Blocking Personal Outlook and Gmail Accounts on Corporate Device
Hello Community, In my organization, we use the Microsoft 365 environment. We have a hybrid infrastructure, but we aim to deploy as many policies as possible through Microsoft 365 (Intune, Purview, Defender, etc.). One of our goals is to limit the use of corporate devices for personal purposes. We use Outlook as our corporate email service, and we would like to block employees from signing into their personal email accounts (either via web or desktop application). Additionally, we would like to block access to other email services, such as Gmail, both via web and desktop apps. Could you provide guidance on how to achieve this? I would greatly appreciate any help or suggestions. Thank you very much! Juan RojasSecure Score Improvement Recommended actions information sheet
Hello All I am starting a project to Improve our Secure score following the "Recommended Actions" section in the M365 Defender portal. Now each action comes with its own set of General information and remediation options. Rather than get the actions on each of the 208 recommendations by clicking through all the tabs and recording every step required to complete the recommendation , does anyone know if Microsoft has an Excel sheet with all the relevant Secure Score Improvement actions/information in one place? Will make running this project so much easier! Thanks in advance ! Kind Regards Christo
Insider Builds
I have been an avid Microsoft user for many years with only a couple of small issues every now and again. The 6 weeks have been unbelievably stressful and disheartening. I thought trying samples of New Insider builds and enlisting in Azure for some up to date training for myself to help with what I wanted to roll out for my business. This has been the worst experience i have ever been apart of. I now have multiple computers and hardware in disarray but more importantly the loss of time and patience is paramount . I have come to realise the repetitive responses and requests for data collection on feedback or issues is one-sided The amount of user data submissions is not the issue though. It is the assistance from Microsoft regarding issue via portals, help-desk etc. The inclusion of many backend functions for the purpose of better user experience is heavily flawed. Unless end-user inadvertently has or encounters issues in there OS life is good. Heavily automated program tiggers sit through all OS builds for example. One drive. Regardless whether this is declined or removed it will always be running in the background. If you system had been compromised this is a perfect place for root-kit other Malware to spread. Xcopy: A Microsoft background function which has the ability clone and copy 99% of drivers of operating info structure. Can be controlled by ghost script directives or embedded dll to aid malware. Anti-virus or defender find difficulties identifying or distinguishing authentic and re-pro-ducted data. In time this type of incursion can mimic a vast amount of OS functionality. Microsoft OS validity. I have trailed numerous builds with all sharing this characteristic. Invalid or expired software and driver certificates & TPM flaws even after a full clean reset and TPM turned off in bios. Inevitably this can introduce compromised software without end-user knowledge. The impact leads to unauthorised access in many elements of the OS platform especially data access and embedded .dll which can run inline or above elevated authorisation. A lot of this is undetectable. Once embedded in OS and bios this is impossible to clean without expert assistance and can be very costly. For the most part the inclusion of new AI functionality across the OS platform is very welcomed. Unfortunately there are a large amount of bugs to be ironed out especially in the platform navigation. Advice provided via OS AI can be mis-leading or incorrect. .Live response sessions and Zscaler
Has anyone managed to get live response sessions from Defender XDR working with Zscaler enabled? I have bypassed all necessary URLs from SSL inspection but still getting blocked from performing actions on live response. It is definitely Zscaler as when it's disabled live response works perfectly.
Old .NET versions automatic uninstallation/removal
Hello, How are you removing old versions of .NET from your devices? Is there a way to automate this? To better clarify our issue, please see the screenshot below. We just installed the latest version (6.0.35) for both: .NET Runtime and Desktop Runtime but older 6.0.33 versions are still there. We need to automate those older versions removal. I appreciate your response and help. Thanks, MarkUnable to Restrict Sensitive Data Access by Microsoft Edge via Endpoint DLP Policy
Hello everyone, I've been running into a peculiar issue where actions we have configured to be blocked via our Endpoint DLP policies do not apply to the Microsoft Edge browser. Currently, we have a DLP policy configured to block attempts to access protected files by a list of restricted apps. Our restricted apps include "firefox.exe", "chrome.exe", "msedge.exe" and "msedgewebview2.exe". When the sensitive content is accessed by either Chrome or Firefox, the DLP policy works correctly (Block with override), but the policy completely refuses to work in any scenario that involves Edge. The data we are using as an example is able to be accessed by the Edge executables without restriction. Has anyone else run into this issue? It's strange to me that for some reason Edge is just completely exempt from the DLP policy actions we have implemented. Thank you!How much time does it takes to update secure score on Defender portal?
Hi Folks, I have marked some of the recommended actions on secure score as "third party" or "alternate mitigation". Even after 10 hours I can see action is still marked as "to be addressed". How much time does it take for changes to show up there? And also, how much time will it take to get this add up to my cumulative secure score?
Whenever login into the office applications different OTP needs to be applied Outlook and teams
When signing into Office applications, a different OTP is required for both Outlook and Teams. To address this issue, there is any resolution this issue supports or a supporting document as proof to confirm that this is a standard procedure.
Block standard C:\Users\%User%\AppData\Local\Microsoft\WindowsApps Path environment variable
Hello togehter, for security reasons I like to block (GPO?) / delete the standard Windows-path-enviroment variable: C:\Users\%User%\AppData\Local\Microsoft\WindowsApps First of all: Does it make sense to do this? I want to exclude a case that some user / unwanted software are copied here by attackers. Thanks a lot Kevin
RPC Endpoint Mapper Client Authentication uses NTLM
Introduction The main goal is to secure existent windows 10 clients. As there a few hardening recommendations from for example CIS and Microsoft concerning secure OS configuration i discovered a potential misleading dependency regarding NTLM and RPC. How it happened On windows 10 clients in the computermanagement (local admin group) the therein contained domain-members were only shown with their SID. Long story short, the actual name of the ADuser was not displayed anymore. Solution In the end it turned out that the following configuration based on a hardening configuration of CIS was the root cause: "18.8.37.1 Ensure 'Enable RPC Endpoint Mapper Client Authentication' is set to 'Enabled' (MS only)" More information https://www.tenable.com/audits/items/CIS_Microsoft_Windows_Server_2016_STIG_v1.1.0_L1_MS.audit:0f08c2bcc89cf26f03d14a0903b9d388 Basically there should not be a problem when enabling the RPC Endpoint Mapper Client Authentication. But if you configured "Restrict NTLM: Outgoing NTLM traffic to remote servers" to "Deny all" More information https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers then the enabled RPC Endpoint Mapper Client Authentication will not work anymore because it does rely on NTLM. Conclusion A risk assessment must now be carried out here. Even Microsoft says that "It's encouraged to move away from NTLM to better secure your environment. If faced with a choice between restricting NTLM and using EnableAuthEpResolution, the recommended approach is that you restrict NTLM in your environment." More information https://learn.microsoft.com/en-us/windows-server/security/rpc-interface-restrict --> To sum up, even CIS recommends to enable the RPC Endpoint Mapper Client Authentication, but they do not make any statement in their benchmarks with regard to the denying of outgoing NTLM traffic to remote servers. Question Which configuration will have a more severe risk and what should be the recommendation here regarding to achieve an overall secure configuration?
