#Modern Workplace

When starting with a greenfield Microsoft 365 environment, Microsoft 365 Business Premium provides a surprisingly strong security foundation. You get Microsoft Entra ID P1, Intune, Defender for Business, Defender for Office 365 Plan 1 and Microsoft Purview capabilities as part of the subscription. However, one area I’m frequently asked about by customers is Microsoft Defender for Cloud Apps (MDC), specifically, what does it actually add to Microsoft 365 Business Premium? More importantly, what can you do with MDC in a brand-new, cloud-only environment? Let's discuss.. Business Premium and Cloud App Discovery Microsoft Entra ID P1 includes Cloud App Discovery at no additional cost. Cloud App Discovery provides visibility into cloud applications being used in an organisation. It analyses network and endpoint telemetry to identify the cloud applications being used within an organisation. The source of that data can vary depending on the environment and this is where things start to ge...

Indicator of compromise (IoCs) is an essential feature in every endpoint protection solution. This capability gives SecOps the ability to set a list of indicators for detection and for blocking. Back in August'21, I had published a blog on ' Creating custom Network Indicator rules in Defender for Endpoint '. As part of the MDE configuration series, I wanted to cover the creation of IoC for mobile devices as well. Now for IoC to work, devices need to be onboarded on MDE and it is no different for mobile devices. You can head over to my posts from February'22 to check out the onboarding process for both iOS and Android mobile devices. One thing to note here is that as of writing this blog, only IPs & URLs\domains under IoC are supported for mobile devices at this point. When creating a new indicator (IoC), one or more of the following actions are available: Allow – the IoC will be allowed to run on your devices. Audit – an alert will be triggered when the IoC runs. ...

Controlled folder access is a feature that helps protect your documents and files from modification by suspicious or malicious apps. It does so by checking apps against a list of trusted apps. This is particularly important during Ransomware attacks when user data can get encrypted which is normally found in common system folders. Here is a list of Windows system folders that are protected by default: c:\Users\<username>\Documents c:\Users\Public\Documents c:\Users\<username>\Pictures c:\Users\Public\Pictures c:\Users\Public\Videos c:\Users\<username>\Videos c:\Users\<username>\Music c:\Users\Public\Music c:\Users\<username>\Favorites The protected folders also include boot sectors and you can add more folders, allow specific apps access to the protected folders or exclude them all together. I recently dealt with one such application that needed to be allowed access to the protected folders. The app in question is Symantec Encryption Desktop. The first ind...

Picking up from my last post that covers details on enabling & creating Web Content Filtering rule in Defender for Endpoint, I will now cover the process for creating custom network indicator rules that can be used to supersede the Web Content Filtering categories. What are Indicators anyway? Defender for Endpoint can block malicious IPs/URLs through Windows Defender SmartScreen for Microsoft browsers, and through Network Protection for non-Microsoft browsers or calls made outside of a browser based on Microsoft's own threat intelligence data. By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs, or domains based on your organization's own threat intelligence. What are the pre-requisites for Indicators? Before one can go about setting up the rules, following pre-requisites must be met. 1. Network Protection to be enabled in block mode. 2. The Antimalware client version must be 4.18.1906.x or later. 3. Supported on machines on Windows 10,...