こんにちは、Teamsチームの吉野です。
本日はチャネルにメールで投稿する際に安全度を増す（？）ための設定を案内します。

チャネルを右クリックすると以下のようにメールアドレスを取得できます。

このメールアドレスはチームのメンバー以外でも送信することが可能です。
システムからのメールなど便利な面はあるのですがセキュリティを気にされることもあるかと思います。

詳細設定をクリックすると制限することが可能になります。

チームのメンバーやドメインを限定することにより、

なお、管理センターからは管理者がメール機能そのものの禁止やドメインの許可設定が行えます。
（各チャネルの設定よりも優先されます）

Hello All,

I will assume that you have set the permissions on your Site Collections correctly, but if that still leaves the security team uncomfortable we can always look to perform several other steps using Conditional Access and SharePoint admin.

The Microsoft team approaches this by classifying 3 types of sites Baseline, Sensitive, and Highly regulated each one escalating from the previous (Well actually there is a 4th which is public with minimal security). Here are those levels

And of course you need to setup the Site-Scoped limited access policies for SharePoint Online and OneDrive for Business. These policies utilize the device-based policies for SharePoint and OneDrive (Released Mar 2017) to help administrators ensure data on corporate resources is not leaked onto unmanaged devices such as non-domain joined or non-compliant devices. This is done by limiting access to content to the browser, preventing files from being taken offline or synchronized with OneDrive on unmanaged devices.

There are two things you need to do to configure these Site level policies

1. Tenant-level device-based policy must be configured to Full Access
2. Run the following script for each Site Collection you want to enforce the policy on
Connect-SPOService -Url
$Site = Get-SPOSite -Identity
Set-SPOSite -Identity $Site.Url -ConditionalAccessPolicy AllowLimitedAccess

You can also use the following values for the parameter 'ConditionalAccessPolicy': AllowFullAccess, AllowLimitedAccess, BlockAccess

While it might seem counterintuitive to allow external sharing, this approach provides more control over file sharing compared to sending files in email. SharePoint Online and Outlook work together to provide secure collaboration on files.

Now if a user connects to a Site Collection via an unmanaged/non-compliant device they will see a banner like this:

Note:

If access is limited or blocked to unmanaged devices, this impacts external users too, though you can can exempt them from this policy by running the following cmdlet:

Set-SPOTenant -ApplyAppEnforcedRestrictionsToAdHocRecipients $false

If you cannot see the Device Security Tab you need to enable MDM (See above for what this means) follow this article to enable and go thru settings

Pax

Some new links:

Docs BC (DEV): https://docs.microsoft.com/en-us/dynamics365/business-central/dev-itpro/

Docs BC (APP): https://docs.microsoft.com/en-us/dynamics365/business-central/

D365 BC for Partners (Blog): https://community.dynamics.com/business/b/businesscentraldevitpro/

D365 BC for Partners (Yammer): https://www.yammer.com/dynamicsnavdev#/home

BC DEV tools issues: https://github.com/Microsoft/AL/issues/

BC Event issues: https://github.com/Microsoft/ALAppExtensions/issues/

BC Ideas: https://experience.dynamics.com/ideas/list/?forum=e288ef32-82ed-e611-8101-5065f38b21f1

Create common environment/tenant: https://demos.microsoft.com/environments

Create trial BC under common account: https://trials.dynamics.com/Dynamics365/Signup/

P.S.

“Cumulative Update 01 for Microsoft Dynamics 365 Business Central has been released”

Hey… this news on the new site.

D365 BC for Partners (Blog): https://community.dynamics.com/business/b/businesscentraldevitpro/

Had some questions come up from the community to check the Log Analytics agent version.

Depending on how you are setup, the SCOM Integration makes this easy with Holman's blog for the agent management pack.

If you have admin right in Operations Manager console then you can check this directly from SCOM server:

If you are an admin in SCOM, you can check from MS

$Server = "DC01.yourlabnamehere.net"
(Get-SCOMAgent -Name $ServerName).Version

Alternatively, from server registry:

(Get-ItemProperty "HKLM:SOFTWAREMicrosoftMicrosoft Operations Manager3.0setup")

# Just the Agent version variable

(Get-ItemProperty "HKLM:SOFTWAREMicrosoftMicrosoft Operations Manager3.0setup").AgentVersion

Log Analytics

Kusto query

// Servers and Versions

Heartbeat
| project Computer,Version

// Specific version

Heartbeat
| where Version == "8.0.10918.0"
| project Computer,Version

// Summarize by Version

Heartbeat
| summarize by Version

If you're visual

From the Portal > Log Analytics > workspace > Workspace Summary > Agent Health

Scroll right to agent version

Monitor

Monitor > Overview > Agent Health Assessment

Scroll right to agent version

The time has come for me to change blog platforms.  I have tried to clone over many of my more popular or relevant posts to keep for future reference.  I don't plan to do any more blog posting on this site.  If you don't see your favorite but want to make sure it doesn't get lost, leave a comment on my new site.  Speaking of which, here is where you can find any of my future ConfigMgr/SCCM blogs:

https://learnconfigmgrintune.wordpress.com/

Check out the attached list of technical webinars for next week, to help you build your technical depth. Through these live, instructor-led webinars, you will receive interactive guidance with real-time Q&A capabilities - all at no cost to Microsoft Partner Network members!

Technical-Webinars_11-26-thru-11-30

To find additional dates and times for the webinars and consultations above, as well as the full suite of webinars and consultations available, visit aka.ms/TechnicalJourney.

As Intune Service Administrators at Microsoft, we often get a lot of inactive and stale Intune records due to the nature of test device enrollments. We want to keep our Intune environment and reports current by cleaning up these stale devices. With Intune device cleanup, we have the ability to configure the automatic cleanup rule which cleans up devices that are inactive, orphaned, or obsolete and have not checked in recently. The rule allows us to choose between 90 and 270 days to automatically remove inactive/obsolete device records from Intune. 

To get started, go to the Devices blade in Intune portal and navigate to "Device cleanup rules". Here you will be able to enable the cleanup rule to delete devices that haven't checked in for {X} days; the minimum is 90 days and the maximum is 270 days. At Microsoft, we have configured it as 90 days as we would like to keep device count as realistic as possible with the amount of test devices that get enrolled. Once this rule is enabled, Intune will automatically remove devices that haven’t checked in for the number of days you set. 

What happens behind the scene for Device Cleanup rules? 

After the Intune Service Admins enable the rule, Intune services run a background job every few hours to remove all applicable devices from the Intune portal and they won't show up in any Intune blade or device list anymore. This device removal is only applicable to Intune portal and devices do not get removed from Azure AD. Azure AD tenant admin has  to perform the device cleanup task in Azure AD portal to remove the stale record permanently. 

What device types get affected from this device cleanup? 

All enrolled devices including MDM, EAS/MDM, MDM/SCCM (Co Management) devices will be removed. This includes registered devices and also approval pending devices.

Does this device cleanup rule perform device wipe or retire? 

No, this automatic rule only removes the devices from the Intune portal which are orphaned devices. It means these device are no longer checking in with the service for the last x days chosen by the admin before getting removed from the Intune portal. 

Is it possible to have devices removed by  the device cleanup rule to come back in some scenarios?

Yes it is possible that some devices can come back in the Intune portal as there is service criteria to auto-recover the cleaned up devices if they check-in to the Intune service recently. The purpose of this behavior is to recover devices owned by somebody that took a long leave (e.g. Extended vacation, sabbatical, maternity leaves). The grace period for the device to show up in the Intune portal again is before the device cert expires, which is 180 days.  If you do not want devices to be able to check back in, consider filtering for stale devices and doing a bulk delete from the All devices view instead.

