Add Privacy Scrub Service to Microsoft Defender?
Microsoft Defender protects accounts against phishing and malware, but attackers increasingly exploit nuisance data broker sites that publish personal information (names, emails, addresses). These sites are scraped to personalize phishing campaigns, making them harder to detect. I propose a premium Defender add‑on that automatically files opt‑out requests with major data brokers (similar to DeleteMe).
User app registration - exploitable for BEC?
Hello. Recently dealt with a case of BEC. I'm not trained in forensics, but doing my best. Appears the hacker used an application called eM Client for their attack, getting access to a user's mailbox and hijacking a thread. I can see the login from two weeks ago (the incident was only noticed a couple days ago, however) - from a European country that SHOULD have been blocked by Conditional Access. Come to find out, the tenant conditional access was unassigned from everyone. We're not sure how - we re-enabled it, and audited changes, but the only change that appears was us re-enabling it. Which I thought indicates it was never configured right, except we've got a ticket documenting a change to Conditional Access a couple days after the hack that ALSO does not appear in the logs. So... it's likely it was changed, yet I have no record of that change (atleast, not through Entra > Monitoring > Auditing). If anyone knows any other ways of checking this, please advise - but I can't seem to even access our Diagnostic settings, the page tells me I need an Azure Active Directory subscription (I'm on Entra ID P1, which includes AAD.... this might be related to being global admin, and not Security Admin - we don't use that role in this relationship) ANYWAY, my amateur forensic skills have found that the attacker used an app called eM Client to get access. I'm not sure yet how they obtained the password, and got past MFA... But quick research shows this application (esp it's pro version) is known for use in BEC. The app was registered in Entra, and granted certain read permissions in Entra ID for shared mailboxes, presumably to find a decent thread to hijack. I'm not 100% sure yet there was any actual exploit done using this app, but it's popularity amongst hackers implies it does SOMETHING useful (i think remember that it authenticates using Exchange Web Services instead of Exchange Online, or something similar? Will update when I have the chance to check). We're in the process of improving our Secure Score, and this incident makes me think user's ability to register apps should be locked down. Checked Secure Score for this, and while there ARE recommendations around apps, disabling user app registration is NOT one of them. Just curious about people's thoughts. I just barely understand App Registration in Entra, but if this is a known attack vector, I would think disabling app registration would be a security recommendation?Spotlight on ‘Velocities’ in Dynamics 365 Fraud Protection
We are excited to bring you our latest weekly spotlight series edition. This week, we are focusing on the frequently asked questions about ‘Velocities’ in DFP. Check out all the Q&A details below. Your input is invaluable, so please feel free to reply with any questions or for more information in the Fraud Protection Tech Community. Best regards, DFP Product Team 1. What are velocities in Microsoft Dynamics 365 Fraud Protection? While Lists, ML scores, and other payload attributes give you insight into the current event that is being processed, we also have velocities that will help you consider past behavior as well. Velocities give insights into historical patterns of an individual or entity. It helps answer questions like 'how many attempted transactions coming from the same emails? Or how many unique users or IP addresses? Or how many login attempts happened in a certain amount of time such as 5 or 10 minutes? Perhaps, I want to block anyone who tries to login into the web site more than 3 times in under ten minutes then I can do that. Velocities help identify patterns of events that occur over a period of time, which can be monitored to identify potentially fraudulent activity. By defining velocities, you can set thresholds to flag activities as suspicious when they exceed certain limits. References: Perform velocity checks - Dynamics 365 Fraud Protection | Microsoft Learn 2. How would someone use velocities in fraud protection? Velocities can be used in various ways, such as: Setting Rules: Define rules using velocities to automatically flag transactions that exceed predefined thresholds. Monitoring Patterns: Keep an eye on the frequency and volume of events associated with user accounts, payment instruments, or IP addresses. Investigating Anomalies: Use velocity data to investigate and understand unusual patterns that could indicate fraudulent behavior. References: Perform velocity checks - Dynamics 365 Fraud Protection | Microsoft Learn 3. Can you provide examples of