Forum Widgets
Latest Discussions
RSS feeds to security blogs?
Hello, After the update of blogs here i no longer see any RSS feeds or links. Where can those RSS feed be found now? It was the only newsfeed where blogs could be aggregated. perhaps im just blind :) but i cant find the new RSS feeds. Thank you! Previously (before this weeks update) the links to those RSS feed was as follows: https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=MicrosoftSecurityandCompliance https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=Identity https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=CoreInfrastructureandSecurityBlog https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=AzureNetworkSecurityBlog https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=IdentityStandards https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=MicrosoftThreatProtectionBlog https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=MicrosoftDefenderCloudBlog https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=MicrosoftDefenderATPBlog https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=MicrosoftDefenderIoTBlog https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=DefenderExternalAttackSurfaceMgmtBlog https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=Vulnerability-Management https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=DefenderThreatIntelligence https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=MicrosoftSecurityExperts https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=Microsoft-Security-Baselines https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=MicrosoftSentinelBlog https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=MicrosoftDefenderforOffice365Blogjohn66571Nov 09, 2024Brass Contributor116Views9likes1CommentAdditional commonly asked Q&A related to ‘Device Fingerprinting’ in DFP continued
We're excited to keep our weekly spotlight series going on various topics within our Microsoft Fraud Protection Tech Community to help you maximize the benefits of Microsoft Dynamics 365 Fraud Protection (DFP). This week, we're continuing our focus on commonly asked questions about DFP 'Device Fingerprinting' which you can check out the Q&A details here: If you have any questions, please feel free to reach out in the Fraud Protection Tech Community. Your feedback is incredibly valuable to us. Best wishes, DFP Product Team ------------------ 1. Is device fingerprinting necessary? For DFP to provide the most accurate scores, device fingerprinting is highly recommended as it provides hundreds of device attributes. These critical attributes are used by DFP's machine learning to constantly improve the accuracy of your system. For more information, see the DFP Documentation site: Overview of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn 2. What is DFP Device Fingerprinting and how does it work? For a description of DFP Device Fingerprinting and how it works, please refer to the following DFP documentation: Overview of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn 3. What data isretained by DFP Device Fingerprinting and for how long? The data collected by the device fingerprinting feature is stored in a Microsoft designated data center closest to the location of the transaction source for up to 28 days. The data could also be stored along with the transaction that was sent against this profiling session in the customer’s selected geography, if the customer has opted in to storing data with DFP. (Note – for legacy Purchase assessment, data storage is not optional) 4. How can I tell if device fingerprinting has stopped for some reason? In Microsoft Dynamics 365 Fraud Protection, you can tell if device fingerprinting has stopped by monitoring the SSL certificate status and ensuring it is up to date. If the SSL certificate used for device fingerprinting is not renewed before its expiration date, device fingerprinting will stop collecting information. You should receive notifications regarding the SSL certificate for renewal status, as it is a critical component for the device fingerprinting service. Additionally, you can monitor the health and status of device fingerprinting through the Dynamics 365 Fraud Protection portal, which provides metrics that refresh near real-time. These monitors are designed to assist in detecting unusual transaction patterns or anomalies in observation events, such as fraud attacks and faulty rule releases. References: Overview of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Web setup of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Monitoring - Dynamics 365 Fraud Protection | Microsoft Learn 5. Outline the device profiling capabilities you support, if any. D365 Fraud Protection (DFP) supports probabilistic device identification, which involves returning an assigned device ID to the client along with device enrichment information. 