Microsoft is pleased to announce the final release of the security configuration baseline settings for Windows 10 October 2018 Update (a.k.a., version 1809, “Redstone 5” or “RS5”), and for Windows Server 2019.

For now, download the content here: Windows-10-1809-Security-Baseline-FINAL. It will be posted to the Security Compliance Toolkit download site very soon.

The downloadable attachment to this blog post includes importable GPOs, a PowerShell script for applying the GPOs to local policy, custom ADMX files for Group Policy settings, documentation in spreadsheet form and as a set of Policy Analyzer files. In this release, we have changed the documentation layout in a few ways:

• MS Security Baseline Windows 10 v1809 and Server 2019.xlsx – multi-tabbed workbook listing all Group Policy settings that ship in-box with Windows 10 v1809 or Windows Server 2019. Columns for “Windows 10 v1809,” “WS2019 Member Server,” and “WS2019 DC” show the recommended settings for those three scenarios. A small number of cells are color-coded to indicate that the settings should not be applied to systems that are not joined to an Active Directory domain. Cells in the “WS2019 DC” columns are also highlighted when they differ from the corresponding cells in the “WS2019 Member Server” column. Another change from past spreadsheets is that we have combined tabs that used to be separate. Specifically, we are no longer breaking out Internet Explorer and Windows Defender AV settings into separate tabs, nor the settings for LAPS, MS Security Guide, and MSS (Legacy). All these settings are now in the Computer and User tabs.
• A set of Policy Analyzer files:
  • MSFT-Win10-v1809-RS5-WS2019-FINAL.PolicyRules – a Policy Analyzer file representing all the GPOs in the combined Windows 10 and Server 2019 baselines.
  • MSFT-Win10-v1809-RS5-FINAL.PolicyRules – a Policy Analyzer file representing the GPOs intended to be applied to Windows 10 v1809.
  • MSFT-WS2019-MemberServer-FINAL.PolicyRules – a Policy Analyzer file representing the GPOs intended to be applied to Windows Server 2019, Member Server.
  • MSFT-WS2019-DomainController-FINAL.PolicyRules – a Policy Analyzer file representing the GPOs intended to be applied to Windows Server 2019, Domain Controller.
• BaselineDiffs-to-v1809-RS5-FINAL.xlsx – This Policy Analyzer-generated workbook lists the differences in Microsoft security configuration baselines between the new baselines and the corresponding previous baselines. The Windows 10 v1809 settings are compared against those for Windows 10 v1803, and the Windows Server 2019 baselines are compared against those for Windows Server 2016.
• Windows 10 1803 to 1809 New Settings.xlsx – Lists all the settings that are available in Windows 10 v1809 that were added since Windows 10 v1803. (We used to highlight these settings in the big all-settings spreadsheets.)
• Server 2016 to 2019 New Settings.xlsx – Lists all the settings that are available in Windows Server 2019 that were added since Windows Server 2016. (We used to highlight these settings in the big all-settings spreadsheets.)

Highlights of the differences from past baselines, which are listed in BaselineDiffs-to-v1809-RS5-FINAL.xlsx:

• Added two new Attack Surface Reduction rules in Windows Defender Exploit Guard: “Block Office communication applications from creating child processes” (which includes Outlook), and “Block Adobe Reader from creating child processes.” Note that these were added since the draft release of these baselines.
• Since the draft baseline, we removed the “Turn off printing over HTTP” setting in “Computer ConfigurationAdministrative TemplatesSystemInternet Communication ManagementInternet Communication settings.” This setting had been in our baselines at least as far back as Windows XP because of the mistaken belief that it distinguished between HTTP and HTTPS. Enabling this setting also disables printing over HTTPS, which breaks legitimate and necessary functionality for no security benefit.
• The MS Security Guide custom setting protecting against potentially unwanted applications (PUA) has been deprecated, and is now implemented with a new setting under Computer Configuration...Windows Defender Antivirus.
• We have enabled the “Encryption Oracle Remediation” setting we had considered for v1803. At the time we were concerned that enabling the newly-introduced setting would break too many not-yet-patched systems. We assume that systems have since been brought up to date. (You can read information about the setting hereand here.)
• Changes to Virtualization-Based Security settings (used by Credential Guard and Code Integrity):
  • “Platform Security Level” changed from “Secure Boot and DMA Protection” to “Secure Boot.” If system hardware doesn’t support DMA protection, selecting “Secure Boot and DMA Protection” prevents Credential Guard from operating. If you can affirm that your systems support the DMA protection feature, choose the stronger option. We have opted for “Secure Boot” (only) in the baseline to reduce the likelihood that Credential Guard fails to run.
  • Enabled the new System Guard Secure Launch setting which will enable Secure Launch on new capable hardware. Secure Launch changes the way windows boots to use Intel Trusted Execution Technology (TXT) and Runtime BIOS Resilience features to prevent firmware exploits from being able to impact the security of the Windows Virtualization Based Security environment.
  • Disabled the “Require UEFI Memory Attributes Table” option. This is a change from the draft release, and is intended to increase compatibility.
  • Removed Credential Guard from the Domain Controller baseline, while retaining the rest of the VBS settings. This is implemented in a new DC-only GPO named “MSFT Windows Server 2019 - Domain Controller Virtualization Based Security.” Note that this is a change from the draft baseline in which we had removed all VBS settings from the DC baseline. (Credential Guard is not useful on domain controllers and is not supported there.)
• Enabled the new Kernel DMA Protection feature described here. The “External device enumeration” policy controls whether to enumerate external devices that are not compatible with DMA-remapping. Devices that are compatible with DMA-remapping are always enumerated.
• Removed the BitLocker setting, “Allow Secure Boot for integrity validation,” as it merely enforced a default that was unlikely to be modified even by a misguided administrator.
• Removed the BitLocker setting, “Configure minimum PIN length for startup,” as new hardware features reduce the need for a startup PIN, and the setting increased Windows’ minimum by only one character.
• Since the draft release, we removed “Prevent users from modifying settings” from “Computer ConfigurationAdministrative TemplatesWindows ComponentsWindows SecurityApp and browser protection,” as it merely enforced a default that non-admins could not override.
• Enabled the new Microsoft Edge setting to prevent users from bypassing certificate error messages, bringing Edge in line with a similar setting for Internet Explorer.
• Removed the block against handling PKU2U authentication requests, as the feature is increasingly necessary.
• Removed the configuration of the “Create symbolic links” user rights assignment, as it merely enforced a default, was unlikely to be modified by a misguided administrator or for malicious purposes, and needs to be changed to a different value when Hyper-V is enabled.
• Removed the deny-logon restrictions against the Guests group as unnecessary: by default, the Guest account is the only member of the Guests group, and the Guest account is disabled. Only an administrator can enable the Guest account or add members to the Guests group.
• Removed the disabling of the xbgm (“Xbox Game Monitoring”) service, as it is not present in Windows 10 v1809. (By the way, consumer services such as the Xbox services have been removed from Windows Server 2019 with Desktop Experience!)
• Created and enabled a new custom MS Security Guide setting for the domain controller baseline, “Extended Protection for LDAP Authentication (Domain Controllers only),” which configures the LdapEnforceChannelBinding registry value described here.
• The Server 2019 baselines pick up all the changes accumulated in the four Windows 10 releases since Windows Server 2016.

We received and have been evaluating recommendations for more extensive changes to the baselines that we are continuing to evaluate for future releases.