velocities? Yes, here are a few examples: Total Spending Per User: This velocity tracks the sum of money spent by each user over a specified time frame. IP Address Usage: This velocity monitors the number of times an IP address is used to create new accounts. Device ID Checks: This velocity observes how often a particular device ID is used in transactions. References: Perform velocity checks - Dynamics 365 Fraud Protection | Microsoft Learn 4. Are there any system-defined velocities? Yes, Dynamics 365 Fraud Protection creates several system-defined velocities per environment, such as email, payment instrument, IP, and device ID velocities. These can be customized to fit the specific needs of your business. References: Perform velocity checks - Dynamics 365 Fraud Protection | Microsoft Learn 5. Why isn't my velocity rule being hit by some transactions even though the conditions are met? Microsoft D365 Fraud Protection is a distributed system. In a distributed system, events can happen concurrently and there is no sequence/order between them if they arrive at the same time. (For transactions that come in at the same time, DFP does not block one transaction for the other.) From a velocity standpoint, which would mean that multiple transactions sent at the same time can be considered the “first one” and in these cases can influence the aggregate count of the velocity. One potential way to mitigate this on the customer side would be for you to sequentially execute your transactions one by one (i.e., only send the next transaction after the previous one is done being processed), however this may not be a desired behavior as it would result in longer latencies for those transactions that get executed later. References: Perform velocity checks - Dynamics 365 Fraud Protection | Microsoft Learn 6. Do you recommend using device ID to set up a velocity rule? In Microsoft Dynamics 365 Fraud Protection, setting up velocity rules using device ID can be an effective method to identify suspicious activity patterns. For instance, velocity checks can help you spot patterns such as a single credit card quickly placing many orders from a single IP address or device, which might indicate potential fraud. You can define velocities using the SELECT, FROM, WHEN, and GROUPBY keywords, and device ID can be a useful attribute to GROUPBY in your velocity definition. It is important to tailor the velocity rules to the specific patterns and behaviors that are indicative of fraud in your business context. The device ID can be a valuable attribute to monitoring, especially if device-related fraud is a concern for your organization. Always ensure that the field you want to observe for velocity is part of the API call and consider the specific conditions and thresholds that are relevant to your business when defining these rules. References: Perform velocity checks - Dynamics 365 Fraud Protection Manage rules - Dynamics 365 Fraud Protection | Microsoft Learn 7. In the recommended rules, there are velocity-based rules. How did you set the threshold for those velocity-based rules? The threshold for velocity-based rules in Microsoft Dynamics 365 Fraud Protection is typically set based on historical data analysis and the specific fraud patterns observed within your organization. It involves identifying the normal transaction velocity for legitimate users and then setting thresholds that would flag transactions as suspicious when they exceed this normal velocity. It is important to continuously monitor and adjust these thresholds as fraud patterns evolve and as you gather more data on user behavior. Collaboration with your fraud management team and using machine learning models can also help in dynamically adjusting these thresholds to improve fraud detection accuracy. 8. Where can I find more information on setting up velocities? You can find detailed instructions and examples on the official Microsoft documentation site for Dynamics 365 Fraud Protection here: Perform velocity checks - Dynamics 365 Fraud Protection | Microsoft LearnAdditional commonly asked Q&A related to Search in DFP continued
Hello everyone, We are excited to continue our weekly spotlight series with a focus on frequently asked questions about DFP's Search feature. To assist you in navigating and optimizing this feature, we've compiled a comprehensive Q&A that you can find below. If you need further clarification or have additional questions, feel free to reply here in the Fraud Protection forum. We value your feedback and are here to help. Kind regards, DFP Product Team 1. What is Search and how does it work? In Microsoft Dynamics 365 Fraud Protection, the search functionality allows fraud investigators and support agents to locate and investigate specific transactions and associated data. This capability is essential for quickly resolving customer issues, analyzing fraudulent activities, and taking appropriate action. How it works: Initiate Search: The user navigates to the appropriate section (e.g., Purchase) and