6. What kind of device metadata can be gathered from the device being used? Data categories collected for web include: UserAgent information Canvas/WebGL data HTTP data Within and across session anomaly information IP, network, VPN and geo intelligence TCP Signature SSL/TLS Signature Client hints Javascript collected information like OS, processor, screen resolution, round trip time, etc. Data categories collected for iOS and Android include: Accelerometer and gyroscope data Location data Emulator and rooted information SIM card information Device specification data like advertising ID, screen size, total memory, screen refresh rate, build ID, etc. User preference data like is closed captioning enabled, is speak screen enabled, is haptic feedback enabled, etc. For a full list of attributes we collect across web, Android, and iOS, see Attributes in device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn. 7. How is the metadata evaluated to identify anomalies and create sticky identifiers for device recognition? D365 Fraud Protection (DFP) enriches the attributes collected from the device and runs these attributes through an embedding model, creating a vector representation of a device that remains sticky over time. DFP then checks similarity to determine device ID assignment. With device vectors, we can consistently identify returning devices. 8. What kind of challenges (e.g., CAPTCHAs) are invoked if suspicious activity is detected? D365 Fraud Protection (DFP) doesn't provide challenge capabilities in the product, however, clients can invoke different kinds of challenges that suit their own business needs (CAPTCHA, RECAPTCHA or MFA, for example), through a “challenge” decision based on the bot score rules they configure in our rule engine. 9. What if clients are using a device fingerprinting of their own and they would like to complement with MS DFP, could they use both? Yes, they could use both services. The client can integrate with DFP and their other device fingerprinting and use the data from both on their end. 10. In the portal UX for classic PP, can attributes returned by device fingerprinting only be used in the "Post Risk Scoring" clause section? No, you can reference @"deviceAttributes.trueIp" (for example; gets returned from Device Fingerprinting) in both types of rule clauses – Prior to Scoring, Post Risk Scoring – as this is different than generating a risk score.4Views0likes0CommentsMicrosoft Security Product Reviews on TrustRadius: Give product feedback & get rewarded!
We love hearing more about our customers’ experience with our products! We’re currently working on growing our product reviews of Microsoft Security products on TrustRadius. We would love for you to participate and share your thoughts, feedback, and experiences using Microsoft Security products to help others in their buying process. To provide feedback on the capabilities of the Microsoft Security products, please click on the link below. You will need to first log in to your TrustRadius account or take 30 seconds to create a free account. Here are some Guidelines and Tips for Reviewers & About TrustRadius Reviews - Frequently Asked Questions Once you have completed your review, you will receive a $25 USD (or local currency equivalent) digital gift card via email as a thank-you from TrustRadius for each in-depth review that you publish. Microsoft Entra ID Microsoft 365 Defender Microsoft Sentinel Microsoft Defender for Cloud Microsoft Defender for Endpoint The offer is good only for those customers who submit a product review on the above-mentioned site. Limit one per person The offer is non-transferable and cannot be combined with any other offer. This offer runs through December 31, 2023, or while supplies last, and is not redeemable for cash. Taxes, if any, are the sole responsibility of the recipient. Any gift returned as non-deliverable will not be re-sent. Microsoft reserves the right to cancel, change, or suspend this offer at any time without notice. This offer does not apply to customers in Cuba, Iran, North Korea, Sudan, Syria, Region of Crimea, Russia, and China Customers, Microsoft partners and MVPs are eligible to participate. Please see Microsoft Privacy Statement and TrustRadius Privacy Policy for more information.Trevor_RusherNov 08, 2024Community Manager3.5KViews4likes4CommentsInsider Builds