We have replaced the collection of .cmd batch files for applying the baselines to local policy with a single PowerShell script that takes one of these five command-line switches to indicate which baseline you want to apply:

.BaselineLocalInstall.ps1 -Win10DomainJoined      - for Windows 10 v1809, domain-joined

.BaselineLocalInstall.ps1 -Win10NonDomainJoined   - for Windows 10 v1809, non-domain-joined

.BaselineLocalInstall.ps1 -WS2019Member           - for Windows Server 2019, domain-joined

.BaselineLocalInstall.ps1 -WS2019NonDomainJoined  - for Windows Server 2019, non-domain-joined

.BaselineLocalInstall.ps1 -WS2019DomainController - for Windows Server 2019, domain controller

A couple of important notes about using the BaselineLocalInstall.ps1 script:

• PowerShell execution policy must be configured to allow script execution. You can configure this with a command line such as the following:
  Set-ExecutionPolicy RemoteSigned
• exe must be in the Tools subdirectory or somewhere in the Path. LGPO.exe is part of the Security Compliance Toolkit and can be downloaded from this URL:
  https://www.microsoft.com/download/details.aspx?id=55319

Windows 10 v1809 has greatly expanded its manageability using Mobile Device Management (MDM). The Intune team is preparing documentation about the Microsoft Windows MDM security baseline and how to use Intune to implement the baseline, and will publish it very soon. We will post information to this blog when that happens.

Summary

SharePoint 2019 delivers an updated modern look and feel for lists and libraries and enabled by default.

Modern:                                                                                                                                                              Classic:

However, if the classic experience is required for your farm, the modern experience can be disabled.

How to modify the default experience for list and libraries as a user

From the user perspective, switching from modern and classic is a simple click.

For example, users will see all lists and libraries. Once in classic mode, you will then see to return to modern mode.

How to modify the default experience for list and libraries as an Admin

Admins can manage the default experience for list and libraries at the site collection, web or library level.

To change disable / re-enable the modern user experience at the site collection level

#Site Collection Level
Add-PSSnapin microsoft.sharepoint.powershell -ea 0
$site = Get-SPSite http://spwfe

#Disable modern Lists and libraies at the Site Collection Level
$featureguid = new-object System.Guid "E3540C7D-6BEA-403C-A224-1A12EAFEE4C4"
$site.Features.Add($featureguid, $true)

#Re-enable the moden expirence at the site collection Level.
$featureguid = new-object System.Guid "E3540C7D-6BEA-403C-A224-1A12EAFEE4C4"
$site.Features.Remove($featureguid, $true)

To change disable / re-enable the modern user experience at the web level

#Web Level
Add-PSSnapin microsoft.sharepoint.powershell -ea 0
$site = Get-SPWeb http://spwfe

#Disable modern Lists and libraies at the Web Level.
$featureguid = new-object System.Guid "52E14B6F-B1BB-4969-B89B-C4FAA56745EF"
$site.Features.Add($featureguid, $true)

#Re-enable the moden expirence at the Web Level
$featureguid = new-object System.Guid "52E14B6F-B1BB-4969-B89B-C4FAA56745EF"
$site.Features.Remove($featureguid, $true)

To change disable / re-enable the modern user experience at the library level

Add-PSSnapin microsoft.sharepoint.powershell -ea 0
$web = Get-SPWeb http://spwfe
$list = $web.Lists["Documents"]

#Classic setting
$list.ListExperienceOptions = "ClassicExperience"
$list.Update()

#Modern setting
$list.ListExperienceOptions = "NewExperience"
$list.Update()

#User Default
$list.ListExperienceOptions = "Auto"
$list.Update()

More Information

I hope you found this tip useful, and if you are interested in the SPO equivalent, see the following articles.

Switch the default experience for lists or document libraries from new or classic

Change the default list and library experience

以下当てはまるものありませんか？

• バックアップで痛い目に合ってる方
• バックアップシステムの更改をご検討の方
• データ保護対策でお悩みの方
• バックアップやアーカイブ、ストレージ関連でお悩みの方
• クラウドバックアップに興味をお持ちの方
• Windows/SQL Server のEOSを控えていらっしゃる方

上記一つでも当てはまったそこのあなた！

ハイブリッド・クラウド時代の次世代型データ保護製品として、
シンプル・低コスト・短時間で導入/運用可能なRubrikソリューションを本セミナーでご紹介させてください。

［概要］
■日程：2018/12/5 (水) 14:30~17:00（14:15 受付開始）
■場所：マイクロソフト 品川グランドセントラルタワー 30 階　30C-13
■参加：無料（※同業者様のご参加をお断りさせて頂く場合があります。あらかじめご了承ください。）
■定員：20名様

株式会社コミュニティネットワークセンター様の事例登壇あり。
（質疑応答、個別相談会）

［Agenda］
■14:30-15:10　マイクロソフトのクラウドサービス「Azure」 IaaS最前線
クラウドの利用やクラウドへの移行を検討されている方を対象に、マイクロソフトのクラウドサービスであ
る「Azure」で何ができるのか、どのようなメリットがあるのか、何が安心なのか、オンプレと比較して何
が優れているのかを最新情報を含めて解説します。
日本マイクロソフト株式会社
エバンジェリスト
田中達彦

■15:10-15:40　ついに来た!「ルーブリック」が変えるクラウド時代のデータ保護
これまでのシステム毎に構築されてきたバックアップやDRでは、爆発的に増えるデータへの対応やクラ
ウドの活用、そしてSDDCなど新たなテクノロジーへの対応に限界を感じていないでしょうか？データの
扱いはどうあるべきなのでしょう？ 今世界中で大きく注目され、遂に日本へ本格参入した新たな
データ保護ソリューション「ルーブリック」を是非ご確認ください。
ルーブリック・ジャパン株式会社
セールス・エンジニア
吉田 幸春

（休憩）

■15:50-16:20　ルーブリック製品デモ
誰でも簡単にできるルーブリックを使ったバックアップ・リストアとクラウドの活用についてご紹介し
ます。
ルーブリック・ジャパン株式会社
セールス・エンジニア
藤田達也

■16:20-16:50　お客様導入事例登壇
実際にご利用いただいているお客様に事例のご登壇をいただきます。今回は株式会社コミュニティネットワークセンター様にお話いただきます。
株式会社 コミュニティ ネットワークセンター
技術本部 サーバグループ
ニコライ ボヤジエフ 氏

▼本セミナーの参加登録はこちら

• 『アルバスティア戦記』 ケムコ （KEMCO）
• 『サリーの法則』 Polaris-x
• 『フォーゴットン・アン』日本語版 コーラス・ワールドワイド

• 『ドラゴンファングZ 竜者ロゼと宿り木の迷宮』 Toydea Inc.
• 『BackSlash (バックスラッシュ)』 株式会社Skeleton Crew Studio
• 『ライバル・メガガン』 Spacewave Software
• 『La-Mulana 2 (ラ・ムラーナ 2)』 アクティブゲーミングメディア / PLAYISM

ID@Xbox プログラムから発売予定のタイトル

The Good Life

アルバスティア戦記

サリーの法則

フォーゴットン・アン

今後ID@Xboxを通じて発売予定のタイトル

ドラゴンファングZ 竜者ロゼと宿り木の迷宮

BackSlash (バックスラッシュ)

ライバル・メガガン

La-Mulana 2 (ラ・ムラーナ 2)

ID@Xboxについて

ID@Xbox 登録サイト

• https //www.xbox.com/ja-JP/developers/id

Following on from my earlier post https://blogs.technet.microsoft.com/jeremyknight/2018/10/01/introducing-the-exchange-online-fiddler-extension/ we have now made significant improvements to the extension and have just made version 1.0.50 available.