enters the search criteria in the search field. View Results: The system returns a list of transactions that match the search criteria. Users can click on any transaction to view expanded details. Investigate and Take Action: Based on the detailed information provided, fraud investigators can determine the legitimacy of a transaction and decide on the appropriate course of action, such as unblocking a customer or flagging a transaction for further review. References: Search - Dynamics 365 Fraud Protection | Microsoft Learn 2. How can I enable Search? To enable the Search feature in Microsoft Dynamics 365 Fraud Protection, you need to have Product Admin role permissions. Here are the steps to enable Search: Sign in to the Dynamics 365 Fraud Protection portal with your Product Admin role credentials. Go to Settings and select the Search tab. Toggle the switch to On to provision search for your Fraud Protection tenant. Once enabled, you can use the search to find and review transactions and events in Fraud Protection. Please note that you cannot turn off the search feature after enabling it. References: Search - Dynamics 365 Fraud Protection | Microsoft Learn 3. Are null values supported in search? In Microsoft Dynamics 365 Fraud Protection, null values are supported in search. The Is null operator can be used to find records that aren't required on payloads and with an unknown value: 1) not on the payload or 2) with a null value. Example: Search for payloads where a user ID value isn't required on the payload and unknown. References: Search - Dynamics 365 Fraud Protection | Microsoft Learn 4. When I exported a CSV it changed all the numbers to scientific notations. Why did this happen & how do I fix it? The issue you're experiencing with numbers changing to scientific notation in a CSV file is a common occurrence when opening CSV files in Excel. This happens because Excel automatically formats numbers that are longer than a certain length (usually more than 10 digits) into scientific notation to save space in the cell. Here's how you can fix it: Open the CSV with a Text Editor: If you open the CSV file with a text editor like Notepad, you will see the full numbers without scientific notation. This confirms that the CSV file itself is correct. Format as Text in Excel: When opening the CSV in Excel, you can prevent numbers from being displayed in scientific notation by formatting the cells as text before importing the data. Here's how: Open Excel and go to the "Data" tab. Choose "From Text/CSV" to import your CSV file. In the import wizard, select the column with the numbers. Change the column's data format to "Text". Finish the import process. Text to Columns Wizard: Another method is to use the Text to Columns wizard in Excel: Open the CSV file in Excel. Select the column with the scientific notation. Go to the "Data" tab and select "Text to Columns". Choose "Delimited" and click "Next". Uncheck all delimiters and click "Next". Select "Text" as the column data format and finish the wizard. Prevent Automatic Formatting: To prevent Excel from automatically formatting large numbers in scientific notation, you can also add an apostrophe (') before the number in the CSV file. This forces Excel to treat the number as text. Please note that these steps are general guidelines and the exact process may vary depending on the version of Excel you are using. 5. How long is search data available for? In Microsoft Dynamics 365 Fraud Protection, you can search for events and transactions within a timeframe of up to the past 13 months. References: Search - Dynamics 365 Fraud Protection | Microsoft Learn 6. Is there a cost for search to be on? Is there a downside to search being on? There is no cost or downside to enabling search. Note: You can't turn search off after you enable it. 7. Exporting data to CSV for analysis: can it be accessed or pushed to PowerPivot or similar so a large volume of data can be analyzed? Once the search data has been exported and downloaded as a CSV, the user can choose how to analyze this data, including pushing it to our tools like PowerPivot. DFP also supports event tracing if the user desires to export data regularly. Once the data has been traced to the data store defined, the customer can analyze this data in any way they choose. References: Search - Dynamics 365 Fraud Protection | Microsoft Learn Event tracing - Dynamics 365 Fraud Protection | Microsoft LearnAdditional commonly asked Q&A related to ‘Device Fingerprinting’ in DFP continued
