Unusual Sign-In Activity E-mail but I cannot identify the account!
Hi, I'm experiencing something quite weird. This morning I got an alert to a personal e-mail address of mine (w********@gmail.com) that a Microsoft account of mine was accessed from an IP address in Brazil. I've attached that e-mail and it lists the account as "ja*****" with no domain name listed. I have two microsoft accounts that I know of that start with "ja". One is a hotmail account and one is registered with my university account. I figured this alert had to do with my university account because that could explain why it never listed a domain name. However, when I checked, neither account have any record of a sign in, successful or unsuccessful, from an IP address in Brazil today. Furthermore, the university account doesn't have the w*******@gmail.com listed as a primary or secondary e-mail account so even if that was the account that alert wouldn't have gone to that e-mail. I contacted Microsoft support hoping that they could try to locate the alert e-mail and confirm what account the alert was about from their end but they told me they don't have the tools for that and they have limited access to their own system. A supervisor told me that at this point my best bet is to either post on the community forums or to go to the police and ask them to track the IP address. I have a vague memory that years ago when I tried to log into my university Microsoft account, it would let me log in as a personal account and as a work account separately but now I can only use it as a work account. I'm wondering if that might be related like maybe someone was able to access my personal account of my university Microsoft account which could explain both the lack of a domain name in the e-mail and the fact that there's no history of it in my work account. This is really bugging me because someone may have accessed an account belonging to me but I'm completely unable to actually confirm that or even the account this is happening to. Thanks!
Survey: Microsoft Purview Retention Labels in Outlook Mobile (iOS/Andriod)
We need your input! Today, in Outlook for Windows, Outlook for the Web, and (currently rolling out) Outlook for Mac, end-users can manually apply Microsoft Purview retention labels and MRM personal tags to individual emails and non-default (user-created) folders. The Outlook and Data Lifecycle Management product groups are interested in learning from our customers how important that same functionality would be in Outlook for Mobile (iOS/Android). Please consider filling out and sharing the following survey to let us know how this feature would or would not be useful to you and your organization: https://aka.ms/RetentionLabels-OutlookMobile Please note that your responses will remain anonymous unless you choose to provide contact information at the end of the survey.
Quarantine emails marked as High Confidence Phish are being system released
I have a group of about 20 emails that were in quarantine, and within moments they were released by 'System release' There are multiple different domains being released, and all of them have a High Confidence Phish level. Since it is a system release, I cannot submit anything to Microsoft other than it appears clean. Is anyone else experiencing this?
Scheduling attack simulations
I'm starting to use the Defender attack simulation feature. I have approx. 3000 users to target. Leadership don't want to send 3000 tests every month rather divide the people up across 12 months sending smaller monthly batches. The issue of not being enough tests for each individual is there a way to automate the sending of these to even batches of people across 12 months rather than having to set these up manually?
User app registration - exploitable for BEC?
Hello. Recently dealt with a case of BEC. I'm not trained in forensics, but doing my best. Appears the hacker used an application called eM Client for their attack, getting access to a user's mailbox and hijacking a thread. I can see the login from two weeks ago (the incident was only noticed a couple days ago, however) - from a European country that SHOULD have been blocked by Conditional Access. Come to find out, the tenant conditional access was unassigned from everyone. We're not sure how - we re-enabled it, and audited changes, but the only change that appears was us re-enabling it. Which I thought indicates it was never configured right, except we've got a ticket documenting a change to Conditional Access a couple days after the hack that ALSO does not appear in the logs. So... it's likely it was changed, yet I have no record of that change (atleast, not through Entra > Monitoring > Auditing). If anyone knows any other ways of checking this, please advise - but I can't seem to even access our Diagnostic settings, the page tells me I need an Azure Active Directory subscription (I'm on Entra ID P1, which includes AAD.... this might be related to being global admin, and not Security Admin - we don't use that role in this relationship) ANYWAY, my amateur forensic skills have found that the attacker used an app called eM Client to get access. I'm not sure yet how they obtained the password, and got past MFA... But quick research shows this application (esp it's pro version) is known for use in BEC. The app was registered in Entra, and granted certain read permissions in Entra ID for shared mailboxes, presumably to find a decent thread to hijack. I'm not 100% sure yet there was any actual exploit done using this app, but it's popularity amongst hackers implies it does SOMETHING useful (i think remember that it authenticates using Exchange Web Services instead of Exchange Online, or something similar? Will update when I have the chance to check). We're in the process of improving our Secure Score, and this incident makes me think user's ability to register apps should be locked down. Checked Secure Score for this, and while there ARE recommendations around apps, disabling user app registration is NOT one of them. Just curious about people's thoughts. I just barely understand App Registration in Entra, but if this is a known attack vector, I would think disabling app registration would be a security recommendation?MS Sensitivity labels mail sending MIME format Header
