What you need to know about Azure AD security defaults?

Hello Cloud Marathoners,

The following post is going to be covered in the Azure Spring Clean 2022 event’s website too. Thus, you might be wondering what the Azure Spring Clean is?

Note: This post is not finalized yet πŸ˜‰ and will include a video session too.
Thus, please be patient with ongoing progress. Thanks!

Azure Spring Clean 2022 Overview

The Azure Spring Clean is a community-driven event focused on Azure management topics and gradually publishes content from March 14-18, 2022.

I would like sincerely Thank – Joe Carlyle and Thomas Thornton for putting time and effort in organizing this event. From a #cloudmarathoner ’s perspective it’s been enjoyable to contribute and be a part of this event. This topic specifically outlines how to understand the pros and cons of your initial Azure AD settings that will be aligned with your project’s expectations.

Azure Spring Clean 2022
Azure Spring Clean 2022 site

WHY azure ad security defaults are important?

Indeed, this is a very legit question and I would like to address it with the following quote from Alex Weinert:

…our telemetry tells us that more than 99.9% of organization account compromise could be stopped by simply using MFA, and that disabling legacy authentication correlates to a 67% reduction in compromise risk (and completely stops password spray attacks, 100% of which come in via legacy authentication)…

Alex Weinert – Director of Identity Security at Microsoft

The main purpose behind these default settings is to make sure that all organizations using Azure AD have a basic level of security, and it is enabled at no extra cost according to Microsoft.

New Azure AD Bug Lets Hackers Brute-Force Passwords Without Getting Caught

Azure AD security defaults are something you need to enable at the tenant level. Once you do this, the rules will apply to all users in your tenant without any exceptions.

If you are looking for enforce rules more selectively ( or exclude some users ) then security defaults won’t be a fit solution for you. For this scenario, you would need to look at getting some P1 or P2 licenses and use the conditional access instead.

How can I set up my Azure AD Security Defaults?

The Microsoft Azure AD team did a fantastic job by simplifying this option. You need to navigate int0 Azure AD -> Properties -> and click on link Manage Security defaults.

You will end-up with the following window on the right panel of Azure portal:

Enabling Security Defaults in Azure AD

What is baked inside the security defaults in azure ad?

There are a number of things baked into the “Security Defaults” by Azure AD team. You could read about an official and detailed description here – Security defaults in Azure AD.

One of the BIG incentives for the security defaults is that it brings Multi-Factor Authentication (MFA) to your users for #free. Of course, there are some limitations around this which I will cover later on, but this option does allow you to get an MFA with no additional cost.

Previously, you would have to have either Azure AD P1 licenses, or pay per use for MFA functionality. Thus, this is a big game changer benefit that you are getting for free in your tenant and will bring a significant extra level of security. And this defaults includes both Azure and Office 365 services.

Along with MFA, security defaults are enforcing several policies that make your tenant more secure:

  • Requiring all users to sign up for MFA (for free)
  • Requiring those in Azure administrator roles to perform MFA
  • Blocking legacy authentication protocols – this includes clients that don’t use modern authentication and so don’t support MFA, and older mail protocols like IMAP, SMTP and POP3
  • Requiring MFA authentication when undertaking privileged actions using the Azure portal, PowerShell or CLI

Will Security Defaults replace my Azure AD licenses ?

In short, the answer is No. Your Azure AD licenses provide more security protection services than what you get from “Security Defaults”.

Think of a “Security Defaults” as a security design approach for users on a free Azure AD tier. Because, if you are already using P1 or P2 licenses you would want to look at using conditional access to perform this (and more) rather than security defaults.

Azure Ad Premium P1 | Azure Active Directory Premium Pricing & Licensing -  USA | IOTAP Online US
Azure AD Premium licenses

What you need to know before deploying the Security Defaults?

Based on Microsoft security guidelines, every organization should have at least two emergency access accounts configured. These accounts are intended for use when your regular administrator account’s can not be used. A typical example is: when person with the most recent Global Admin access has left your company.

What are the emergency access accounts ?
Well, following three criteria defines it pretty well:

  • Aren’t used on a daily basis
  • Are protected with a long complex password
  • Has an assigned Global Administrator rights in Azure AD
Break the Glass Admin no longer compliant? - Microsoft Partner Community

These emergency access accounts and credentials are very sensitive and should be stored in a secure location like a fireproof safe. And only authorized people in your organization should have access to these accounts.

You are also encouraged to disable password expiration to for these accounts using Azure AD PowerShell.