I have been an avid Microsoft user for many years with only a couple of small issues every now and again. The 6 weeks have been unbelievably stressful and disheartening. I thought trying samples of New Insider builds and enlisting in Azure for some up to date training for myself to help with what I wanted to roll out for my business. This has been the worst experience i have ever been apart of. I now have multiple computers and hardware in disarray but more importantly the loss of time and patience is paramount . I have come to realise the repetitive responses and requests for data collection on feedback or issues is one-sided The amount of user data submissions is not the issue though. It is the assistance from Microsoft regarding issue via portals, help-desk etc. The inclusion of many backend functions for the purpose of better user experience is heavily flawed. Unless end-user inadvertently has or encounters issues in there OS life is good. Heavily automated program tiggers sit through all OS builds for example. One drive. Regardless whether this is declined or removed it will always be running in the background. If you system had been compromised this is a perfect place for root-kit other Malware to spread. Xcopy: A Microsoft background function which has the ability clone and copy 99% of drivers of operating info structure. Can be controlled by ghost script directives or embedded dll to aid malware. Anti-virus or defender find difficulties identifying or distinguishing authentic and re-pro-ducted data. In time this type of incursion can mimic a vast amount of OS functionality. Microsoft OS validity. I have trailed numerous builds with all sharing this characteristic. Invalid or expired software and driver certificates & TPM flaws even after a full clean reset and TPM turned off in bios. Inevitably this can introduce compromised software without end-user knowledge. The impact leads to unauthorised access in many elements of the OS platform especially data access and embedded .dll which can run inline or above elevated authorisation. A lot of this is undetectable. Once embedded in OS and bios this is impossible to clean without expert assistance and can be very costly. For the most part the inclusion of new AI functionality across the OS platform is very welcomed. Unfortunately there are a large amount of bugs to be ironed out especially in the platform navigation. Advice provided via OS AI can be mis-leading or incorrect. .JaikayaNov 07, 2024Copper Contributor6Views0likes0CommentsMicrosoft account login error
Hello, I'm looking for a solution to my problem. I haven't been able to find one with hours of searching and trouble shooting. The error pops up after an attempt to sign into my account "Something went wrong please try again later. 0x8007000e." If there's anyone that can help me solve this error please reply to my discussion.IneedMc89276Nov 04, 2024Copper Contributor257Views2likes2CommentsIs a Digipass Go 6 compatible with MS MFA
I'm trying to setup a bunch of Digipass go 6's that my company has for some users. https://www.onespan.com/sites/default/files/2019-08/Digipass-GO6_tcm42-47370.pdf These are Duo branded hardware tokens. Is it possible to set them up with MS MFA instead of Duo https://duo.com/docs/administration-devices#managing-otp-hardware-tokens https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-oath-tokens The part I have yet to find is the base-32 secret.AdamA180Oct 31, 2024Copper Contributor165Views1like0CommentsWhitelisting domain in DLP policy
Does anyone know, if there is any way to whitelist a domain in DLP policy? The problem is that we are sharing documents from SPO site to a trusted partner domain and don't want to get the DLP warning messages for this, but at the same time don't want to take the whole site out of DLP's reach.SolvedPekka KarppinenOct 31, 2024Copper Contributor27KViews1like13CommentsSpotlight on Device Fingerprinting in DFP
We're thrilled to bring you a weekly spotlight on various topics within our Microsoft Fraud Protection Tech Community. This week, we're diving into the fascinating world of Device Fingerprinting in Microsoft Dynamics 365 Fraud Protection (DFP). Ever wondered how Device Fingerprinting works and how it can benefit you? Check out our detailed Q&A below where we answer all your burning questions about this innovative feature. If you have any questions or need further clarification on this topic, don't hesitate to reply to this thread in the Fraud Protection Tech Community. Your feedback is incredibly valuable to us. Best regards, DFP Product Team ------------------ 1. Do I really need device fingerprinting? Why is it important? Device fingerprinting is an essential feature in Microsoft Dynamics 365 Fraud Protection. It collects information about a computing device during online actions, which includes hardware, browser, geographic information, and IP address. This data is crucial as it helps the Fraud Protection service to track and link events in the fraud network, identifying patterns of fraud. The device fingerprinting feature uses artificial intelligence (AI) and machine learning to probabilistically identify devices, which can significantly improve the model detection rate for businesses by reducing false negatives. As a result, less fraud is detected on approved transactions after the fact. It's important to note that while device fingerprinting has a high accuracy, it is probabilistic and not deterministic, meaning there is a possibility of false positives. However, the benefits it brings to fraud detection and prevention are significant and can help protect businesses from