I selected the Sensitivity labels in OWA and checked the value exposed in Chrome developer mode when sending an email. When sending mail (C#-EWS sending test), i confirmed that the message was encrypted by additionally coding the header with the information below. ## Header Sample X-MS-Exchange-Organization-ModifySensitivityLabel: 00000000-0000-0000-0000-000000000000;6e4f02ee-0f9f-44eb-9f14-57b7d505f382 msip_labels: MSIP_Label_6e4f02ee-0f9f-44eb-9f14-57b7d505f382_Enabled=True;MSIP_Label_6e4f02ee-0f9f-44eb-9f14-57b7d505f382_SiteId=a23af047-ccd4-43c4-b36d-5303e9f04b12;MSIP_Label_6e4f02ee-0f9f-44eb-9f14-57b7d505f382_SetDate=2024-03-18T00:20:34.940Z;MSIP_Label_6e4f02ee-0f9f-44eb-9f14-57b7d505f382_Name=Confidential;MSIP_Label_6e4f02ee-0f9f-44eb-9f14-57b7d505f382_ContentBits=0;MSIP_Label_6e4f02ee-0f9f-44eb-9f14-57b7d505f382_Method=Privileged; ## Question - If only msip_labels is applied, the sensitivity label is displayed, but the message is not encrypted. Adding X-MS-Exchange-Organization-ModifySensitivityLabel will enable message encryption. Can I code it like this? - The msip_labels guide is provided by https://learn.microsoft.com/en-us/information-protection/develop/concept-mip-metadata Where can I find the specifications for X-MS-Exchange-Organization-ModifySensitivityLabel? - What are the limitations of development if implemented only by adding a header? Thanks in advance
SMTP XOAuth authentication and Microsoft authentication libraries
Due to the upcoming deprecation of basic authentication our company is looking to move all our products to modern authentication protocols for sending emails but we have some unusual usage scenarios that have me running in circles. I have been through all available documentation multiple times and I'm stuck. The problem is that we have on premise web applications that are running on multiple client servers and not a central location. This creates a problem when using standard OAuth flows since there is no fixed URL to use as a redirect URI. Because of this I have created a separate API on a fixed URL that will serve as the redirect URI for all clients and instances of our web applications. This breaks the standard usage of MSAL library and I had to go around chasing my tail to even be able to implement something that could possibly work. I have been able to do it using Microsoft.Identity.Client MSAL library but I hit a problem since I need to use the ConfidentialClientApp.AcquireTokenByAuthorizationCode call to redeem the access code obtained after user login but apparently SMTP does not allow confidential clients to login. We need the application to be able to send emails from any account any tenant or personal accounts. I have obtained the access token for a personal account but SMTP rejects it with this error: 535: 5.7.3 Authentication unsuccessful [AM8P251CA0016.EURP251.PROD.OUTLOOK.COM]. If I switch to PublicClientApplication then there is no AcquireTokenByAuthorizationCode method and I can't even use client secret so I'm not even sure how this works in redeeming a code. I am going by instructions on this page: https://docs.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth and it mentions no requirement of a public client application. It states I can use authorization code flow and the documentation on authorization code flow states it can be used by web apps and desktop apps. Well how am I supposed to use it when SMTP won't accept a confidential app and the PublicClientApplication does not have a method to redeem it? If I drop the authentication library and go for pure REST API call implementation, which application credentials should I use that the acquired tokens will be accepted by the SMTP server? Also I would like to know if office 365 users still have to disable security defaults and enable STMP Authentication to use SMTP with OAuth 2? This would defeat the whole purpose of migrating to OAuth 2 and the blog about deprecation states that moving to OAuth 2 is the way to prepare your app for this deprecation, but I've seen instructions on SMTP OAuth that state SMTP Authentication still needs to be enabled.Purview Information Protection for internal and external emails
I'm working with an organisation that is starting to use sensitivity labels. They have Office 365 E3 licenses. The current plan is to set up a default label for documents and emails called "Internal Only". This label will encrypt contents and grant co-author permissions to all staff. The challenge will be when emails include external recipients. Ideally, the user will change from the default label to one that grants access to any recipients. However, I can imagine that there will be many cases where they forget to do this. If we had Office 365 E5 licenses, we would have the option to create a DLP policy to show a policy tip. I I would expect this would reduce the incidents of mislabeling. I have seen recommendations to avoid encrypting by default and only use it where needed. However this client is keen to use encryption to protect as much content as possible. One suggestion could be to change the default email label to only grant access to the sender and recipients, regardless of whether they are internal or external. I'm interested in any real-world feedback on how others have tackled this issue.