Check out this Microsoft article – Manage emergency access accounts in Azure AD, as it provides more detailed information about emergency access accounts.

What to do when switching from Security Defaults to azure ad Conditional Access Policies?

In order to provide more productivity and better security to your users, you could replicate the policies created by Azure AD Security Defaults. First, your customer’s tenant must be licensed with Azure AD Premium P2. However, the majority of policies can also be accomplished using the Azure AD Premium P1 license.

Check out the following Microsoft documented guides on how you can use Conditional Access to configure equivalent policies to the once that get set by the security defaults:

All these policies could be implemented with Premium P1 license, except the last one. The last policy requires Azure AD Identity Protection feature of the Azure AD and could be provided via Premium P2 license.

Summary

Thank you so much for reading this post and learning about the Azure AD Security defaults. I tried my best to provide my perspective on this important topic while using availiable Microsoft docs and resources.

Please, keep up the good work by securing your and customer’s cloud environments!

Azure Bicep presentation for Omaha Azure User Group

Hello friends,

I am very excited to see you all in the next Omaha Azure User Group meetup. This time we will speak about the latest advancements and use cases you could apply in your Azure resource authoring toolkit.

This meeting will take place on November 17th, starting at 6 PM CST. Details of the event are posted here: https://lnkd.in/gzh_sF8e and on my LinkedIn post.

Please, make your registration at the meetup website here.


Support & Subscribe toΒ #cloudmarathonerΒ LinkedInΒ tagΒ πŸ‘πŸ‘€
Stay tuned for more Azure, Automation & Security related posts.

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become α΄€Β #cloudmarathonerΒ β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ – 𝐋𝐄𝐓’𝐒 π‚πŽπππ„π‚π“ πŸ‘

Festive Tech Calendar 2021 event

Hi Cloud Marathoners,

As you may know, it is that time of a year when great content will be coming to the town! You could enjoy and learn throughout the month of December, as people behind the #festivetechcalendar will be bringing you lots of new content from different communities and people around the globe.

https://festivetechcalendar.com/

This year, I have submitted two sessions and have been nicely surprised yesterday. Both sessions have been accepted and I am looking forward to deliver following sessions for the community:

Session # 1: What you need to know about Azure AD security defaults?

Accepted session – “What you need to know about Azure AD security defaults?


In this session above, we will discuss about how to get started with Azure security on right foot and its challenges. We will focus on importance of a strong Identity and Access in any cloud solution that we are creating for our customers. One simple way to get started is review and adjustment of security default options in Azure AD. We will also look into the set of practices to get you started with Azure AD setup and learn about the benefits of Azure Security Benchmark.

Session # 2: All you need to know about Azure Bicep configurations

Accepted session -“All you need to know about Azure Bicep configurations”

In the second session, we will talk about Azure Bicep – a new language that aims to ease Azure resource authoring and management. This new language comes with a powerful VS Code extension and config file options.
In this session, we will unveil dozens of powerful features in our config file to suit your style of coding on VS Code and cheer up our productivity skills. We will apply our fresh skills by creating several Bicep demos in the process. 

Conclusion

I sincerely hope that these sessions will spark your interest and I am looking forward to see you all during this event. But most importantly, I hope you could have lots of fun during this festive month.

Stay tuned for more Azure AD, Automation & Security related posts.

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become α΄€ #cloudmarathoner β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ – 𝐋𝐄𝐓’𝐒 π‚πŽπππ„π‚π“ πŸ‘

How to create a free, Azure Active Directory developer tenant? πŸ€”

Hi Cloud Marathoners!

It is a pretty common situation when as a Developer you are not granted access to work with company Azure AD. And there are many reasons why corporate security / IT would be hesitant to provide that access.

However, this situation should not discourage you from experimenting and prototyping solutions that you have.

Let’s consider following two easy options to create a free Azure Active Directory with Premium (P1 or P2) trial licenses. This will enable you to install/create an app that requires Azure AD license, and start testing and validating your workloads right away:

Azure Active Directory voor Developers - ppt download

Option # 1: Microsoft 365 Developer Program

Join a free Microsoft 365 Developer Program and get a free sandbox, tools, and other resources you need to build solutions for the Microsoft 365 platform. Resources like an Azure AD with Premium licenses, pre-configured users, groups, mailboxes and etc.

Option # 2: Create an Azure trial account

Create a new free Azure AD account with a tenant and activate your Premium licenses in your new tenant. This is a classic option for anyone who is trying to learn Azure for the first time.

