This article is contributed. See the original author and article here.

Before we start, please not that if you want to see a table of contents for all the sections of this blog and their various Purview topics, you can locate the in the following link:

Microsoft Purview- Paint By Numbers Series (Part 0) – Overview – Microsoft Tech Community

Disclaimer

This document is not meant to replace any official documentation, including those found at docs.microsoft.com.  Those documents are continually updated and maintained by Microsoft Corporation.  If there is a discrepancy between this document and what you find in the Compliance User Interface (UI) or inside of a reference in docs.microsoft.com, you should always defer to that official documentation and contact your Microsoft Account team as needed.  Links to the docs.microsoft.com data will be referenced both in the document steps as well as in the appendix.

All of the following steps should be done with test data, and where possible, testing should be performed in a test environment.  Testing should never be performed against production data.

Target Audience

The Information Protection section of this blog series is aimed at Security and Compliance officers who need to properly label data, encrypt it where needed.

Document Scope

This document is meant to guide an administrator who is “net new” to Microsoft E5 Compliance through.

We will be covering the recommendation of labels for new files and emails based on the Sensitive Information Type within those files and emails. 

It is presumed that you already have a Sensitive Information Type that you want to use in your Information Protection policy.  For the purposes of this document, I will be using a previously created Data Classification called “Recommended_Label_Contoso_medicine”.  The keyword I am tracking within that data classifier is “Contoso_medicine”.  I am doing this to avoid labeling any files by accident by using an out-of-the-box classifier.  For information on how you create your own data classifier, refer back to “Part 1 – Sensitivity Information Types” of this blog series.

This document is only meant to be an introduction to the topic of multiple Sensitivity labels.  Always refer back to official Microsoft documentation or your Microsoft account team for the latest information.

Out-of-Scope

This document does not cover any other aspect of Microsoft E5 Purview, including:

• Data Classification


• Data Protection Loss (DLP) for Exchange, OneDrive, Devices


• Data Lifecycle Management (retention and disposal)


• Records Management (retention and disposal)


• eDiscovery


• Insider Risk Management (IRM)


• Priva


• Advanced Audit


• Microsoft Cloud App Security (MCAS)


• Information Barriers


• Communications Compliance


• Licensing

It is presumed that you have a pre-existing of understanding of what Microsoft E5 Compliance does and how to navigate the User Interface (UI).

For details on licensing (ie. which components and functions of Purview are in E3 vs E5) you will need to contact your Microsoft Security Specialist, Account Manager, or certified partner.

We will not be covering the auto-labeling of data at rest.  That will be covered in another blog post and those auto-labeling policies should not be done until after you have locked down your Sensitivity labeling of all “net new” data.

Overview of Document

1. Create a recommended Sensitivity Label


2. Create a recommended Sensitivity labeling policy


3. Verify that the user is prompted to apply the specific Sensitivity Label to a new file


4. Verify that the user is prompted to apply the specific Sensitivity Label to a new email

Use Case

• The prompting of users to apply a Sensitivity Label when sensitive data is detected within a new file or email.

Definitions

• Sensitivity Label – a metadata tag


• Publish Label – making the metadata tag available to your tenant


• Policy – The monitoring and applying of Sensitivity labels through the Microsoft tenant

Notes

• Types of labels:
  
  
  
  • Automatic labels are applied to data at rest in Exchange mailboxes, SharePoint/Teams sites and users’ OneDrives.
  
  
  • Default labels are applied to data upon creation (and based on what is in the file/email).
  
  
  • Recommended labels do not label data, but appear when a specific piece of Sensitive Information Type (ex. Contoso_Medicine) are added to a file/email.  It is up to the user to apply or not apply the recommended label.
  
  
  
  

Pre-requisites

• You have read Parts 0, 1 and 2 of this blog series


• You have a Sensitive Information Type (SIT) that will be tied to this automatic label.

Part 1 – Create a Recommended Sensitivity label

We will first set up our recommended label.

1. Give the label a name and description (and color marker, if you wish).  Then click Next.

2. For the Scope, select Items and be sure that Files and Emails are selected.  Then click Next.

3. Under the Items section of the wizard, select Apply or remove encryption and Apply content marking, then click Next.

4. We now arrive at Encryption.  Click Configure encryption settings.

5. Assign Permissions now or let users decide?  and chose Let users assign permissions when they apply the label.

6. For the purpose of this blog, under In Outlook, enforce one of the following restrictions -> Do Not Forward.

7. We want this label to be applied to MS Office related workloads.  So, select In Word, Powerpoint, and Excel, prompt users to specify permissions.

8. Click for Apply content watermarking, I like to use the header option as it is the easiest because it is at the top of each electronic page. I will be using this watermark – “Contoso Medicine (Blog Recommended Label)”.

