If you have a 3rd party mail gateway in front of your Exchange Online tenant and haven’t already fixed the bypass issue, then you’re opening yourself up to inbound emails that completely skip the usual checks performed by Exchange Online Protection. What is the bypass issue? If you use a 3rd party gateway as your… Read More: The EXO 3rd Party gateway bypass is even worse than… »
If you’ve ever had to deploy a new Microsoft Defender for Identity (MDI) Sensor on a Domain Controller, you’ll know that one of the required components is the Access Key that is used during installation. The Access Key is effectively a one-time password for use when deploying the sensor, after which communication is performed using… Read More: MDI Access Key Generation »
Well, this is definitely going to be one of my shortest posts 😁. Q. How do you remove an App Connector in Microsoft Defender for Cloud Apps? A. You can’t. The only options you have are to edit the settings, edit the instance name, or disable the connector. If you no longer need the App… Read More: MDCA App Connector Deletion »
I recently had to help out a customer with a situation where someone in first level support accidentally deleted an Entra ID security group. That person (let’s call him Eric) was trying to to remove a user from the group using the Entra Portal but ended up deleting the group instead. It transpired that instead… Read More: Entra ID and Accidental Security Group Deletion »
I’ve been doing a bit of work recently with URL/Domain Indicators in “block execution” mode and thought it might be usefult to share my experience here. I found a website that isn’t blocked in Chrome and I suspect that my experience may not be unique. This article briefly covers how to use Indicators to block… Read More: Browser support for Defender for Endpoint URL/Domain Indicators »
I came across something quite surprising (to me at least) the other day, so I thought I would share it here in case others come across the same behaviour. What I found is that that the Entra ID audit log doesn’t always show an entry for removal of a member from a group. Specifically, if… Read More: Auditing removal of group members in Entra ID »
When something runs in Audit mode, you generally expect it not to block anything, right? I recently found an anomaly with Microsoft Defender Application Control runing in Audit mode causing .hta files not to open. An HTML Application (HTA) is a Microsoft Windows program whose source code consists of HTML, Dynamic HTML, and one or… Read More: MDAC in Audit mode blocking .hta files »
SharePoint Online offers a nifty security feature known as “app-enforced restrictions”. In this article, I will briefly describe the feature and show you how to enable it. I will also point out why there is a need to be aware of what is happening in the background in case turning it on causes issues for… Read More: Caution required when enabling SPO app-enforced restrictions »
If you’ve ever needed to do some troubleshooting with Exchange Online (EXO) message delivery, you’ll know how useful the Extended Report capability can be. One thing I noticed recently is that while the Summary Report is typically available within a few minutes of the message being handled by EXO, it can take considerably longer for… Read More: Patience required when running Extended Reports in Message Trace »
You may have heard recently that Microsoft has rebranded their Advanced Threat Protection (ATP) offerings. I’m putting this up here because I keep forgetting their new names. This is what they look like: Microsoft 365 Defender (previously Microsoft Threat Protection)Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection)Microsoft Defender for Office 365 (previously Office… Read More: The Artist Formerly Known as ATP »