The Azure trial account will give you one month to play with Azure and Azure AD services, where you will get certain credits to spend on Azure resources. You will get an option to convert this trial subscription into a paid one at the end of the trial period.

How to Join Microsoft 365 Developer Program

My recommendation would be to sign up for the free Microsoft 365 developer program that gets renewed automatically, if you are using that account. Check out the following instructions on how to set-up one:

1. Click on the Join Now button on the screen

2. Sign in with a exisiting or new Microsoft Account you already have

3. On the signup page, fill the form and accept the terms and conditions of the program, and click next

4. Continue with a subscription set-up. You should specify the region where you want to create your new tenant, create a username, domain and enter a password. This step will create a new tenant and an administrator account of the tenant.

5. Enter the security information which is required to protect the sensitive administrator account. Complete this step by setting up MFA authentication for your admin account.

6. Link your developer account with your GitHub account for an easy renewal. You should see the following GitHub account link blue banner, once the linking operation succeeds.

Congratulations!
You have created a new Azure AD tenant with 25 E5 user licenses. This also includes Azure AD Premium licenses.

As an additional perk, you can also add sample data packs with users, Mail & Events and SharePoint, as sample data for your development environment.

Good Luck on your next M365 project!

Stay tuned for more Azure AD, Automation & Security related posts.

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become α΄€ #cloudmarathoner β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ – 𝐋𝐄𝐓’𝐒 π‚πŽπππ„π‚π“ πŸ‘

Azure introduced new Fusion Detection for Ransomware!

Hi Cloud Marathoners,

This week a new service – Fusion Detection for Ransomware has been announced. These Fusion detections correlate alerts that are potentially associated with ransomware activities that are observed at defense evasion and execution stages during a specific timeframe.Β 

What is Ransomware?

Ransomware attack is a type of attack that involves using specific types of malicious software or malware to make a network or system inaccessible for the purpose of extortion – β€˜ransom’.

There is no doubt that ransomware attacks have taken a massive turn in being the top priority as a threat to many organizations. AΒ recent reportΒ released byΒ PurpleSecΒ revealed that the estimated cost of ransomware attacks was $20 billion in 2020 and with downtime increasing by over 200% and the cost being 23x higher than 2019.

Preventing such attacks in the first place would be the ideal solution but with the new trend of β€˜ransomware as a service’ and human operated ransomware, the scope and the sophistication of attacks are increasing – attackers are using slow and stealth techniques to compromise network, which makes it harder to detect them in the first place.

AI in action with Azure Sentinel for help!

Good new is that #azuresentinelΒ πŸ”₯ is constantly getting more efficient by introducingΒ #AIΒ in action – SentinelΒ #fusion!

In order to help your analyst quickly understand the possible attack, Fusion provides you with a complete picture for the suspicious activities happened on the same device/host by correlating signals from Microsoft products as well as signals in network and cloud. Supported data connectors include:

”With Fusion detection for ransomware that captures malicious activities at the defense evasion and execution stages of an attack, it gives security analysts an opportunity to quickly understand the suspicious activities happened around the same timeframe on the common entities, connect the dots and take immediate actions to disrupt the attack.”

Microsoft is commited to release new multistage attack scenarios detected by Fusion in Azure Sentinel. You could keep an eye on thereΒ Azure Sentinel FusionΒ page and get latest updates there πŸ™‚

Stay tuned for more Azure automation & Security related posts.

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become α΄€ #cloudmarathoner β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ – 𝐋𝐄𝐓’𝐒 π‚πŽπππ„π‚π“ πŸ‘

#microsoftsecurity
#security
#infosec
#cybersecurity

Essential Azure cloud transformation handbook – for everyone

Hi Cloud Marathoners,

There might be some technical knowledge gaps when we start to learn a new cloud service or its features. One way to minimize it – is to study for a certification exam or read a book that has a more holistic approach into the technology.

Well, while not all of you might agree with this approach of reading the book, certain books can open a completely new perspective into your vision. Of course, there is a risk that over-time, the cloud services described in the book might be phased out, merged or re-named (like, Azure Data Warehouse service got evolution into Azure Synapse Analytics) into some other services.

In addition, hands-on learning is the recommended approach to masterΒ your knowledge and get technical depth into the subject matter area.


Anyway, no matter what approach works best for you, the “Azure Strategy and Implementation Guide 4th Edition” is an essential handbook to cloud transformation with Azure that you don’t want to miss out on.

As it is a common case in technology, there are many different scenarios for running your workloads on Azure to meet your company’s business needs. This book puts renewed emphasis on the importance of using design principles and how crucial planning is – when moving resources to Azure.

