MCAS Policy Creation

[EASchmitt]

I have noticed an increasing number of accounts being compromised, without generating any alerts I have configured in the Microsoft Cloud App Security portal (Ie. Impossible travel activity)

Is there anyway to create an alert policy for "Run Command: task MailItemsAccessed" when it happens outside of the US?

For example the activity above would generate an alert because the task MailItemAccessed occurred in Japan. What would that policy look like in the MCAS portal?

[#2]

@EASchmitt 

Hi, you could first try changing the sensitivity of the Impossible Travel policy as shown below;

And then ensure you have your alerts configured as required.  Have you tried this already?

[#3]

@PeterRisingI did try this and I haven't seen any additional alerts being generated since. My main concern is the Impossible Travel policy is looking only at actual sign-in's. I believe what I'm looking to configure an alert for is a Task that is being performed in multiple locations that are considered impossible travel, but I have no idea if that is even possible to configure an alert for.

[#4 · Accepted solution]

@EASchmitt 
Does this work for you?

Go to - 

Sunglasses (Investigate) -> Activity log -> Advanced (right corner)

1. "App" "equals" "Microsoft Exchange Online"
2. "Activity objects" "Item" "equals" "MailItemsAccessed"
3. "Location" "does not equal" "United States"

If this works, select -> new policy from search and create your policy. 

Other things that help:

1. In Azure Identity Protection
   1. Make sure you have a good policy for "User Risk Policy" and "Sign-in risk policy"
   2. https://portal.azure.com/#blade/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/UserPolicy
2. MFA w/conditional access policies
   
   1. Include:
      1. For all users
   2. Exclude:
      1. Backup Failsafe account
   3. CloudApps:
      1. Office 365 Preview
      2. Azure Management
   4. Conditions:
      1. Sign-in risk- High, Medium
      2. (Assuming no-one is using legacy auth methods) Client apps- Select All.
   5. Grant Access
      1. Require MFA.
3. Prevent legacy auth with or without conditional access.
   1. (via Exchange Online Powershell) For Users not using legacy methods (exclude service accounts using internal email services)
      1. Connect-EXOPSSESSION -UserPrincipalName [insert your email or admin email]
         1. Sign-In.
      2. New-AuthenticationPolicy "MFA Required" -AllowBasicAuthPop:$false \   -AllowBasicAuthSmtp:$false \   -AllowBasicAuthImap:$false \   -AllowBasicAuthWebServices:$false \  -AllowBasicAuthOutlookService:$false \  -AllowBasicAuthPowershell:$false \  -AllowBasicAuthReportingWebServices:$false \  -AllowBasicAuthRpc:$false \  -AllowBasicAuthMapi:$false \  -AllowBasicAuthAutodiscover:$false \  -AllowBasicAuthActiveSync:$false
      3. Set-User -User "Users actual name like 'John Smith'" -AuthenticatonPolicy "MFA Required"
   2. For Service Accounts (Set as needed, example SMTP/IMAP)
      1. New-AuthenticationPolicy "Legacy Service Accounts" -AllowBasicAuthPop:$false \   -AllowBasicAuthSmtp \   -AllowBasicAuthImap \   -AllowBasicAuthWebServices:$false \  -AllowBasicAuthOutlookService:$false \  -AllowBasicAuthPowershell:$false \  -AllowBasicAuthReportingWebServices:$false \  -AllowBasicAuthRpc:$false \  -AllowBasicAuthMapi:$false \  -AllowBasicAuthAutodiscover:$false \  -AllowBasicAuthActiveSync:$false
      2. Set-User -User "HP-MFP-0120" -AuthenticatonPolicy "Legacy Service Accounts"
      3. I'd recommend considering moving any accounts like a copier or scanner out of the office 365 environment and into a Amazon-SES if possible.

Hope this helps.

[#5]

@Jonathan GreenThank you! I was just able to circle back around to this and the first part did exactly what I was looking for.

[#6]

@EASchmitt

‌‌Glad I could help!