Forum Discussion

EASchmitt's avatar
EASchmitt
Copper Contributor
Jul 15, 2020

MCAS Policy Creation

I have noticed an increasing number of accounts being compromised, without generating any alerts I have configured in the Microsoft Cloud App Security portal (Ie. Impossible travel activity)

 

Is there anyway to create an alert policy for "Run Command: task MailItemsAccessed" when it happens outside of the US?

For example the activity above would generate an alert because the task MailItemAccessed occurred in Japan. What would that policy look like in the MCAS portal?

Cloud App Security
policy
threat protection
  • Jonathan Green's avatar
    Jonathan Green
    Jul 17, 2020

    EASchmitt 
    Does this work for you?

    Go to - 

    Sunglasses (Investigate) -> Activity log -> Advanced (right corner)

    1. "App" "equals" "Microsoft Exchange Online"
    2. "Activity objects" "Item" "equals" "MailItemsAccessed"
    3. "Location" "does not equal" "United States"

    If this works, select -> new policy from search and create your policy. 

     

    Other things that help:

    1. In Azure Identity Protection
      1. Make sure you have a good policy for "User Risk Policy" and "Sign-in risk policy"
      2. https://portal.azure.com/#blade/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/UserPolicy
    2. MFA w/conditional access policies
      1. Include:
        1. For all users
      2. Exclude:
        1. Backup Failsafe account
      3. CloudApps:
        1. Office 365 Preview
        2. Azure Management
      4. Conditions:
        1. Sign-in risk- High, Medium
        2. (Assuming no-one is using legacy auth methods) Client apps- Select All.
      5. Grant Access
        1. Require MFA.
    3. Prevent legacy auth with or without conditional access.
      1. (via Exchange Online Powershell) For Users not using legacy methods (exclude service accounts using internal email services)
        1. Connect-EXOPSSESSION -UserPrincipalName [insert your email or admin email]
          1. Sign-In.
        2. New-AuthenticationPolicy "MFA Required" -AllowBasicAuthPop:$false \   -AllowBasicAuthSmtp:$false \   -AllowBasicAuthImap:$false \   -AllowBasicAuthWebServices:$false \  -AllowBasicAuthOutlookService:$false \  -AllowBasicAuthPowershell:$false \  -AllowBasicAuthReportingWebServices:$false \  -AllowBasicAuthRpc:$false \  -AllowBasicAuthMapi:$false \  -AllowBasicAuthAutodiscover:$false \  -AllowBasicAuthActiveSync:$false
        3. Set-User -User "Users actual name like 'John Smith'" -AuthenticatonPolicy "MFA Required"
      2. For Service Accounts (Set as needed, example SMTP/IMAP)
        1. New-AuthenticationPolicy "Legacy Service Accounts" -AllowBasicAuthPop:$false \   -AllowBasicAuthSmtp \   -AllowBasicAuthImap \   -AllowBasicAuthWebServices:$false \  -AllowBasicAuthOutlookService:$false \  -AllowBasicAuthPowershell:$false \  -AllowBasicAuthReportingWebServices:$false \  -AllowBasicAuthRpc:$false \  -AllowBasicAuthMapi:$false \  -AllowBasicAuthAutodiscover:$false \  -AllowBasicAuthActiveSync:$false
        2. Set-User -User "HP-MFP-0120" -AuthenticatonPolicy "Legacy Service Accounts"
        3. I'd recommend considering moving any accounts like a copier or scanner out of the office 365 environment and into a Amazon-SES if possible.

    Hope this helps.

  • PeterRising's avatar
    PeterRising
    MVP
    Jul 16, 2020

    EASchmitt 

     

    Hi, you could first try changing the sensitivity of the Impossible Travel policy as shown below;

     

     

    And then ensure you have your alerts configured as required.  Have you tried this already?

    • EASchmitt's avatar
      EASchmitt
      Copper Contributor
      Jul 16, 2020

      PeterRisingI did try this and I haven't seen any additional alerts being generated since. My main concern is the Impossible Travel policy is looking only at actual sign-in's. I believe what I'm looking to configure an alert for is a Task that is being performed in multiple locations that are considered impossible travel, but I have no idea if that is even possible to configure an alert for.

  • Jonathan Green's avatar
    Jonathan Green
    Brass Contributor
    Jul 17, 2020

    EASchmitt 
    Does this work for you?

    Go to - 

    Sunglasses (Investigate) -> Activity log -> Advanced (right corner)

    1. "App" "equals" "Microsoft Exchange Online"
    2. "Activity objects" "Item" "equals" "MailItemsAccessed"
    3. "Location" "does not equal" "United States"

    If this works, select -> new policy from search and create your policy. 

     

    Other things that help:

    1. In Azure Identity Protection
      1. Make sure you have a good policy for "User Risk Policy" and "Sign-in risk policy"
      2. https://portal.azure.com/#blade/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/UserPolicy
    2. MFA w/conditional access policies
      1. Include:
        1. For all users
      2. Exclude:
        1. Backup Failsafe account
      3. CloudApps:
        1. Office 365 Preview
        2. Azure Management
      4. Conditions:
        1. Sign-in risk- High, Medium
        2. (Assuming no-one is using legacy auth methods) Client apps- Select All.
      5. Grant Access
        1. Require MFA.
    3. Prevent legacy auth with or without conditional access.
      1. (via Exchange Online Powershell) For Users not using legacy methods (exclude service accounts using internal email services)
        1. Connect-EXOPSSESSION -UserPrincipalName [insert your email or admin email]
          1. Sign-In.
        2. New-AuthenticationPolicy "MFA Required" -AllowBasicAuthPop:$false \   -AllowBasicAuthSmtp:$false \   -AllowBasicAuthImap:$false \   -AllowBasicAuthWebServices:$false \  -AllowBasicAuthOutlookService:$false \  -AllowBasicAuthPowershell:$false \  -AllowBasicAuthReportingWebServices:$false \  -AllowBasicAuthRpc:$false \  -AllowBasicAuthMapi:$false \  -AllowBasicAuthAutodiscover:$false \  -AllowBasicAuthActiveSync:$false
        3. Set-User -User "Users actual name like 'John Smith'" -AuthenticatonPolicy "MFA Required"
      2. For Service Accounts (Set as needed, example SMTP/IMAP)
        1. New-AuthenticationPolicy "Legacy Service Accounts" -AllowBasicAuthPop:$false \   -AllowBasicAuthSmtp \   -AllowBasicAuthImap \   -AllowBasicAuthWebServices:$false \  -AllowBasicAuthOutlookService:$false \  -AllowBasicAuthPowershell:$false \  -AllowBasicAuthReportingWebServices:$false \  -AllowBasicAuthRpc:$false \  -AllowBasicAuthMapi:$false \  -AllowBasicAuthAutodiscover:$false \  -AllowBasicAuthActiveSync:$false
        2. Set-User -User "HP-MFP-0120" -AuthenticatonPolicy "Legacy Service Accounts"
        3. I'd recommend considering moving any accounts like a copier or scanner out of the office 365 environment and into a Amazon-SES if possible.

    Hope this helps.

Resources