We're excited to keep our weekly spotlight series going on various topics within our Microsoft Fraud Protection Tech Community to help you maximize the benefits of Microsoft Dynamics 365 Fraud Protection (DFP). This week, we're continuing our focus on commonly asked questions about DFP 'Device Fingerprinting' which you can check out the Q&A details here: If you have any questions, please feel free to reach out in the Fraud Protection Tech Community. Your feedback is incredibly valuable to us. Best wishes, DFP Product Team ------------------ 1. Is device fingerprinting necessary? For DFP to provide the most accurate scores, device fingerprinting is highly recommended as it provides hundreds of device attributes. These critical attributes are used by DFP's machine learning to constantly improve the accuracy of your system. For more information, see the DFP Documentation site: Overview of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn 2. What is DFP Device Fingerprinting and how does it work? For a description of DFP Device Fingerprinting and how it works, please refer to the following DFP documentation: Overview of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn 3. What data is retained by DFP Device Fingerprinting and for how long? The data collected by the device fingerprinting feature is stored in a Microsoft designated data center closest to the location of the transaction source for up to 28 days. The data could also be stored along with the transaction that was sent against this profiling session in the customer’s selected geography, if the customer has opted in to storing data with DFP. (Note – for legacy Purchase assessment, data storage is not optional) 4. How can I tell if device fingerprinting has stopped for some reason? In Microsoft Dynamics 365 Fraud Protection, you can tell if device fingerprinting has stopped by monitoring the SSL certificate status and ensuring it is up to date. If the SSL certificate used for device fingerprinting is not renewed before its expiration date, device fingerprinting will stop collecting information. You should receive notifications regarding the SSL certificate for renewal status, as it is a critical component for the device fingerprinting service. Additionally, you can monitor the health and status of device fingerprinting through the Dynamics 365 Fraud Protection portal, which provides metrics that refresh near real-time. These monitors are designed to assist in detecting unusual transaction patterns or anomalies in observation events, such as fraud attacks and faulty rule releases. References: Overview of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Web setup of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Monitoring - Dynamics 365 Fraud Protection | Microsoft Learn 5. Outline the device profiling capabilities you support, if any. D365 Fraud Protection (DFP) supports probabilistic device identification, which involves returning an assigned device ID to the client along with device enrichment information. 6. What kind of device metadata can be gathered from the device being used? Data categories collected for web include: UserAgent information Canvas/WebGL data HTTP data Within and across session anomaly information IP, network, VPN and geo intelligence TCP Signature SSL/TLS Signature Client hints Javascript collected information like OS, processor, screen resolution, round trip time, etc. Data categories collected for iOS and Android include: Accelerometer and gyroscope data Location data Emulator and rooted information SIM card information Device specification data like advertising ID, screen size, total memory, screen refresh rate, build ID, etc. User preference data like is closed captioning enabled, is speak screen enabled, is haptic feedback enabled, etc. For a full list of attributes we collect across web, Android, and iOS, see Attributes in device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn. 7. How is the metadata evaluated to identify anomalies and create sticky identifiers for device recognition? D365 Fraud Protection (DFP) enriches the attributes collected from the device and runs these attributes through an embedding model, creating a vector representation of a device that remains sticky over time. DFP then checks similarity to determine device ID assignment. With device vectors, we can consistently identify returning devices. 8. What kind of challenges (e.g., CAPTCHAs) are invoked if suspicious activity is detected? D365 Fraud Protection (DFP) doesn't provide challenge capabilities in the product, however, clients can invoke different kinds of challenges that suit their own business needs (CAPTCHA, RECAPTCHA or MFA, for example), through a “challenge” decision based on the bot score rules they configure in our rule engine. 9. What if clients are using a device fingerprinting of their own and they would like to complement with MS DFP, could they use both? Yes, they could use both services. The client can integrate with DFP and their other device fingerprinting and use the data from both on their end. 10. In the portal UX for classic PP, can attributes returned by device fingerprinting only be used in the "Post Risk Scoring" clause section? No, you can reference @"deviceAttributes.trueIp" (for example; gets returned from Device Fingerprinting) in both types of rule clauses – Prior to Scoring, Post Risk Scoring – as this is different than generating a risk score.Tackling frequently asked questions about the DFP ‘Search’ feature.