Improvements in this new version include:

• Performance troubleshooting enhancements to the inspector tab. -- See how long the Exchange Online server took to respond to requests.
• Updates to the rule set, new scenarios for highlighting / providing information on scenarios we have seen in support cases.
• Expanded out the menu to include more options, making it easier to use.
• Added X-HostIP column. Easier to see local vs. internet IP responding server / device.
• Title of the 'Exchange Online' menu will now show if an update is available.
• Minimal telemetry data collected for usage statistics.

The update is available now at: https://github.com/jprknight/EXOFiddlerExtension/releases.

For any questions see: https://github.com/jprknight/EXOFiddlerExtension/wiki.

For any issues see: https://github.com/jprknight/EXOFiddlerExtension/issues.

Happy troubleshooting!

執筆者: John Macintyre (Partner Group Program Manager, Azure SQL Data Warehouse)

このポストは、2018 年 11 月 7 日に投稿された Azure SQL Data Warehouse introduces new productivity and security capabilities の翻訳です。

Azure SQL Data Warehouse は、長年他社を凌ぐトップ クラスのパフォーマンスを発揮してきており、TPC-H (英語) や TPC-DS (英語) などの第三者ベンチマークでも圧倒的な成績を収めています。これは、Anheuser Busch InBev (英語)、Thomson Reuters (英語)、ThyssenKrupp (英語) などの Fortune 1000 企業の 50% 以上が、新しい分析ソリューションに Azure を採用していることからも明白です。

2018 年 4 月にリリースした SQL Data Warehouse Gen2 では、クエリ パフォーマンスと並列処理を大幅に強化しました。さらに今回、膨大に増え続けるデータ量とそれを分析するワークロードの負荷に対応する新機能を追加し、ワークロード管理機能の強化、行レベル セキュリティ (英語) の追加、運用エクスペリエンスの改善を実施しました。

ワークロード管理機能の強化

SQL Data Warehouse は、重要度の高い処理が優先的にシステム リソースにアクセスできるようにクエリを最適化するワークロード管理機能を備えています。この機能を使用すると、複数のワークロードを 1 つの SQL Data Warehouse データベースで効率よく実行できるため、ソリューションごとにデータ ウェアハウスを運用する必要がなくなります。これにより、デプロイ済みのリソースをさらに制御、活用、最適化できるようになります。この機能は、今年中にすべての SQL Data Warehouse にて無料でご利用いただけるようになります。
 

業界最先端のセキュリティ

SQL Data Warehouse は行レベル セキュリティ (RLS、英語) をネイティブにサポートしており、厳格なセキュリティ ポリシーを設定してきめ細かいアクセス制御を実装できます。今後は、データ ウェアハウスの再設計や再デプロイを行わなくても、セキュリティ ポリシーの変更やクエリ パフォーマンスに影響しない行レベル セキュリティの適用などが可能になります。データベース階層にきめ細かいセキュリティを実装し、Azure Active Directory とネイティブに統合することで、セキュリティ ポリシーを一元的に調整し、セキュリティ モデル全体の管理と制御を簡素化します。

SQL Data Warehouse は、仮想ネットワーク サービス エンドポイント (英語)、脅威検出、透過的なデータ暗号化などと組み合わせることができ、さらに 40 以上の国と地域や業界独自のコンプライアンス要件に準拠しているため、最高レベルのセキュリティとコンプライアンスを追加コストなしで実現できます。
 

トップ クラスの開発ツールとインサイト

SQL Data Warehouse は、データ ウェアハウス管理者や開発者に最適なエクスペリエンスを提供するために、より高度なインサイトや自動化および管理のための最新ツールを活用できるようにしています。今回の最新機能では、先進的なデータ ウェアハウスを Azure で簡単にすばやく構築することができます。

SQL Data Warehouse 用 Visual Studio でプレビューを開始した、SQL Server Data Tool (SSDT、英語) は、非常に優れた開発エクスペリエンスを提供するツールです。バージョン管理のサポートが統合されており、継続的インテグレーションによるテストの自動化や変更済みスクリプトのワンクリックでのデプロイが可能です。データ ウェアハウスを実装する開発者は、ビジネス要件の進化に合わせてコーディングし、すばやくデプロイできます。また、堅牢な品質管理も継承されているため、運用環境に実装したシステムが差し戻されるといったことも防げます。

また、インテリジェント インサイト機能の拡張 (英語) により、複製したテーブルの情報に加え、適応型キャッシュや tempdb を活用するためのデータベース スキーマ最適化に関する詳細情報を提示できるようになりました。また、Azure Advisor と Azure Monitor が包括的な管理エクスペリエンスに統合されているため、データ ウェアハウス管理者はパフォーマンスに関するインサイトをシームレスに把握し、ソリューションを調整してすばやくパフォーマンスを強化できます。

SQL Server では、過去の実行時間に関するクエリ パフォーマンスのトラブルシューティングに、クエリ ストアが広く使用されてきました。今回、この機能を SQL Data Warehouse にも実装しました。これにより、プラットフォームで実行されているクエリ ワークロードを確認し、関連するクエリ プランと実行時間の統計を分析して、生産性に影響するパフォーマンス関連の問題を識別できるようになります。

データ ウェアハウスを最新状態に維持しデータ ソースの変化に対応するためには、更新とトランザクションのサポートが不可欠です。しかし、実行時間の長いトランザクションを中断すると、データベースの復旧処理に時間がかかることがあります。データベースの可用性を高めるために、SQL Data Warehouse に高速データベース復旧 (ADR、英語) を実装しました。ADR を使用すると、SQL Data Warehouse のデータベースの可用性が向上すると同時に、サービスの一時停止と再開を大幅に高速化することができます。

高度なトラブルシューティングを行う場合、ワンクリックで Azure Monitor の診断ログを統合できるため、実行済みや待機状態などクエリの使用状況に関するデータを取得して分析用にアーカイブすることも可能です。これらのログは、従来の SQL Data Warehouse の動的管理ビューの拡張版であるため、これまでと同じように確実に操作できます。
 

あらゆる分析を実現する Azure プラットフォーム

Azure SQL Data Warehouse は Azure Databricks、Azure Data Factory、Power BI とネイティブに統合されているため、最新のデータ ウェアハウス機能、高度な分析機能、リアルタイムの分析シナリオ (英語) などに対応した分析ソリューションを新規に開発する際に役立ちます。このたび、Azure Data Lake Storage Gen2 を SQL Data Warehouse に統合し、一般提供を開始します。これは、ミッション クリティカルな分析と AI ワークロードに最適化された唯一のクラウド規模のデータ レイクです。

マイクロソフト製およびサードパーティ製の 25 種類以上のデータ統合ツールや BI ツールを使用して、分析ソリューションを構築することができます。マイクロソフトは各ベンダーと提携しながら、従来のオンプレミスのデータ ウェアハウスを Azure で刷新できるよう、手順の合理化を進めています。このようなエコシステム全体での取り組みにより、既存のインフラストラクチャを利用して強力な分析ソリューションを構築し、より短期間で価値を創出できるようにしています。

• シアトルで開催された PASS Summit (英語) では、Azure SQL Data Warehouse の最新テクノロジをご紹介しています。
• 実際にデータ ウェアハウスを作成 (英語) し、Azure SQL Data Warehouse のパフォーマンスを体験してください。
• データ ウェアハウスの刷新に関する評価 (英語) は、無料でご利用いただけます。お気軽にマイクロソフトまでお問い合わせください。

Ноябрь-декабрь насыщен мероприятиями для ИТ-профессионалов. Присоединяйтесь, зовите коллег!
Будет интересно!