9. Next, we will Enable auto-labeling for files and emails.

10. At the top of this page, for the Content contains, we will select the SIT that we created previously.  In my case, I am using the “Recommended_Label_Contoso_medicine”.  The keyword I am tracking within that data classifier is “Contoso_medicine”. 

11. At the bottom of this page, for the When content matches these conditions select Recommend that the users apply the label.

• Note – this is the proverbial switch that needs to be flipped for a label to enable Recommend vs. Automatic vs Default labels.

12. We also want to provide an explanation in Word, Excel, etc. for the users.  So in the field Display this message to users when the label is applied, type the message you want your user to see when the label is recommended.   Then click Next.

13. On the protection settings for Groups and Sites, we will not be enabling anything as they are not applicable for this label and policy.  Accept the defaults and click Next.

14. On the schematized data assets, we will leave this at the default of Off.  Click Next.

15. Review your label and click Create Label.

16. Accept the defaults and then click Done and then Create Policy and then Close.

17. You are now ready to publish your policy.

Part 2 – Publish your Recommended Sensitivity label

We will now publish your label to your tenant.

1. On the left click on Information protection -> Label policies.

2. Click Publish label to start the publication wizard.

3. On the first step of the wizard, click Choose sensitivity labels to publish.

4. Select your recommended above label and click Add.

1. Note – you can publish (or republish) 1, many or all your labels in a Publish label wizard.

5. Click Next.

6. In the next step of the wizard, you can assign a specific administrative team to manage this policy.  We will not be doing that in this blog.  Click Next.

7. Next, you can decide who will see the published label.  I will be using the default of all Users and groups, but I recommend you only use your own test user accounts here to limit the who will be seeing this label.

8. Under Policy Settings, you can leave all of these boxes blank.  I will leave the first 3 boxes blankc and enter a URL into the last box (Provide users with a link to a customer help page).  When you are ready, click Next.

9. On Default settings for documents, we will not be selecting any Default labels.  Accept the default and click Next.

10. On Default settings for emails, leave things as the default of Same as docuemtn.  Click Next.

11. On Default settings for meetings and calendar events, leave things as the default of None.  Click Next.

12. On Default settings for Power BI content, leave things as the default of None.  Click Next.

13. Now give your policy a name and description and click Next.

14. Tk Review your settings. When you are satisfied, click Submit and Done.

15. You are not ready to start the testing phase of this blog.

Note – it can take 24-48 hours for labels and policies to replicated within a tenant.

Part 3 – Test Recommended label on new file

Before we start our file and email tests, remember that labels and policies can take a while to replicate throughout your tenant.  One hour is usually a good amount of time to wait, but it might be quicker or slow to populate based on several variables in your tenant we will not cover at this time.

1. Open Word, Excel or PowerPoint

2. Create a New File. 

3. Type in the Sensitive Information Type that you have associated with your recommended Sensitivity label.  I am using the compound word “contoso_medicine”.

4. When you do, you will see a Policy Tip bar appear at the top of your document. Here is an example.

5. Here is a magnification of the left side above.

6. Here is a magnification of the left side above.

7. This is the end of the file testing.

Part 4 – Test Recommended label on new email

We will now test this recommended label against a newly created email.

1. Open Outlook.

2. Create a New Email. 

3. Type in the Sensitive Information Type that you have associated with your recommended Sensitivity label.  I am using the compound word “contoso_medicine”.

4. When you do, you will see a Policy Tip bar appear at the top of your document. Here is an example.

5. Here is a magnification of the left side above.

6. Here is a magnification of the left side above.

7. This is the end of the email testing.

You have now reached the end of this blog entry.

Appendix and Links

• Create and publish sensitivity labels – Microsoft Purview (compliance) | Microsoft Learn

• Labeling in the Microsoft Purview Data Map – Microsoft Purview | Microsoft Learn

• Enable sensitivity labels in Power BI – Power BI | Microsoft Learn

• Learn about sensitivity labels – Microsoft Purview (compliance) | Microsoft Learn

• Use sensitivity labels with Microsoft Teams, Microsoft 365 groups, and SharePoint sites – Microsoft 365 Compliance | Microsoft Docs

• Enable archive mailboxes in the Security & Compliance Center – Microsoft 365 Compliance | Microsoft Docs

• Restrict access to content using sensitivity labels to apply encryption – Microsoft 365 Compliance | Microsoft Docs

• Use sensitivity labels with Microsoft Teams, Microsoft 365 groups, and SharePoint sites – Microsoft 365 Compliance | Microsoft Docs

• Automatically apply a sensitivity label to content in Microsoft 365 – Microsoft 365 Compliance | Microsoft Docs

• Use sensitivity labels with Microsoft Teams, Microsoft 365 groups, and SharePoint sites – Microsoft 365 Compliance | Microsoft Docs

