User Profile
dougsbaker
Brass Contributor
Joined Apr 03, 2020
User Widgets
Recent Discussions
Re: Generating alerts in test lab
MSFT Used to have some really good lab playbooks on this. It looks like they moved it off Prod Tech net and is only avaialble in Git Hub https://github.com/MicrosoftDocs/ATADocs/blob/master/ATPDocs/playbook-lab-overview.md https://github.com/MicrosoftDocs/ATADocs/blob/master/ATPDocs/playbook-reconnaissance.md https://github.com/MicrosoftDocs/ATADocs/blob/master/ATPDocs/playbook-lateral-movement.md Another option is to use the Built-in Simulation engine from MSFT. https://security.microsoft.com/tutorials/simulationsRe: Don't allow the Microsoft Authenticator app to popup with approval button
thomasrw thomasrw The Easiest way to disable this for your users is to go to Per-User MFA and disable it for the tenant. https://account.activedirectory.windowsazure.com/UserManagement/MfaSettings.aspx Disable Notifications through Mobile App. This will disable it for everyone. However, there are other options for you if you still want to keep notifications but make them more secure. Specifically Notifications Code Match. https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match you need to go to Azure AD to activate them, here is the link. https://portal.azure.com/#blade/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/AdminAuthMethodsRe: Disable approval popup in MS Authenticator app
thomasrw The Easiest way to disable this for your users is to go to Per-User MFA and disable it for the tenant. https://account.activedirectory.windowsazure.com/UserManagement/MfaSettings.aspx Disable Notifications through Mobile App. This will disable it for everyone. However, there are other options for you if you still want to keep notifications but make them more secure. Specifically Notifications Code Match. https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match you need to go to Azure AD to activate them, here is the link. https://portal.azure.com/#blade/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/AdminAuthMethodsRe: Mahcines not appearing in security portal even though they are registered in MEM
To have them show in security you additionally need to deploy an EDR policy to the endpoints. https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-security-edr-policy This will register them in Defender for Endpoint and have them appear in the Security portal. Make sure you additionally configure AV settings and security experience. https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-security-antivirus-policy Good Best Practice Guide https://thecloudtechnologist.com/2019/11/26/mdatp-best-practices/Re: Azure ATP Login Issue
Try going direct to your Tenant URL for Azure ATP. https://*instancename*.atp.azure.com. The instance name should be the same as your SPO Url. If that doesn't work you can go to the new defender URL for the Product. https://security.microsoft.com/settings/identities?tabid=sensorRe: What is the goal of the spoofing intelligence
This article does a pretty good job walking through the Anti-Spoofing Protection and how MSFT is working to defend against those threats. https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-worldwide The Tenant Allow/Block is all about the admin override of those technologies. https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/manage-tenant-allows?view=o365-worldwide Not 100 % but i suspect the goal is to move to the tenant and allow/block instead of using the traditional allow and block options in MDO. THis sis still the best practice i follow for doing allows. https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365?view=o365-worldwideRe: can't install AzureATP sensor on DC 2022, help with logs?
admin Administrator Definitely looks like a TLS issue. I would Double Check that the server can correctly communicate with your ATP portal using TLS1.2 https://gist.github.com/gpduck/db4f984435744e7dde1d I have used this tool in the past and it can be helpful. Just put in your ATP url EX org.atp.azure.comRe: Defender for Endpoint devices not showing up in security Portal
Think of it as the Management Plane vs the Security/Response plane. All your Security Configs need to happen in GPO/SCCM/Intune then some of the EDR advanced features/all of the response happens in the Security plane. This PDF is probably best at describing the connection. https://download.microsoft.com/download/5/6/0/5609001f-b8ae-412f-89eb-643976f6b79c/mde-deployment-strategy.pdf https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/deployment-strategy?view=o365-worldwideRe: Syncing 2 forest in Single Ad connect
This is a supported Topology. see the following article. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies#multiple-forests-single-azure-ad-tenant Essentially in AD Connect you need to go in to the connected directories and put the other forest there. Then it can use Password Hash sync or whatever other option you want. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-custom#connect-your-directories