1. 24 ноября. Москва. Бесплатный однодневный тренинг, который проводится при поддержке Microsoft в рамках глобального ежегодного события Global Office 365 Developer Bootcamp 2018 - https://www.meetup.com/office365-moscow/events/256058788/
2. 27 ноября. Москва. Митап IoT Community: практика создания и развития IoT-компании - https://iot-community.timepad.ru/event/849921/
3. 8 декабря. Москва. IT Pro Community Conference. В докладах будут рассмотрены разные темы, как традиционные для IT Pro, так и наиболее обсуждаемые в последнее время, такие как Azure Machine Learning и Blockchain. - https://www.meetup.com/itproug/events/256450931/
4. 10 декабря. Москва. В DigitalOctober при поддержке MVP Community пройдет ежегодная конференция Azure Day Moscow 2018 - https://msmvp.timepad.ru/event/851743/
5. 15 декабря. Москва. AI & MR BOOTCAMP RUSSIA. AI & MR Bootcamp приходит в Россию! http://aibootcamp.ru

Hello all, my name is Seth Price and I am a Configuration Manager PFE. I recently had a customer with a large network environment and they wanted to enable Configuration Manager Peer Cache to help with network bandwidth optimization. They were looking for some reporting options to help determine where peer cache could benefit network utilization and what clients would be appropriate in these locations to enable as peer sources. This post provides custom report options to help identify peer cache source candidates and report on systems that are already configured as peer cache sources.

Background information

Peer Cache is a feature in Configuration Manager which expands on the capabilities of Branch Cache to optimize network utilization for content delivery. Peer Cache can be used to manage deployment of content to clients in remote locations.

https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/client-peer-cache

In a large network environment, it may be difficult to identify and track both subnets where Peer Cache could provide a benefit, and the best client options for enabling Peer Cache content sources in that subnet. Some of the considerations in this decision would include:

Enabling Peer Cache on subnet:

• Number of workstation on subnet
• Network location (Connection speed to DP in boundary group)

Enabling a client as a Peer Cache source

• Client OS
• CCM client version (Does it support Peer Cache)
• Network Connection type (Wired vs Wireless)
• System chassis type
  • Example –Chassis type = 3,6, or 7 (Desktop, Mini Tower, or Tower)

    This would exclude systems types you may not want to use as a content source such as laptops, notebooks, hand helds and All in One systems.

• Available system drive space

Here are a few examples of creating custom reports to assist customers with managing Peer Cache.

***Report requirements***

1. Hardware inventory classes

   Hardware inventory will need to be configured to collect the following WMI classes:

   1. Rootccmsoftmgmtagent (CacheConfig) Specifically class 'Size'

      Required to get the CCM cache size on systems

   2. Rootccmpolicymachineactualconfig (CCM_SuperPeerClientConfig) Specifically class 'CanBeSuperPeer'
   3. System Enclosure (Win32_SystemEnclosure) –Chassis Types

1. Update AD System Discovery to add the following AD attribute "OperatingSystem"

*Note – Instructions for configuring requirements including system discovery and hardware inventory are at the end of this post.

Download the .rdl files for both custom reports here:

https://github.com/setprice2245/Peer-Cache

Report 1

PE Peer Cache Candidate Dashboard

This report lists the AD sites and the number of subnets associated with each site. Expanding the site and specific subnet will provide details on the client count in that site and the number of Peer Cache content source candidates.

The details of the client in that site are listed and color coded for Peer Cache candidate status.

Green = (Peer Cache is already enabled)

Blue = (System meets to criteria to be recommended as a Peer Cache candidate)

Gray = (System does NOT meet criteria for Peer Cache candidate)

In this report the client system must meet the following criteria to be displayed in BLUE for Peer Cache capable.

Note- The data used for candidate criteria is based on hardware inventory. Based on hardware inventory configuration this data may or may not be current (Default hardware inventory is 7 days)

• OS version (Like %Windows% NOT like %Server%)
• Ethernet connection (Adaptertype0) = 'Ethernet 802.3'
• IPAddress0 like '%.%.%.%' (Not Null)
• Free space on system drive is > 20 GB
• CCM Client is Active
• Client version 5.00.8540.1000 or later
• Chassis type in (3,6,7) – Desktop, Min Tower, or Tower

Note: The attached report will not list Server operating systems but I do have them enabled for display in the example report screenshot.

Report 2

PE Peer Cache Enabled Clients

This report lists all systems that have the Peer Cache client enabled and system details such as chassis type, free system drive space, CCM cache size, client status, Client version, OS name, AD site, and default gateway

Configuring system discovery and hardware inventory requirements

1. In the Config Mgr console under Administration > Hierarchy Configuration > Discovery Methods > Active Directory System Discovery > Properties > Add attribute operatingsystem
   

   Then start a system discovery

2. Add required classes to hardware inventory.

   Under Administration > Client Settings > Modify the Default Client Setting

   Edit Hardware inventory and click Set Classes…
   

   Add System Enclosure (Win32_SystemEnclosure) class = Chassis Types as shown below

   For the next classes, select Set Classes…, then select Add.
   

   Click Connect

   Under WMI namespace type Rootccmsoftmgmtagent and select Recursive as shown below.

   *Note – You may need to run the Config Mgr console as administrator to have access.

   Select CacheConfig and select OK

   Back in hardware inventory classes, find CacheConfig (CacheConfig) and select the Size class as shown.

   1. Repeat this process to add class Rootccmpolicymachineactualconfig (CCM_SuperPeerClientConfig) -Specifically class 'CanBeSuperPeer'

   After we have added the new hardware inventory classes to the default client settings policy, we need to run a machine policy evaluation on a clliented system, then run a hardware inventory to update the database.

   Next, we can browse to our report server website and import the .rdl files included in this post.

   *Note- Make sure to edit the report and change the data source to your database.

Thank you for reading this post, you should now be able to run both custom reports. Please provide feedback if the reports are useful or if you would like to see additional data in either of the reports.

The Email Phishing Protection Guide is a multi-part blog series written to walk you through the setup of many security focused features you may already own in Microsoft Windows, Microsoft Office 365, and Microsoft Azure. By implementing some or all of these items, an organization will increase their security posture against phishing email attacks designed to steal user identities. This guide is written for system administrators with skills ranging from beginner to expert.

Introduction: Email Phishing Protection Guide - Enhancing Your Organization's Security Posture

Part 1: Customize the Office 365 Logon Portal

Part 2: Training Users with the Office 365 Attack Simulator

Part 3: Deploy Multi Factor Authentication (MFA)

Part 4: Deploy Windows Hello

Part 5: Define Country and Region Logon Restrictions for Office 365 and Azure Services

Part 6: Deploy Outlook Plug-in to Report Suspicious Emails

Part 7: Deploy ATP Anti-Phishing Policies

Part 8: Deploy ATP Safe Link Policies

Part 9: Deploy ATP Safe Attachment Policies

Part 10: Deploy and Enforce Smart Screen for Microsoft Edge, Microsoft Internet Explorer and Google Chrome

Part 11: Monitor Phishing and SPAM Attacks in Office 365

Part 12: Discover Who is Attacking Your Office 365 User Identities

Part 13: Update Your User Identity Password Strategy

Part 14: Prevent Brute Force and Spray Attacks in Office 365

Part 15: Implement the Microsoft Azure AD Password Protection Service (for On-Premises too!)