fraudulent activities. References: Overview of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Set up device fingerprinting - Dynamics 365 Fraud Protection Web setup of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Attributes in device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn 2. We don't use Fingerprinting will DFP still work? Yes, Dynamics 365 Fraud Protection (DFP) will still function without device fingerprinting. However, its effectiveness in detecting fraud will be reduced. Device fingerprinting is a powerful feature that enhances the ability of DFP to identify and link events in the fraud network, thereby improving the detection of fraudulent patterns. Without it, DFP can still assess risk based on other factors, but the absence of device fingerprinting data means it likely won't be as accurate in identifying fraud. 3. How to do end to end device fingerprinting integration? Integrating end-to-end device fingerprinting in Microsoft Dynamics 365 Fraud Protection involves several steps to ensure that device data is accurately collected and assessed for fraud risk. Here's a high-level overview of the process: Set up DNS and Generate an SSL Certificate: Choose a subdomain under your root domain for device fingerprinting, such as fpt.yourcompany.com. Create a CNAME record that points to fpt.dfp.microsoft.com. Generate an SSL certificate for the subdomain and upload it to the Fraud Protection portal. Implement Device Fingerprinting: Your website or application must initiate device fingerprinting requests before a transaction is sent to Fraud Protection for risk evaluation. Modify the provided JavaScript code (see documentation) and insert it on the webpage or in the application where you want to collect device fingerprinting information. Enable Client-Side Integration: Ensure that the device fingerprinting script is correctly implemented and that the client-side integration is enabled to collect the necessary data. Test and Validate: After implementation, thoroughly test the device fingerprinting functionality to confirm that it is working as expected and that Fraud Protection is receiving the required data. Please follow the best practices and guidelines provided in the Microsoft documentation to ensure a successful integration. References: Overview of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Web setup of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Dynamics 365 Fraud Protection mobile SDK for iOS - Dynamics 365 Fraud Protection | Microsoft Learn Dynamics 365 Fraud Protection mobile SDK for Android - Dynamics 365 Fraud Protection | Microsoft Learn 4.What do I need to provide in order for Device Fingerprinting to work? To ensure Device Fingerprinting works effectively in Microsoft Dynamics 365 Fraud Protection, you need to provide the following: DNS Configuration and SSL Certificate: Select a subdomain under your root domain for device fingerprinting, such as fpt.yourcompany.com. Create a CNAME record that points to fpt.dfp.microsoft.com. Generate an SSL certificate for the subdomain and upload it to the Fraud Protection portal. Only .pfx files are supported, and if your certificate has a password, you'll need to enter it during the upload process. Device Fingerprinting Implementation: Your website or application must initiate device fingerprinting requests a few seconds before a transaction is sent to Fraud Protection for risk evaluation. This ensures that all necessary data is received for an accurate assessment. Modify the provided JavaScript code and insert it on the webpage or in the application where you want to collect device fingerprinting information. Client-Side Integration: Ensure that the device fingerprinting script is correctly implemented and that the client-side integration is enabled to collect the necessary data. Testing and Validation: After implementation, thoroughly test the device fingerprinting functionality to confirm that it is working as expected and that Fraud Protection is receiving the required data. Please follow the best practices and guidelines provided in the Microsoft documentation to ensure a successful integration. References: Web setup of device fingerprinting - Dynamics 365 Fraud Protection ... 5. Do we need to send IP address if we use Device Fingerprinting? In Microsoft Dynamics 365 Fraud Protection, the IP address is an optional field when using device fingerprinting. While it is not mandatory to send the IP address, providing it can enhance the accuracy of the fraud protection service. The IP address can be set in the deviceFingerprinting.ipAddress field for assessments, and it helps in identifying the geographic location and network information of the device, which can be valuable in fraud detection scenarios. References: Web setup of device fingerprinting - Dynamics 365 Fraud Protection ... 