MCAS Policy Creation

EASchmitt 
Does this work for you?

Go to - 

Sunglasses (Investigate) -> Activity log -> Advanced (right corner)

1. "App" "equals" "Microsoft Exchange Online"
2. "Activity objects" "Item" "equals" "MailItemsAccessed"
3. "Location" "does not equal" "United States"

If this works, select -> new policy from search and create your policy. 

Other things that help:

1. In Azure Identity Protection
   1. Make sure you have a good policy for "User Risk Policy" and "Sign-in risk policy"
   2. https://portal.azure.com/#blade/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/UserPolicy
2. MFA w/conditional access policies
   
   1. Include:
      1. For all users
   2. Exclude:
      1. Backup Failsafe account
   3. CloudApps:
      1. Office 365 Preview
      2. Azure Management
   4. Conditions:
      1. Sign-in risk- High, Medium
      2. (Assuming no-one is using legacy auth methods) Client apps- Select All.
   5. Grant Access
      1. Require MFA.
3. Prevent legacy auth with or without conditional access.
   1. (via Exchange Online Powershell) For Users not using legacy methods (exclude service accounts using internal email services)
      1. Connect-EXOPSSESSION -UserPrincipalName [insert your email or admin email]
         1. Sign-In.
      2. New-AuthenticationPolicy "MFA Required" -AllowBasicAuthPop:$false \   -AllowBasicAuthSmtp:$false \   -AllowBasicAuthImap:$false \   -AllowBasicAuthWebServices:$false \  -AllowBasicAuthOutlookService:$false \  -AllowBasicAuthPowershell:$false \  -AllowBasicAuthReportingWebServices:$false \  -AllowBasicAuthRpc:$false \  -AllowBasicAuthMapi:$false \  -AllowBasicAuthAutodiscover:$false \  -AllowBasicAuthActiveSync:$false
      3. Set-User -User "Users actual name like 'John Smith'" -AuthenticatonPolicy "MFA Required"
   2. For Service Accounts (Set as needed, example SMTP/IMAP)
      1. New-AuthenticationPolicy "Legacy Service Accounts" -AllowBasicAuthPop:$false \   -AllowBasicAuthSmtp \   -AllowBasicAuthImap \   -AllowBasicAuthWebServices:$false \  -AllowBasicAuthOutlookService:$false \  -AllowBasicAuthPowershell:$false \  -AllowBasicAuthReportingWebServices:$false \  -AllowBasicAuthRpc:$false \  -AllowBasicAuthMapi:$false \  -AllowBasicAuthAutodiscover:$false \  -AllowBasicAuthActiveSync:$false
      2. Set-User -User "HP-MFP-0120" -AuthenticatonPolicy "Legacy Service Accounts"
      3. I'd recommend considering moving any accounts like a copier or scanner out of the office 365 environment and into a Amazon-SES if possible.

Hope this helps.