We're excited to bring you the latest installment of our weekly spotlight series! Our aim is to help you get the most out of Microsoft Dynamics 365 Fraud Protection (DFP) by diving into different topics within our Microsoft Fraud Protection Tech Community. This week, we're continuing to explore the frequently asked questions about the DFP Search feature. It's a great chance to deepen your understanding and enhance your use of this powerful tool. To check out all the Q&A details, please see below. – As always, we value your input and are here to support you. If you've got any questions or need further clarification, don't hesitate to reach out in the Fraud Protection Tech Community. Your feedback is very important to us, and we appreciate your engagement! Best wishes, DFP Product Team ----------- 1. Why can't I access DFP's search functionality? Search must be enabled in your DFP tenant before it can be used. This setting can only be enabled by someone with global admin permissions, and the setting is accessible by clicking the following: Gear Icon (top-right corner of the DFP portal) --> Admin settings --> Search --> Enable search. (Note: Once search has been enabled in your DFP tenant, it cannot be turned off.) References: Search - Dynamics 365 Fraud Protection | Microsoft Learn 2. My transaction is not showing up in search. What can I do? If your transaction is not showing up within the search UX, here are some steps you can take to troubleshoot the issue: Check Search Settings: Ensure that the search feature is enabled in your Dynamics 365 Fraud Protection portal. You must have Product Admin role permissions to enable search. Sign in with your credentials, go to Settings, select the Search tab, and make sure the switch is toggled to On. Select Event Type and Timeframe: When searching, first select the specific assessment you want to search against and then choose the timeframe you want to search across. You can search between any two dates within the past 13 months. Filter Events by Attribute: Use one or more attributes of the transactions to filter your search. You can search by attributes such as email address, DeviceID, or UserID. Review Assessment Configuration: Confirm that you have enabled search for your assessment by checking the Assessment configuration setting. Search will only find transactions that are processed after you enabled the search feature for your assessment. Check for Historical Transactions: Be aware that historical transactions sent before the search feature was enabled are not available in the search results. Note: The standalone Device Fingerprinting template does not support search, however all other Assessment templates do. References: Search - Dynamics 365 Fraud Protection | Microsoft Learn 3. How would a customer query data within the tool? Customers can query data within Microsoft Dynamics 365 Fraud Protection using the Search page, which helps find and view details about events based on specific filter values. Users can search for an individual event ID or use filters to find all transactions that match some criteria. The search results can be exported, or users can drill into an individual event to show a more detailed view. References: Search - Dynamics 365 Fraud Protection | Microsoft Learn 4. We just turned on Search in my DFP tenant, however past transactions aren't being returned that meet my Search criteria. Why? Search is forward-looking by design. This means you will only be able to conduct searches against those transactions that were processed after Search was enabled. 5. Does Search functionality inhibit any Azure resources or result in any performance degradation that would impact fraud decisioning? No, DFP's search feature does not inhibit any Azure resources or result in any performance degradation that would impact fraud decisioning. 6. How long is Search data stored? Search data is stored for 13 months. 7. Can I export Search data into a CSV table? Yes, you can export search data into a CSV file through the Search UX within the DFP portal. A maximum limit of 10,000 rows can be exported at one time. References: Search - Dynamics 365 Fraud Protection | Microsoft Learn 8. When exporting a search result with specific parameters, why is the exported file empty? If you are experiencing an issue where the exported file is empty when exporting a search result with specific parameters in Microsoft Dynamics 365 Fraud Protection, it could be due to a few reasons: Search Feature Not Enabled: Ensure that the search feature is enabled in your Dynamics 365 Fraud Protection portal. You must have Product Admin role permissions to enable search. If search was not enabled when the transactions were