• Automatically apply sensitivity labels to your data – Azure Purview | Microsoft Docs

• Manage sensitivity labels in Office apps – Microsoft 365 Compliance | Microsoft Docs

• Mandatory label policy in Power BI – Power BI | Microsoft Docs

• Automatically apply a sensitivity label to content in Microsoft 365 – Microsoft 365 Compliance | Microsoft Docs

Note: This solution is a sample and may be used with Microsoft Compliance tools for dissemination of reference information only. This solution is not intended or made available for use as a replacement for professional and individualized technical advice from Microsoft or a Microsoft certified partner when it comes to the implementation of a compliance and/or advanced eDiscovery solution and no license or right is granted by Microsoft to use this solution for such purposes. This solution is not designed or intended to be a substitute for professional technical advice from Microsoft or a Microsoft certified partner when it comes to the design or implementation of a compliance and/or advanced eDiscovery solution and should not be used as such.  Customer bears the sole risk and responsibility for any use. Microsoft does not warrant that the solution or any materials provided in connection therewith will be sufficient for any business purposes or meet the business requirements of any person or organization.

What new for Viva Engage – June Edition

by Contributed | Jun 26, 2023 | Technology

This article is contributed. See the original author and article here.

This month we are introducing several capabilities for leaders, corporate communicators, and employees to improve your campaigns, events, and engagement across the platform. Here’s what’s new for Viva Engage this month:

Updates to Leadership Corner* feeds and announcements

Employees can sort the feed in Leadership Corner chronologically, or filter to see unread conversations or only announcements from their leaders. Additionally, employees can now access a dedicated feed with all featured conversations across the network in a single, consolidated view.

Top posts are also new in Leadership Corner, providing a visual element to highlight featured conversations and announcements from leaders.

Top posts now have a dedicated carousel within Leadership Corner

*Denotes features are available to Microsoft Viva customers only.

New enhancements coming to campaigns* in Viva Engage

The campaign discovery hub in Viva Engage will help employees explore and discover campaigns.

In the campaign hub, employees will find:

• Top campaigns which are trending campaigns that the employee is currently not following


• Sponsored campaigns which are campaigns that are sponsored by leaders


• Browse all campaigns which shows all active and ended campaign

Employees can Follow active campaigns or learn more about a campaign on its landing page. Or employees can access the campaign hub by clicking on Discover more from Top Campaigns on the home feed or Followed Campaigns on any storyline profile. Employees can search for a campaign by using the Viva Engage search bar. Search campaigns results show campaign hashtag, description, followers count, official symbol, color theme and cover image. This search is based on a prefix search to provide more relevant information.

The newly added Executive sponsors enables leaders in an organization to sponsor and support campaigns. Corporate communicators (campaign managers) of an organization can manually add leaders as executive sponsors. Once added, executive sponsors will be notified in Viva Engage and Outlook. Campaigns that have executive sponsors will also show up in Leadership Corner. Learn best practices and get some ideas from Viva Engage Explained blog to get started with campaigns.

Ask Me Anything improvements make hosting easier for large AMAs

Ask Me Anything’s are text based virtual events, often hosted by leaders or subject matter experts on a specific topic. Coming soon, organizers will be renamed to hosts and moderators will be renamed to organizers. When you create an AMAM you can add up to 10 moderators and/or hosts per event. Hosts can create the event and add co-organizers to help edit and manage the event. AMA moderators can help manage incoming questions from employees during the event. Depending on the anticipated size and reach of your AMA, we’d advise at least 2 moderators.

Employees will be able to add AMAs directly to their calendars to remind them of the upcoming events and participate live. The calendar invite will include time and a link directly to the AMA making it simple for employees to find the action and post their own question or upvote previously asked questions. Additionally, we display upcoming and past AMAs that leaders have hosted, employees will be able to see AMAs from their leaders within the Leadership Corner.

After the AMA has concluded, organizers and leaders need insights to measure success or make improvements. Viva Engage will now include an initial set of analytics for AMAs. Organizers can see key details of their AMAs like reach and engagement.

For more details about hosting your own AMA and best practices, view the AMA Playbook.

Viva Engage topic migration update and improvements rolling out

Shifting to Viva Topics leverages a more robust and secure infrastructure for Viva Engage topics. We began this process earlier this year for networks in Native Mode and will continue until all Viva Engage networks have migrated to Viva Topics. The migration also helps make community-sourced knowledge accessible across an organization and supports a consistent topics experience in Microsoft 365. To ensure quality topic experiences, Viva Engage topics applied to less than 10 Viva Engage conversations or topics with no usage in the last 18 months will still be migrated but will not be surfaced in topic picking experiences.

For organizations not using premium Viva Topics experiences, the use of topics in Viva Engage will appear the same before and after topic migration.