The authors of the book use the Microsoft Azure Well-Architected Framework, and recommend to adopting best practices to improve the quality of your workloads in the cloud.

That said, let’s have a look into the chapters:

βœ”οΈ Introduction to Azure
βœ”οΈ Automation and governance in Azure
βœ”οΈ Modernizing with hybrid cloud and multicloud
βœ”οΈ Cloud migration: Planning, implementation, and best practices
βœ”οΈ Enabling secure, remote work with Microsoft Azure AD and WVD
βœ”οΈ Security fundamentals to help protect against cybercrime
βœ”οΈ Offers, support, resources, and tips to optimize cost in Azure

I hope those listing sparkled your interest to read the book.
Well, without any overdue check the download link and put it on your device.

Hopefully, you could get solid Azure cloud understanding from this book and lighten-up your cloud transformation journey.

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become α΄€ #cloudmarathoner β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ – 𝐋𝐄𝐓’𝐒 π‚πŽπππ„π‚π“ πŸ‘

#microsoftazure
#cloudskills
#multicloud
#cloudtransformation
#bestpractices
#wellarchitected #framework
#continuouslearning

What is entitlement management and how it can help?

Hello Cloud Marathoner’s,

We are continuing our cloud learning journey with Azure services today. Last year Azure Active Directory has introduced many useful features and we will talk about one of them that simplifies the identity governance.

“An Azure Active Directory (Azure AD) entitlement management is an identity governance feature that enables organizations to manage identity and access lifecycle at scale, by automating access request workflows, access assignments, reviews, and expiration. ” – Microsoft Azure AD Identity Governance

Entitlement management example with one catalog and two access packages

How can entitlement management help?

There are several ways how you could leverage these features for your Azure resource management activities. The easiest one to get started with is the delegation options:

βœ”οΈ Delegate management of resources from high privileged account to managers
βœ”οΈ Govern access for users in your organization
βœ”οΈ Govern access for users outside your organization
βœ”οΈ Automate and simplify day-2-day management
βœ”οΈ View and report on resource assignments and access packages

Let’s consider following two common scenarios:

First Scenario: As administrator you want to delegate access governance from IT administrators to users who aren’t administrators.
Check out the Video clip for step-by-step guidance.

Second Scenario: You would like to create an automated request process for your users to enable them request for an access package (set of Azure resources and accesses rights) to do their job.

The request process of access packages can be simply understood by a help of a following sample infographic.

A user request for access package (set of resources) to start doing work assignments

When I should use access packages?

It is not a silver bullet, so access packages do not replace other mechanisms for access assignment. However, following use-cases are most appropriate in situations where you would consider them:

  • Employees need time-limited access for a particular task. For example, you might use group-based licensing and a dynamic group to ensure all employees have an Exchange Online mailbox, and then use access packages for situations in which employees need additional access, such as to read departmental resources from another department.
  • Access that requires the approval of an employee’s manager or other designated individuals.
  • Departments wish to manage their own access policies for their resources without IT involvement.
  • Two or more organizations are collaborating on a project, and as a result, multiple users from one organization will need to be brought in via Azure AD B2B to access another organization’s resources.

Thank you for reading till this point. Stay tuned for more Cloud Security and Administration related posts.

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become α΄€ #cloudmarathoner β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ – 𝐋𝐄𝐓’𝐒 π‚πŽπππ„π‚π“ πŸ‘

#microsoftazure
#AzureAD
#identitygovernance
#accessmanagement
#secureaccess
#bestpractices
#continuouslearning

Enabling protection of multi-cloud environments from one central?

Hello Cloud Marathoners,

Hybrid-cloud security and protection of digital estate across cloud is very hot topic. But there are very few tools that can cover all different clouds, even though there are myriad of third party and cloud native tools to achieve this mission.

Thus, I have compiled my takeaways on perspective from the latest Microsoft Security blog post and wanted to share back set of tools on Microsoft Azure that could help you achieve management of security poster across clouds.


Microsoft’s Azure security and management tools extend protection to your multi-cloud estate (including other CSPs like AWS, GCP, IBM, etc.)

The followings are the key services that enable it:

βœ”οΈ Azure defender for Servers
βœ”οΈ Azure Security Center
βœ”οΈ Azure Defender for SQL

Let’s start with the Azure Defender for Servers.
What is the Azure Defender for Servers ?

Well, this service leverages Azure Arc to simplify the on-boarding and security of virtual machines running in AWS, GCP, and hybrid clouds.