processed, they will not appear in the search results. Filter Criteria: Verify that the filter criteria used for the search are correct. If the filters are too restrictive or incorrect, it may result in no transactions matching the criteria, leading to an empty export file. Historical Transactions: Search will not display events that were sent prior to the search feature being turned on. If you are trying to export historical transactions that were sent before search was enabled, they won't be available. Export Options: When exporting, ensure you are selecting the correct export options. There are options to export all data associated with the event (all columns) or only data in the columns that are currently shown in the grid (current columns).. References: Search - Dynamics 365 Fraud Protection | Microsoft Learn 9. I'm trying to export from search. The Notification shows Preparing download, but it never completes the download. How can I fix this? If the notification in Microsoft Dynamics 365 Fraud Protection shows "Preparing download" but the download never completes, it could be due to a temporary service issue or a problem with the export process. Here are some steps you can take to troubleshoot and potentially resolve the issue: Retry the Export: Attempt to export the search results again. Sometimes, retrying the process can resolve temporary glitches. Review Export Parameters: Ensure that the search parameters and filters are set correctly and that they are not too broad, which could result in a large dataset that may take longer to export. Check File Size: If the dataset is very large, consider narrowing down the search criteria to reduce the file size, making it more manageable for export. Use a Different Browser: Try using a different web browser or clearing the cache of your current browser before attempting the export again. Check Service Health: Verify if there are any known issues with Dynamics 365 Fraud Protection by checking the service health in the Microsoft 365 admin center or Dynamics 365 Fraud Protection portal. References: Search - Dynamics 365 Fraud Protection | Microsoft Learn 10. Search export sends CSV files. How can I export XLS files in order to do analysis on thousands of transactions at once? In Microsoft Dynamics 365 Fraud Protection, the standard export format for search results is CSV, which is commonly used for its compatibility with various systems and ease of handling large datasets. If you need to export data into XLS format, please consider the following options: Convert CSV to XLS/XLSX: After exporting the data as a CSV file, you can use Excel to open the file and then save it as an XLS or XLSX file. This allows you to leverage Excel's analysis tools on the data. Use Power Query in Excel: Excel's Power Query feature can import data directly from a CSV file and transform it as needed. Once imported, you can then work with the data within Excel and save it as an XLS file.Today’s Fraud Protection Tech Community Live Event & Recording Link
Thank you very much to all who joined us at our Fraud Protection Tech Community Live event earlier today from 9am to 9:30am PST. We hope you found it to be useful and informative. For those who couldn't attend or if you’d like to revisit the session, don't worry! We've got you covered. You can catch up on everything by watching the event recording through the event page link below. During the livestream, we delved into the new Dynamics 365 Fraud Protection (DFP) Support Model and discussed how customers can effectively leverage our Customer Service and Support. Additionally, we highlighted the benefits of our newly launched Fraud Protection discussion forum in the Security, Compliance, and Identity HUB. We also provided a demo on how to best utilize and engage within the Microsoft Tech Community. You can find the link to the TCL event page with the recording here: Fraud Protection Tech Community Live! | Microsoft Community Hub Thank you for your time and for being part of this community. We look forward to seeing you at our next event! Best wishes, The DFP Product TeamReminder to join our Fraud Protection On-Camera AMA tomorrow at 9AM PST!
Learn more about improving your lines of defense with the Fraud Protection team! We will talk about some of the new assets that our customers can leverage, see some updates on the engagement model (Community Discussion Space, other ways to engage, etc.) and our experts are available to answer any other questions you might have! So tune in and get your fraud juices flowing. The event page is here to watch and ask questions: Fraud Protection Tech Community Live! | Microsoft Community Hub See you there!Fraud Protection Tech Community Live!