Part 16: Disable Office 365 Legacy Email Authentication Protocols

Part 17: Control Application Consent Registrations in Microsoft Office 365 and Microsoft Azure

Part 18: Increase Security with Microsoft Secure Score

Part 19: Email Phishing Protection Security Checklist

Part 20: Recommended Security and Anti-Phishing Training from Microsoft Ignite 2018

Part 18: Increase Security with Microsoft Secure Score

While this blog series has provided a large amount of configuration options to consider implementing in your organization this is definitely not a complete list. In fact, the list of recommendations and possible configuration options will always continue to grow! So how do you evaluate all of the existing and yet to be released settings so your security posture continues to be elevated? The answer is by using Microsoft Secure Score!

Microsoft Secure Score is a feature offered to every tenant in Office 365 as a window to evaluate and improve the overall cloud security posture of your organization. In a practically limitless realm of features, products, and opportunity in Microsoft Office 365 and Azure, Microsoft has designed this first of its kind scoring system to help you make adjustments in your cloud environment be more secure. The score represents a weighted value of how the security related features in your organization are configured according to Microsoft Best Practices.

Microsoft Secure Score provides valuable insights into your cloud environment so that you know what is going on. What I often recommend to customers is that it be used to drive awareness in the correct configuration options for each of the products they are subscribed to. With literally thousands of configuration options, how would any administrator know about all the potential configurations, what the best practices are and then how to configure them? Microsoft Secure Score takes care of this in an easy to use, rich graphical format that displays everything I would need to know as an administrator. I also recommend that customers use it for a self-assessment of their security posture.

There is a Secure Score API that can be used to import the available data in a SIEM or other type of dashboard. Information about the API is located at: https://aka.ms/ScureScore_APIBlog

If you want to quickly raise your Microsoft Secure Score and greatly increase the security posture of your organization, the number one thing you should do is enable Multi-Factor Authentication (MFA) for your administrator/privileged accounts. If you don't take any other action from Microsoft Secure Score, do this! This is the first item to do in both the Microsoft Secure Score and Identity Secure Score.

Microsoft Secure Score

Below is information about how to access the Microsoft Secure Score area and a highlight of several of the features available in the site. This is not an exhaustive list of features available, but rather just a few items to get you started. Additional information about Microsoft Secure Score is located here.

1. Logon to https://securescore.microsoft.com. This is a direct link to your Microsoft Secure Score. This area can also be accessed using the Security and Compliance Center in the Microsoft Office 365 Portal.
2. When logged in, you can see the overall security score of your organization…front and center! This is a screen capture of my demonstration tenant where my score is 188/716. While this may seem bad, it is far better than the average score across all cloud tenants that was, as of November 19, 2018, a value of 33.

3. As you scroll down, you will find a number of actions in the queue to consider doing.

4. Expanding each of the actions listed will provide a wealth of information as shown below when I expanded the first item: Require MFA for Azure AD privileged roles.

5. Above the list of action items is a slider bar that will allow you to help define a target score. Remember there are a lot of action items you may choose, but do not feel compelled to take all actions. Evaluate each item and implement them based on what is appropriate for your organization.

6. At the top of the screen are two tabs, Dashboard and Score Analyzer. Using the Score Analyzer tab you can track your progress over a period of time. This information can be invaluable to provide to a security team or auditor of your environment. Consider using the Export option in the upper right of the screen as well.

   Microsoft Identity Secure Score

   The Microsoft Secure Score area above includes information available in this next section called the Identity Secure Score. You can evaluate the Identity Score in detail using the steps below. More information on Identity Secure Score is available here.

7. To access your Identity Secure Score, logon to https://portal.azure.com
8. Click Azure Active Directory

9. Under the Security section, click Identity Secure Score (Preview(as of November 2018)).

10. In the Identity Secure Score area, you will find your calculated score, comparison to other tenants in your industry, the trend of your score over the last 90 days, and a list of Improvement Actions to consider implementing.

1. Clicking on an action in the Improvement Action list will open a new blade of very detailed information.

1. Using the download option in the Improvement Action will generate a CSV file that can be used for additional data point tracking and sorting. Below is a sample download of the demonstration tenant information.

1. To change the industry type used to evaluate your organization's Identity Secure Score:
   1. Click on the Change Industry option

   2. The Security and Compliance Center will now load and log you in.
   3. Locate the Service Assurance section. Then click on Update Industry and Geography Settings.

   4. In this section choose the Region and Industry you would like to be compared against.

   5. Click Save when complete. Then refresh your Identity Secure Score area as well as the Microsoft Secure Score area.

I find there is much confusion around this topic, so I'll try to clear it up here.

First off, non-imported profiles are well… not imported. They were not created by Profile Sync / AD Import / Sync with External Identity Manager. We also refer to these as "unmanaged", or "stub" profiles because they typically only contain the minimum amount of user data -- usually just the users account name.

Note: in this article, I will use the terms profile import / profile sync interchangeably. For our purposes here, it does not matter whether AD Import or FIM Sync is used to get profiles into SharePoint.

Where do they come from?

There are a few ways to create user profiles that are "unmanaged". I will list them here from most common to least:

1. Users just browsing to their profile page or mysite. If a user tries to access any user profile-related pages, and they don't already have a user profile in the UPA, one will be created for them automatically. This will be a "stub" profile with a limited set of data for the user.
2. From a different farm or different UPA. You example, maybe you had profiles imported in a SharePoint 2013 farm. If you then migrate that UPA to a 2016 farm, but you don't select all the same OUs / containers that you had in the 2013 farm, all of the users that live in the containers you missed will become "unmanaged profiles".
3. Created programmatically. You can use PowerShell or object model code to create user profiles. Unless you are also filling in additional data at creation time, these will be "stub"-looking profiles as well.
4. By a 3rd party. This is really just a variation of #3, but 3rd party solutions (Newsgator comes to mind in particular) can create profiles programmatically.

What's the harm?

There's not much really. The main ticket generator that we see is that someone will notice that a certain users profile shows up in people search results, or in the organization chart, or somewhere else unexpectedly. They may be considered "unexpected" for one of several reasons:

• They are not in an OU selected for import / sync.
• They are deleted or disabled in Active Directory.
• They should be subject to an import / sync connection filter.

A second scenario we see is that a profile that belongs to a valid user will not be getting any updates from Active Directory. For example, their title changes in AD, but stays the same in their user profile. This will happen if their profile is "unmanaged". Since it's not being Synched, it won't get any updates from AD.

What to do?

Depends on what your goal is for these profiles. You're typically going to have one of these two objectives:

I -- Turn them into managed profiles so profile import / sync can update and maintain them.

If you intended these user profiles to be imported, but they weren't (and therefore were created as "stub" profiles) then you need to start by determining why they were not imported We also refer to this condition as being "out of scope" for the import. There are only a few reasons:

1. They are in an OU that is not included in the import connection. No really, go double-check the distinguished name of the user in question, and compare against the OUs selected in your import connection. -- I've seen too many assumptions on where the user currently exists in AD and what the connection should be importing.

   Seriously, don't assume, go check. You can use the following PowerShell to look up a given user and output their Distinguished Name (DN):

   $accountName = "josh"
   

   $prop = ([adsisearcher]"samAccountName=$($accountName)").FindOne().Properties
   

   $prop.displayname
   

   $prop.distinguishedname
   

    

   The output will look something like this:

   Josh Roark
   

   CN=Josh Roark,OU=Admins,OU=MyUsers,DC=joroar,DC=local
   

    

   The part of the DN starting with "OU" indicates the container this user exists in. You need to select that container ("Admins"). Selecting its parent container ("MyUsers") by default, will also select any child containers and will also result in the user being imported.

2. They are subject to an import connection filter. This is one place where there is a significant difference between FIM Sync and AD import. The filtering is done entirely differently. AD Import uses a standard LDAP filter, so you can use tools like LDP.exe or LDAP Explorer to verify whether or not the filter in place should return the user. With FIM Sync, exclusion filters are used, so it's a matter of understanding the filters and checking against the AD attribute values for the user.