For organizations using Viva Topics*, you will gain premium benefits, such as topic cards in Yammer (Viva Engage), Viva Topic pages, and centralized topic management.

To support these changes fixes and enhancements to data exports and the Topics API will be rolling out. Admins can review documentation on API and data export in the following resources:

• Export data in Viva Engage


• Introduction to the Data Export API


• More on Yammer Topic API changes with Microsoft Viva

Export topics created in Viva Engage with PowerShell

Using PowerShell, you can export topics created by an employee in Viva Engage (also known as Lite Topics) to a .csv file. Topics created before enabling integration with Viva Engage are included. For more information, please see Export topics created in Viva Engage with PowerShell.

More controls coming to the new admin center

Last month we released a new Viva Engage admin center on the web, and now we will include more capabilities including data exports and increase audit logs. Learn more about the Admin Center here.

And in case you missed it…

CSV Bulk upload for communities is generally available. See this blog post for more details and add members to your communities today! Share step by step instructions with your community admins.

Stay connected, learn from your leaders, and build communities with the newly rebranded Viva Engage mobile app. Download the app from the app store. With the Viva Engage mobile app, sharing updates and staying connected to your organization and up-to-date on the latest news has never been easier.

Yammer.com is rebranding! Yammer web will be rebranded June 28. We will be hosting a community event July 11 to answer any outstanding questions. Need more resources? Check out the rebranding toolkit for templates and more to communicate the upcoming rebranding changes to your employees.

What’s coming soon?

See what else Viva Engage has planned on the public roadmap and keep an eye on this blog for more news, updates, and best practices relating to Viva Engage and communities in Microsoft 365.

*Some capabilities are only available for Microsoft Viva customers. Learn more here.

Error “TSQL CRUD has been disallowed via policy for this Azure subscription“

by Contributed | Jun 25, 2023 | Technology

This article is contributed. See the original author and article here.

We received some support cases when customers encounter following error “TSQL CRUD has been disallowed via policy for this Azure subscription“ while trying to create or modify of Azure SQL resources through T-SQL.

Cause

This error occurred when Azure Administrator block the T-SQL CRUD operations of Azure SQL resources through T-SQL. This is enforced at the subscription level to block T-SQL commands from affecting SQL resources in any Azure SQL database.

How to enable block T-SQL CRUD

To use this feature “block T-SQL CRUD” operation an Azure user with owner or contributor role is needed, by following the below steps:

1. Go to your subscription on Azure portal.


2. Select the Preview Features tab.


3. Select Block T-SQL CRUD.


4. After you select Block T-SQL CRUD, a new window will open, select Register, to register this block with Microsoft.Sql resource provider.

After you register the block of T-SQL CRUD with Microsoft.Sql resource provider, you must re-register the Microsoft.Sql resource provider for the changes to take effect. To re-register the Microsoft.Sql resource provider:

1. Go to your subscription on Azure portal.


2. Select the Resource Providers tab.


3. Search and select Microsoft.Sql resource provider.


4. Select Re-register.

Removing Block T-SQL CRUD

To remove the block on T-SQL create or modify operations from your subscription, first unregister the previously registered T-SQL block. Then, re-register the Microsoft.Sql resource provider as shown above for the removal of T-SQL block to take effect.

When to use Block T-SQL CRUD feature

When you are using Azure Policies to enforce organizational standards through ARM templates. Since T-SQL does not adhere to the Azure Policies, a block on T-SQL create or modify operations can be applied. The syntax blocked includes CRUD (create, update, delete) statements for databases in Azure SQL, specifically CREATE DATABASE, ALTER DATABASE, and DROP DATABASE statements.

Blocked statement

1. CREATE DATABASE statements


2. DROP DATABASE statements


3. A subset of ALTER DATABASE statements, as follows:
   
   
   
   • ALTER DATABASE … ADD SECONDARY ON SERVER
   
   
   • ALTER DATABASE … REMOVE SECONDARY ON SERVER
   
   
   • ALTER DATABASE … FAILOVER
   
   
   • ALTER DATABASE … MODIFY NAME …
   
   
   • ALTER DATABASE … MODIFY (MAXSIZE | EDITION | SERVICE_OBJECTIVE …)
   
   
   • ALTER DATABASE … MODIFY BACKUP_STORAGE_REDUNDANCY …
   
   
   • ALTER DATABASE … SET ENCRYPTION …
   
   
   
   

Disclaimer

Please note that the products and options presented in this article are subject to change. This article reflects Block T-SQL CRUD in June 2023. To check for new update or more information please check the below link:

Block T-SQL commands to create or modify Azure SQL resources – Block T-SQL commands to create or modify Azure SQL resources | Microsoft Learn

I hope this article was helpful to you, please feel free to share your feedback in the comments section.