Learn more about improving your lines of defense with the Fraud Protection team! We will talk about some of the new assets that our customers can leverage, see some updates on the engagement model (Community Discussion Space, other ways to engage, etc.) and our experts are available to answer any other questions you might have! So tune in and get your fraud juices flowing. Ask your questions down below and the on-camera Subject Matter Experts will do their best to answer during the live session after their presentation!Spotlight on Device Fingerprinting in DFP
We're thrilled to bring you a weekly spotlight on various topics within our Microsoft Fraud Protection Tech Community. This week, we're diving into the fascinating world of Device Fingerprinting in Microsoft Dynamics 365 Fraud Protection (DFP). Ever wondered how Device Fingerprinting works and how it can benefit you? Check out our detailed Q&A below where we answer all your burning questions about this innovative feature. If you have any questions or need further clarification on this topic, don't hesitate to reply to this thread in the Fraud Protection Tech Community. Your feedback is incredibly valuable to us. Best regards, DFP Product Team ------------------ 1. Do I really need device fingerprinting? Why is it important? Device fingerprinting is an essential feature in Microsoft Dynamics 365 Fraud Protection. It collects information about a computing device during online actions, which includes hardware, browser, geographic information, and IP address. This data is crucial as it helps the Fraud Protection service to track and link events in the fraud network, identifying patterns of fraud. The device fingerprinting feature uses artificial intelligence (AI) and machine learning to probabilistically identify devices, which can significantly improve the model detection rate for businesses by reducing false negatives. As a result, less fraud is detected on approved transactions after the fact. It's important to note that while device fingerprinting has a high accuracy, it is probabilistic and not deterministic, meaning there is a possibility of false positives. However, the benefits it brings to fraud detection and prevention are significant and can help protect businesses from fraudulent activities. References: Overview of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Set up device fingerprinting - Dynamics 365 Fraud Protection Web setup of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Attributes in device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn 2. We don't use Fingerprinting will DFP still work? Yes, Dynamics 365 Fraud Protection (DFP) will still function without device fingerprinting. However, its effectiveness in detecting fraud will be reduced. Device fingerprinting is a powerful feature that enhances the ability of DFP to identify and link events in the fraud network, thereby improving the detection of fraudulent patterns. Without it, DFP can still assess risk based on other factors, but the absence of device fingerprinting data means it likely won't be as accurate in identifying fraud. 3. How to do end to end device fingerprinting integration? Integrating end-to-end device fingerprinting in Microsoft Dynamics 365 Fraud Protection involves several steps to ensure that device data is accurately collected and assessed for fraud risk. Here's a high-level overview of the process: Set up DNS and Generate an SSL Certificate: Choose a subdomain under your root domain for device fingerprinting, such as fpt.yourcompany.com. Create a CNAME record that points to fpt.dfp.microsoft.com. Generate an SSL certificate for the subdomain and upload it to the Fraud Protection portal. Implement Device Fingerprinting: Your website or application must initiate device fingerprinting requests before a transaction is sent to Fraud Protection for risk evaluation. Modify the provided JavaScript code (see documentation) and insert it on the webpage or in the application where you want to collect device fingerprinting information. Enable Client-Side Integration: Ensure that the device fingerprinting script is correctly implemented and that the client-side integration is enabled to collect the necessary data. Test and Validate: After implementation, thoroughly test the device fingerprinting functionality to confirm that it is working as expected and that Fraud Protection is receiving the required data. Please follow the best practices and guidelines provided in the Microsoft documentation to ensure a successful integration. References: Overview of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Web setup of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Dynamics 365 Fraud Protection mobile SDK for iOS - Dynamics 365 Fraud Protection | Microsoft Learn Dynamics 365 Fraud Protection mobile SDK for Android - Dynamics 365 Fraud Protection | Microsoft Learn 4. What do I need to provide in order for Device Fingerprinting to work? To ensure Device Fingerprinting works effectively in Microsoft Dynamics 365 Fraud Protection, you need to provide the following: DNS Configuration and SSL Certificate: Select a subdomain under your root domain for device fingerprinting, such as fpt.yourcompany.com. Create a CNAME record that points to fpt.dfp.microsoft.com. Generate an SSL certificate for the