TLS Deprecation Report

[AgnesAgnes]

How does the TLS Deprecation Report collect data?

[#2 · Accepted solution]

Magic. All the relevant information is already available in the message trace logs, the report is just summarizing it.

[#3]

How can we get TLS users from Message Trace Log?

[#4]

Not sure what you mean by "TLS users", but as I mentioned above every message trace event has the corresponding information readily available:

Message Trace ID : 21a25006-0ba9-4507-196a-08d688141c7f
Message ID       : <d2ea370052924cdc8cc1d6496cc2e062-JVKUGUBNKBZG6ZBNINMTE7CBKBCVQU2SIV6EM33SOVWXGTTPKJSXA3DZPRJW25DQ@microsoft.com>
Date             : 01/02/2019 07:08:48
Event            : Receive
Action           :
Detail           : Message received by: DB7PR03MB3914 using TLS1.2 with AES256
Data             : <root><MEP Name="ConnectorId" String="DB7PR03MB3914\Default DB7PR03MB3914"/><MEP Name="ClientIP" String="2603:10a6:10:72::16"/><MEP Name="ServerHostName"
                   String="DB7PR03MB3914"/><MEP Name="FirstForestHop" String="DB7PR03MB3914.eurprd03.prod.outlook.com"/><MEP Name="DeliveryPriority" String="Normal"/><MEP Name="ReturnPath"
                   String="maccount@microsoft.com"/><MEP Name="CustomData" Blob="S:ProxyHop1=AM5EUR02FT029.mail.protection.outlook.com(10.152.8.161);S:ProxyHop2=DB7PR03CA0075.outlook.office365.com(26
                   03:10a6:10:72::16);S:tlsversion=SP_PROT_TLS1_2_SERVER;S:tlscipher=CALG_AES_256;S:ProxiedClientIPAddress=207.46.200.12;S:ProxiedClientHostname=smtpi.msn.com"/><MEP
                   Name="SequenceNumber" Long="0"/></root>

[#5]

Sorry that I didn't make the question clear.

What I meant was how to get/filter TLS1.0 users by Message Trace Logs?  We cannot get the information for every message.  Are there any ways we can get TLS1.0 users except Deprecation Report?  Thanks.

[#6]

Sadly no. There is no way to get detailed information about which messages correspond to the data from the TLS deprecation widget, and Microsoft has no plans on actually adding such. So the only method is to go over each of the events in the message trace and check the details there.

[#7]

I still wonder how the date in TLS deprecated report is collected. Referring to your guidance, I understand that the TLS connection of a client can be found by message trace log/powershell. I have check the TLS connection of all my users. They all using TLS1.2 as found in message trace log similar to your screenshot.

However, when I download the TLS Deprecation Report from Secure Score Dashboard, it still shows a number of users still using TLS1.0/1.1. I have no clue how to figure out how this data be collected. Please advise. Thanks.

[#8]

Hi Guys,

Share my script for monitoring afectation after apply TLS deprecation:
https://github.com/Andresji321/MonitoringTLSErrorAzureAD

Good Luck!!!