    

3. This is rare, but there is a known issue where if the LastKnownParent attribute is set on the user in Active Directory, it could result in the user not being imported. Read more here: https://support.microsoft.com/en-us/help/313301

Note: It is not necessary to delete these "stub" profiles first. If a profile was first created as a "stub" / "unmanaged" / "non-imported" profile, but then later profile import / sync pulls that user in, the existing profile will be updated by the sync, and will become a "managed" profile from that point forward.

II -- Remove them.

If you don't want these profiles around, then you need to take some action to get rid of them.

Number one, you should not be looking to profile import / sync to fix this for you. Remember, these profiles were not imported, so the profile sync process does not manage them at all. In general, if profile sync did not create the profile, it can't delete it either.

Get a list of non-imported profiles. This is rather easy. Just run PowerShell like this:

$upa = Get-spserviceapplication | ?{$_.typename -match "profile"}

Set-SPProfileServiceApplication $upa -GetNonImportedObjects $true | out-file c:tempNonImportedProfiles.txt

Then go have a look at the NonImportedProfiles.txt file.

The GetNonImportedObjects flag will only return unmanaged / "stub" profiles. If a user account is in this list, it means they were most certainly not imported, so if there's any question as to whether or not a certain user has been imported by AD Import / Sync, these results should be definitive.

If the contents of NonImportedProfiles.txt looks like the list of user profiles you'd like to remove, then you can run this:

$upa = Get-spserviceapplication | ?{$_.typename -match "profile"}

Set-SPProfileServiceApplication $upa -PurgeNonImportedObjects $true

Please note that this is all or nothing. The PurgeNonImportedObjects command will mark all of the profiles for deletion that GetNonImportedObjects returned. If there are legitimate user profiles returned by GetNonImportedObjects, then you should see the "Turn them into managed profiles…" section above for ideas on how to get them imported.

PurgeNonImportedObjects does not immediately delete the non-imported profiles. It just marks them for deletion (bdeleted = 1 in the UserProfile_Full table of the Profile database). Once they have been marked for deletion, it is the responsibility of the "My Site Cleanup Job" timer job to remove them, which is no different for "managed" profiles that have been marked for deletion by profile import / sync.

The Email Phishing Protection Guide is a multi-part blog series written to walk you through the setup of many security focused features you may already own in Microsoft Windows, Microsoft Office 365, and Microsoft Azure. By implementing some or all of these items, an organization will increase their security posture against phishing email attacks designed to steal user identities. This guide is written for system administrators with skills ranging from beginner to expert.

Introduction: Email Phishing Protection Guide - Enhancing Your Organization's Security Posture

Part 1: Customize the Office 365 Logon Portal

Part 2: Training Users with the Office 365 Attack Simulator

Part 3: Deploy Multi Factor Authentication (MFA)

Part 4: Deploy Windows Hello

Part 5: Define Country and Region Logon Restrictions for Office 365 and Azure Services

Part 6: Deploy Outlook Plug-in to Report Suspicious Emails

Part 7: Deploy ATP Anti-Phishing Policies

Part 8: Deploy ATP Safe Link Policies

Part 9: Deploy ATP Safe Attachment Policies

Part 10: Deploy and Enforce Smart Screen for Microsoft Edge, Microsoft Internet Explorer and Google Chrome

Part 11: Monitor Phishing and SPAM Attacks in Office 365

Part 12: Discover Who is Attacking Your Office 365 User Identities

Part 13: Update Your User Identity Password Strategy

Part 14: Prevent Brute Force and Spray Attacks in Office 365

Part 15: Implement the Microsoft Azure AD Password Protection Service (for On-Premises too!)

Part 16: Disable Office 365 Legacy Email Authentication Protocols

Part 17: Control Application Consent Registrations in Microsoft Office 365 and Microsoft Azure

Part 18: Increase Security with Microsoft Secure Score

Part 19: Email Phishing Protection Security Checklist

Part 20: Recommended Security and Anti-Phishing Training from Microsoft Ignite 2018

Part 19: Email Phishing Protection Security Checklist

Now that you have read about the many features in Microsoft Office 365 and Microsoft Azure to secure your environment, it is now time to implement these items. So how do you do it? What is the most important item you can implement now that will be the least user impacting? Below, I have outlined an implementation plan example based on the topics in this guide.

As you review this guide and the implementation plan below, remember that in the world of security there is no finish line to reach a completely secure environment. This is a constantly evolving field where attack vectors are constantly changing. At Microsoft, the guiding principle of our security strategy is to "assume breach" where a team of more than 3,500 global security professionals identity and mitigate any attack on the Microsoft cloud environment. As outlined in this guide, you can raise the security posture of your organization even higher by adjusting settings in products you may already own in the Microsoft cloud.

Today

• Enable Multi-Factor Authentication (MFA) for your Administrator accounts
• Reduce the number of Administrator accounts to less than five
• Evaluate your Microsoft Secure Score and Microsoft Identity Score to identify additional security settings to implement
• Implement Advanced Threat Protection (ATP). Define all three policies: Anti-Phishing, Safe-Links, Safe-Attachments. If you do not currently own ATP, consider a 30 day trial.
• Discover who is attacking your Office 365 User Identities
• Review logs for Legacy Authentication activity
• Review reports for SPAM campaigns and identify the most targeted users

Two Weeks

• Deploy the Outlook Plug-In to Report Suspicious Email
• Block Legacy Authentication with a Conditional Access Policy
• Turn on Password Hash Sync
• Import Azure AD Logs into your SIEM systems

30 Days

• Communicate to users about the new Outlook Plug-In to Report Suspicious Email
• Begin designing a new user security training program
• Initiate Brute Force and Password Spray attack against your own users
• Initiate a simulated spear phishing attack
• Modernize your password policy with Azure Active Directory Password Protection
• Implement the Azure Geo-IP filter policy

90 Days

• Enable user risk policy
• Enable sign-in risk policy
• Review application consent permissions and prevent future permissions
• Implement Windows Hello
• Deploy Microsoft Smart Screen

The Email Phishing Protection Guide is a multi-part blog series written to walk you through the setup of many security focused features you may already own in Microsoft Windows, Microsoft Office 365, and Microsoft Azure. By implementing some or all of these items, an organization will increase their security posture against phishing email attacks designed to steal user identities. This guide is written for system administrators with skills ranging from beginner to expert.

Introduction: Email Phishing Protection Guide - Enhancing Your Organization's Security Posture

Part 1: Customize the Office 365 Logon Portal

Part 2: Training Users with the Office 365 Attack Simulator

Part 3: Deploy Multi Factor Authentication (MFA)

Part 4: Deploy Windows Hello

Part 5: Define Country and Region Logon Restrictions for Office 365 and Azure Services

Part 6: Deploy Outlook Plug-in to Report Suspicious Emails

Part 7: Deploy ATP Anti-Phishing Policies

Part 8: Deploy ATP Safe Link Policies

Part 9: Deploy ATP Safe Attachment Policies

Part 10: Deploy and Enforce Smart Screen for Microsoft Edge, Microsoft Internet Explorer and Google Chrome

Part 11: Monitor Phishing and SPAM Attacks in Office 365

Part 12: Discover Who is Attacking Your Office 365 User Identities

Part 13: Update Your User Identity Password Strategy

Part 14: Prevent Brute Force and Spray Attacks in Office 365

Part 15: Implement the Microsoft Azure AD Password Protection Service (for On-Premises too!)