subdomain and upload it to the Fraud Protection portal. Only .pfx files are supported, and if your certificate has a password, you'll need to enter it during the upload process. Device Fingerprinting Implementation: Your website or application must initiate device fingerprinting requests a few seconds before a transaction is sent to Fraud Protection for risk evaluation. This ensures that all necessary data is received for an accurate assessment. Modify the provided JavaScript code and insert it on the webpage or in the application where you want to collect device fingerprinting information. Client-Side Integration: Ensure that the device fingerprinting script is correctly implemented and that the client-side integration is enabled to collect the necessary data. Testing and Validation: After implementation, thoroughly test the device fingerprinting functionality to confirm that it is working as expected and that Fraud Protection is receiving the required data. Please follow the best practices and guidelines provided in the Microsoft documentation to ensure a successful integration. References: Web setup of device fingerprinting - Dynamics 365 Fraud Protection ... 5. Do we need to send IP address if we use Device Fingerprinting? In Microsoft Dynamics 365 Fraud Protection, the IP address is an optional field when using device fingerprinting. While it is not mandatory to send the IP address, providing it can enhance the accuracy of the fraud protection service. The IP address can be set in the deviceFingerprinting.ipAddress field for assessments, and it helps in identifying the geographic location and network information of the device, which can be valuable in fraud detection scenarios. References: Web setup of device fingerprinting - Dynamics 365 Fraud Protection ... 6. What is the difference btw 'device.ipaddress' and 'trueIp'? In Microsoft Dynamics 365 Fraud Protection, 'device.ipaddress' refers to the IP address that the merchant's website receives when a customer uses the site. This is typically the public IP address that the customer's device is using to access the internet. On the other hand, 'trueIp' is the actual IP address of the device as identified by device fingerprinting. It is used to assess the risk of fraud and is part of the device attributes collected during the fraud assessment process The 'trueIp' can be particularly useful in identifying fraud attempts because it can reveal if a customer is using a proxy or VPN to mask their actual IP address. This can be a red flag for fraudulent activity, as fraudsters often use such methods to hide their location and identity. 7. What is TrueIP? What is “IP address (via Merchant)”? Why is TrueIP blank, while “IP address (via Merchant)” is available? In Microsoft Dynamics 365 Fraud Protection, "TrueIP" refers to the actual IP address of the device identified by device fingerprinting, which is used to assess the risk of fraud. It is part of the device attributes collected during the fraud assessment process. The "IP address (via Merchant)" is the IP address that the merchant provides to Fraud Protection, which may be different from the TrueIP if, for example, the user is connected through a proxy or VPN. If "TrueIP" is blank, it could be due to several reasons such as the device fingerprinting data not being collected properly, the user using privacy features that prevent the collection of their true IP address, or simply that the TrueIP information was not available or not passed on at the time of the transaction. However, generally speaking, the true IP address is the one assigned to a device connected to the internet, while the IP address provided by the merchant could be the one they have on record for the transaction, which might be different due to the reasons mentioned above. References: View purchase protection schemas - Dynamics 365 Fraud Protection | Microsoft Learn 8. Any information collected beyond IP address? A detailed summary of what device fingerprinting attributes we attempt to collect for web, iOS, and Android can be found here: Attributes in device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn 9. How do I renew the DFP Device Fingerprinting SSL Green ID certificate? Multiple steps: Obtain a renewed certificate. These can be provided by whichever team within your organization manages certificates. Typically, these are IT, Security or Engineering. The certificate should be a .pfx file. Upload your certificate. From the DFP Portal, select "Integration" and "Enable device fingerprinting". For the renewal process instructions and further details, please refer to the Microsoft Learn Page: Web setup of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn 10. Does device fingerprinting work for different browsers and operating systems? Yes, DFP Device Fingerprinting works for different types of web browsers and operating systems. Below is more information on support and how to integrate: Web setup of device fingerprinting - Dynamics 365 Fraud Protection | Microsoft Learn Dynamics 365 Fraud Protection mobile SDK for Android - Dynamics 365 Fraud Protection | Microsoft Learn Dynamics 365 Fraud Protection mobile SDK for iOS - Dynamics 365 Fraud Protection | Microsoft Learn Dynamics 365 Fraud Protection mobile SDK for React Native - Dynamics 365 Fraud Protection | Microsoft Learn