The Azure Arc projects non-Azure resources into Azure native objects that can be managed and secured with Azure capabilities (Secure Score, Compliance Reporting, Azure Policy, Azure Defender, asset management, etc.)

Next important service visualized on a diagram is Azure Security Center.
Well, what is Azure Security Center?

This service provides a unified multi-cloud view of security posture by integrating AWS Security Hub and GCP Security Command Center detected misconfigurations and findings in Secure Score and Regulatory Compliance Experience.

And finally, let’s review the Azure Defender for SQL.

This managed service constantly monitors your SQL servers for threats, whether they are hosted on-premises, in multi-cloud deployments on Amazon Web Services (AWS), and Google Cloud Platform (GCP), and in virtual machines on Azure.Β 

Looking for more references?

Check out a “Protecting multi-cloud environments with Azure Security Center” blog post on Microsoft blog post.

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become α΄€ #cloudmarathoner β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ
#SharingIsCaring❀️️

What is MCAS and why would you need it?

Hello cloud marathoners,

The MCAS (Microsoft Cloud App Security) πŸ›‘οΈπŸ” – helps to identify and combat cyberthreats across all your cloud services. This is a cloud access security broker (CASB) that provides multifunction visibility, control over data travel, and sophisticated analytics.

Here is a high level architecture diagram from Microsoft docs.

What are the main benefits of this cloud service?

Here are the main three benefits ot brings alone:
βœ”οΈ Discovery & Manage your apps
βœ”οΈ Govern access to apps and resources
βœ”οΈ Check compliance on your cloud apps

Check out this detailed level architecture ofΒ #appsecurityΒ inΒ Microsoft Azure β„’Β πŸ‘

MCAS – Microsoft Cloud App Security.


What are the main use cases for your business?

βœ”οΈ Shadow IT Discovery & Control
βœ”οΈ Secure Access
βœ”οΈ Security Poster Management
βœ”οΈ Threat Protection
βœ”οΈ Information Protection
βœ”οΈ User & Entity Behavioral Analytics

Another beauty of above architecture lies in a fact that you could easily integrate this model with third party SaaS apps, all listed on a diagram.

Thank you Matt Soseman for bringing this diagram  #SharingIsCaring❀️️

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become α΄€Β #cloudmarathonerΒ β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ – 𝐋𝐄𝐓’𝐒 π‚πŽπππ„π‚π“ πŸ‘

#microsoftazure
#MCAS#securitymanagement
#OAuth#secureaccess #appsec
#threatprotection
#securityengineering
#bestpractices
#continuouslearning

What are the Microsoft Azure’s Multi-Cloud and Cross-Platform Capabilities?

Hello cloud marathoners,

There are many security and multi-cloud capability services under Microsoft Azure umbrella of services. In this post, I will reference the Microsoft documentation to clarify those capabilities on high-level.
I hope this post will clarify intent and purpose of these capabilities for you.

Important: Please zoom into a infographic – as it is of a high quality and can be very informative in understanding the article.

Microsoft’s cross-platform or cloud security starts with endpoints and cloud visibility and controls: namely Endpoint management and Cloud Security Posture Management (CSPM) that provides insight across your multi-cloud and on-premises datacenter estate as well as Cloud Workload Protection capabilities

Next are the SIEM and XDR Strategy – where Microsoft provides integrated capabilities for the Security Operations / SOC to get the broad and deep visibility needed to rapidly detect, hunt for, and respond/recover to threats across clouds and platforms.

The following capability on the infographic is – Infrastructure Extended Detection and Response (XDR). These capabilities are provided through set of services, namely Azure Defender, Azure Arc, Microsoft 365 Defender with number of features combined under the suit of services.

Next set of capabilities are Identity Enablement and Security – where Azure Active Directory provides comprehensive solutions, including Zero Trust access control that explicitly verifies trustworthiness of devices (via XDR) and users via native UEBA, Threat Intelligence and analytics.

And finally, Information Protection capabilities – utilize the Microsoft Information Protection and Azure Purview services that provide a full lifecycle approach to discovering, classifying, protecting, and monitoring structured and unstructured data as your organization generates and leverages more data. These capabilities provide insights to drive mission completion and competitive advantage.

What would be your approach?
Please, share in the comments section πŸ‘
#SharingIsCaring❀️️

Important: Please zoom into the infographic – as it is of a high quality and can be very informative in understanding this article.

#microsoftazure
#multicloud
#crossplatform
#endpointmanagement
#SOC
#securityengineering
#identityaccessmanagement