Part 16: Disable Office 365 Legacy Email Authentication Protocols

Part 17: Control Application Consent Registrations in Microsoft Office 365 and Microsoft Azure

Part 18: Increase Security with Microsoft Secure Score

Part 19: Email Phishing Protection Security Checklist

Part 20: Recommended Security and Anti-Phishing Training from Microsoft Ignite 2018

Part 20: Recommended Security and Anti-Phishing Training at Microsoft Ignite 2018

While I have written many blogs in this Email Phishing Protection Guide about topics to help secure your environment, you may want to learn more. I encourage anyone looking for more information to search documentation available on https://docs.microsoft.com AND to watch recorded conference sessions on just about any topic or product from Microsoft.

I find that information presented at the many conferences Microsoft hosts or attends is some of the best information available. Instead of just learning about product features and implementation steps in the documentation, there is often a large amount of valuable information also presented at these conferences. I reviewed the catalog of more than 1200 sessions presented at Microsoft Ignite 2018 in Orlando, FL with a focus to learn more about the latest anti-phishing and security products and recommendations Microsoft offers. Below is that list, separated into two sections - Phishing Protection and Security.

I have listed the session code, title, link to the session in the Microsoft Ignite website, and finally the link to watch the session directly on YouTube. Yes, I have watched each one and highly recommend them. These are only the sessions I found in my review but remember that there are over 1200 sessions available to watch. All the Microsoft Ignite sessions are in this YouTube channel.

Microsoft Ignite 2018 Sessions:

• Phishing Protection
  • BRK4000 - Leveraging the power of Microsoft Threat Protection to secure the modern workplace across data, endpoints, identities, and infrastructure
    YouTube 75 minutes
  • BRK4002 Securing your Office 365 environment from Advanced Phishing Campaigns with Office 365 Advanced Threat Protection
    YouTube 45 minutes
  • BRK3031 Getting to a World Without Passwords
    YouTube 45 minutes
  • BRK3251 Shut the door to cybercrime with identity driven security
    YouTube 75 minutes
  • BRK3408 Azure AD Best Practices from Around the World
    YouTube 45 minutes
  • THR3047 Ensure all your users have strong passwords with Azure Active Directory Password Protection
    YouTube 20 minutes
  • THR3048 Credential Protection in the Password-less Era
    YouTube 20 minutes
  • THR2148 Experiences with going password-less
    YouTube 20 minutes
  • THR2018 Single Sign-on best practices for Azure Active Directory and Microsoft accounts
    YouTube 20 minutes
  • BRK3226 - Secure access to Office 365/Azure Active Directory with new features in AD FS in Windows Server 2019 and Azure AD Password Protection
    YouTube 45 minutes
  • THR2355 A World Without Passwords
    YouTube 20 minutes
  • BRK3037 Windows Devices and Azure Active Directory: What's new and what's upcoming
    YouTube 75 minutes
  • BRK2253 What's new for Windows Hello for Business
    YouTube 45 minutes
  • BRK2447 Cutting edge cyber security
    YouTube 75 minutes
  • BRK4010 Anatomy of an attack in Microsoft 365
    YouTube 45 minutes
  • THR4006 Raising Awareness and Education of Modern Threats to Office 365
    YouTube 20 minutes
  • BRK3148 Securing Exchange Online from Modern Threats
    YouTube 75 minutes
  • BRK4002 Securing your Office 365 environment rom advanced phishing campaigns with Office 365 ATP
    YouTube 45 minutes
  • BRK3272 Authentication and passwords: The good, the bad, and the really ugly!
    YouTube 45 minutes
  • THR2002 - Keeping your sensitive data secure in Office 365 with Data Loss Prevention (DLP)
    YouTube 23 minutes
  • THR2363 Don't get phished
    YouTube 16 minutes
  • THR4006 Raising awareness and education of modern threats to help reduce your organizations risk profile
    YouTube 20 minutes
  • BRK3279 So long and thanks for all the phishing email
    YouTube 45 minutes
• Security:
  • THR1097 Security is important to Small Businesses, too
    YouTube 20 minutes
  • BRK2482 End-end security for SMBs with Microsoft 365 Business
    YouTube 75 minutes
  • BRK3368 Successfully deploy Microsoft 365 Business in your SMB
    YouTube 45 minutes
  • BRK2158 Elevate the security for all your cloud apps and services with the Microsoft CASB - Cloud App Security
    YouTube 75 minutes
  • BRK3221 Combat advanced cyber attacks with Microsoft Cloud App Security
    YouTube 45 minutes
  • THR2130 Deploy and manage Cloud App Security in Office 365
    YouTube 20 minutes
  • THR3040 Dramatically improve your security posture through attack surface area reduction
    YouTube 20 minutes
  • THR2069 Raise your game as a security administrator with Windows Defender ATP
    YouTube 20 minutes
  • GS008 - Microsoft Security: How the cloud helps us all be more secure
    YouTube 20 minutes
  • THR2066 How Microsoft can save you X% on your EPP and EDR spend with Windows Defender ATP
    YouTube 20 minutes
  • BRK4000 Leveraging the power of Microsoft threat protection to secure the modern workplace across data, endpoints, identities, and infrastructure
    YouTube 75 minutes
  • BRK2020 Living in an Assume Breach world: What it means to run a secure Microsoft 365 cloud service and how you can apply these lessons to improve your security posture
    YouTube 70 minutes
  • BRK3411 Secure enterprise productivity with Office 365 threat protection services including EOP, ATP, and Threat Intelligence
    YouTube 75 minutes
  • THR3043 Secure administration across Microsoft Office and Azure Clouds
    YouTube 20 minutes
  • THR2346 How to mitigate the new cybersecurity threat
    YouTube 20 minutes
  • BRK3409 The future of threat protection: Become efficient, cost effective, and more secure with Office 365 Threat Intelligence
    YouTube 45 minutes
  • THR1070 Go from zero to hero using Azure Site Recovery: Surviving a ransomware attack
    YouTube 20 minutes
  • BRK4023 The rising risk of social engineering
    YouTube 20 minutes
  • THR2037 Comprehensive threat protection for Office 365
    YouTube 20 minutes
  • THR1096 Beware ransomware! How to mitigate risk with Windows 10 and Microsoft 365 security features
    YouTube 20 minutes
  • THR3088 How to onboard your clients to Windows Defender ATP
    YouTube 20 minutes

Hello Networking Enthusiasts - Tomorrow, the US will celebrate Thanksgiving and since we're so close to a holiday we decided to keep this week's blog fairly simple and answer some common questions and information we've seen over the last few months.

If you have follow-up questions you'd like answered (or more details on what's below), hit us up on Twitter @ Microsoft SDN!

RDMA and HCI

Q. Network traffic from Live Migrations takes valuable CPU cycles from my tenant VMs. How can I reduce the impact of a live migration for tenants, increase the number of live migrations I can perform, and/or increase the speed of the live migrations?

Answer from RDMA PM, Dan Cuomo:

Although not the default option, SMB can be selected as the live migration mechanism.  If selected, SMB can use RDMA under the hood (in this context, known as SMBDirect), which avoids the need to process the GB's (yes, Gigabytes not bits) of network traffic produced from the live migration (e.g VM Memory or VHDX Storage).

RDMA by-passes the host operating system and removes the processing burden of the live migrations.  Since host networking is most commonly constrained by host CPU spreading (remember your VMs are competing for access to the same cores processing network traffic), RDMA eases the effect of the live migration on VMs on the same host as they can now continue to focus on the VMs CPU scheduling needs.

The net effect is an increase to the number of live migrations you can perform at once because the CPU is no longer the bottleneck for the network or affecting your tenant VMs.

Software Defined Networking

Containers

Networking Diagnosis Tools