6. What is the difference btw 'device.ipaddress' and 'trueIp'? In Microsoft Dynamics 365 Fraud Protection, 'device.ipaddress' refers to the IP address that the merchant's website receives when a customer uses the site. This is typically the public IP address that the customer's device is using to access the internet. On the other hand, 'trueIp' is the actual IP address of the device as identified by device fingerprinting. It is used to assess the risk of fraud and is part of the device attributes collected during the fraud assessment process The 'trueIp' can be particularly useful in identifying fraud attempts because it can reveal if a customer is using a proxy or VPN to mask their actual IP address. This can be a red flag for fraudulent activity, as fraudsters often use such methods to hide their location and identity. 7. What is TrueIP? What is “IP address (via Merchant)”? Why is TrueIP blank, while “IP address (via Merchant)” is available? In Microsoft Dynamics 365 Fraud Protection, "TrueIP" refers to the actual IP address of the device identified by device fingerprinting, which is used to assess the risk of fraud. It is part of the device attributes collected during the fraud assessment process. The "IP address (via Merchant)" is the IP address that the merchant provides to Fraud Protection, which may be different from the TrueIP if, for example, the user is connected through a proxy or VPN. If "TrueIP" is blank, it could be due to several reasons such as the device fingerprinting data not being collected properly, the user using privacy features that prevent the collection of their true IP address, or simply that the TrueIP information was not available or not passed on at the time of the transaction. However, generally speaking, the true IP address is the one assigned to a device connected to the internet, while the IP address provided by the merchant could be the one they have on record for the transaction, which might be different due to the reasons mentioned above. References: View purchase protection schemas - Dynamics 365 Fraud Protection | Microsoft Learn 8.Any information collected beyond IP address? A detailed summary of what device fingerprinting attributes we attempt to collect for web, iOS, and Android can be found here: Attributes in device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn 9. How do I renew the DFP Device Fingerprinting SSL Green ID certificate? Multiple steps: Obtain a renewed certificate. These can be provided by whichever team within your organization manages certificates. Typically, these are IT, Security or Engineering. The certificate should be a .pfx file. Upload your certificate. From the DFP Portal, select "Integration" and "Enable device fingerprinting". For the renewal process instructions and further details, please refer to the Microsoft Learn Page: Web setup of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn 10.Does device fingerprinting work for different browsers and operating systems? Yes, DFP Device Fingerprinting works for different types of web browsers and operating systems. Below is more information on support and how to integrate: Web setup of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Dynamics 365 Fraud Protection mobile SDK for Android - Dynamics 365 Fraud Protection | Microsoft Learn Dynamics 365 Fraud Protection mobile SDK for iOS - Dynamics 365 Fraud Protection | Microsoft Learn Dynamics 365 Fraud Protection mobile SDK for React Native - Dynamics 365 Fraud Protection | Microsoft Learn197Views0likes0CommentsNew Blog | Introducing Lineage Tracking for Azure Databricks Unity Catalog in Microsoft Purview
ByKaran Shah We’re thrilled to announce the release of a highly anticipated feature inMicrosoft Purview: lineage tracking forAzure Databricks UnityCatalog. This marks a significant milestone in our ongoing efforts to enhance data governance and visibility across cloud environments. By leveraging this new functionality, users can now track data flow across their Azure Databricks notebooks, improving the ability to audit, monitor, and manage data movement. With data increasingly flowing through complex, cloud-native platforms like Azure Databricks, having clear, end-to-end visibility is crucial for compliance, troubleshooting, and operational excellence. Read the full post here:Introducing Lineage Tracking for Azure Databricks Unity Catalog in Microsoft Purview145Views0likes0CommentsLive response sessions and Zscaler
Has anyone managed to get live response sessions from Defender XDR working with Zscaler enabled? I have bypassed all necessary URLs from SSL inspection but still getting blocked from performing actions on live response. It is definitely Zscaler as when it's disabled live response works perfectly.880Views1like2Comments
Resources
Tags
- cloud security980 Topics
- security754 Topics
- microsoft information protection516 Topics
- azure496 Topics
- information protection and governance479 Topics
- microsoft 365412 Topics
- compliance386 Topics
- Microsoft Sentinel335 Topics
- Azure Active Directory238 Topics
- data loss prevention210 Topics