Nathan McNulty

KQL to review #DirectSend abuse

EmailEvents​
| where SenderMailFromDomain == RecipientDomain​
| where isempty(Connectors)​
| where DeliveryAction !in ("Junked", "Blocked")​
| extend AuthenticationDetails = parse_json(AuthenticationDetails)​
| where AuthenticationDetails.DMARC == "fail"​

And yet... this is the only reason I know this setting exists 😂

I had to do troubleshooting, more than a few orgs have this applied to all users in an Entra environment :(

And they do, in several places, but it's not as comprehensive as it could be (though great for a starting point)

Microsoft has long published security benchmarks based on research/testing and customer support cases

They also do the Secure Score stuff which is much better than it used to be :p

Or anything else requiring device identity really... So no filter for devices, no compliance, no hybrid join grant control :-/

Sadly, I'm not a member of CIS anymore nor have the time to go through all of the settings for issues, but hopefully they are listening to feedback :)

While I'm on the topic of CIS Benchmarks...

If you follow this one for Edge, you won't be able to use device compliance in your Conditional Access policies :-/

I ended up writing a post about the new feature to change group SOA from AD to #Entra. Big big thanks to @intune.best for all of the assistance he provided and initial testing he did in #WinAdmins Discord voice yesterday!

ajf.one/group-soa

The S in MCP stands for security

Don’t blindly follow benchmarks.

They’re a great starting point — but not the finish line. Always make sure you understand what you’re configuring and why it matters in your specific environment.

I don't remember if it went that far back or not, but I know we had them in v2 (though there was no native way to convert them back to plain text back then, only via .NET)

I don't think this is really a factor, just dangerous imo

Lots of reasons, outside of not great defaults, most are total nonsense

Many just hate Microsoft, which is fine, but most don't configure it well, can't let go of AV results from a decade ago, compare to consumer experiences, etc.

Also fun, CIS says to enable ASR rules (which you absolutely should), but then disabling cloud delivered protection effectively disables 3 of the ASR rules they say you need to enable :P

So in the end, you can't actually get a device configured per the CIS Benchmarks, lol

As always, you cannot blindly trust benchmarks, you need to understand products to make the correct decisions for your environment

CIS was notorious for disabling PowerShell logging because it might capture a password... 🤦‍♂️

Here are just some of the things you will lose:

If you use CIS Benchmarks, I highly advise against this recommendation...

This disables cloud delivered protection which underpins a bunch of capabilities, disables roughly half of your protection

Fortunately, if you enable Tamper Protection, it is forcefully enabled for you :)

Euphoria

YouTube video by Get Rubix How to Automate Intune Policy Assignments with Graph and PowerShell

Today I'll show you how to add Intune policy assignments using the Microsoft Graph and PowerShell.

youtu.be/PAlSpLl5ASA

#intune #windows #graph

Poor man’s IGA: Monitor and clean up stale guest accounts Today’s challenge Today, we are dealing with inactive or stale guest users in a tenant. Entra ID Governance has several ways to solve this, but if you had those licenses, you wouldn’t be here. For tod...

I'd love to know which limited features most are interested in

This is partly why I created my Entra Operational Groups project:
github.com/nathanmcnult...

@janbakker.bsky.social also has a nice series on poor man's IGA:
janbakker.tech/poor-mans-ig...

We can do a lot with a little admin effort :)

At least they didn't let the security copilot licensing people touch it :p

I quite prefer getting charged for real usage though rather than licensing all active users or something

They'd lose a lot of money if they did this for all licenses, lol. So many licensed accounts not being used.

nathanmcnulty/Entra/operational-groups/per-user-mfa.ps1 at master · nathanmcnulty/nathanmcnulty Contribute to nathanmcnulty/nathanmcnulty development by creating an account on GitHub.

This week I discovered we couldn't use my Entra Operational Group to create the per-user MFA groups because GCC doesn't allow Graph PowerShell to get tokens that work with this API endpoint

This technique worked around this limitation, very cool! :)

github.com/nathanmcn...

Pro Tip: You can borrow Bearer tokens from your browser in the various Microsoft portals and use them with Graph PowerShell/CLI

This is useful when Graph API endpoints don't allow clients like Graph PowerShell/CLI to make requests, common on new endpoints or in GCC environments

MDM doesn't matter BTW

The combined mobileconfig and onboarding file could even be combined, but regardless, these are deployed as custom configuration profiles, AV policy can be via Settings Catalog, Endpoint security, Jamf schema, etc., and app via Intune or PKG from portal :)

Intune-based deployment for Microsoft Defender for Endpoint on macOS - Microsoft Defender for Endpoint Install Microsoft Defender for Endpoint on macOS, using Microsoft Intune.

Reminder when deploying Defender for Endpoint for macOS

You *could* do this the hard way:
learn.microsoft.com/...

Or you can do it the easy way:
github.com/microsoft...

You really just need 4 policies:

1) Permissions (combined)
2) Onboarding
3) AV policy
4) App installation

Seeing a lot of folks frustrated with the Microsoft.Graph #PowerShell SDK...missing modules, bloat, weird errors.

If you just need to hit a few endpoints without the overhead:
Install-Module Microsoft.Graph.Authentication
Connect-MgGraph
Invoke-MgGraphRequest

#MSGraph #Intune

Looks like the Entra QR code authentication method is going GA 🥳

They've also added some great guidance on suppressing the camera permission prompt for iOS :)

learn.microsoft.com/...

It all depends on the use case, imo

If you are really using it for lifecycle workflows and lots of entitlement management capabilities (especially custom extensions), then it might be worth it

To just do a few actions, quite expensive imo

At the speed of cloud!

(2x slower than a typical 486)

For very large orgs, I left a comment on line 16 where we might have to use loggedByService due to too many records. I'm testing now.

Final note - I can't find this option anywhere in Entra, and I feel like I'm pretty good at navigating the portal :p

learn.microsoft.com/en-us/entra/...

So now I'm stuck pulling ALL audit logs back and post processing, which brings me to my next "what the heck?" moment

This is no ordinary hashtable, they murdered this thing. It's arrays with unrelated key/value pairs inside of it, plus escaped quotes...

What a pain to work with

Many orgs have massive audit logs, so pulling them all back is not the best way to do this, except...

We can't actually filter on the things you want to for this, and the docs aren't clear which loggedByService corresponds to which API calls :-/

learn.microsoft.com/en-us/graph/...

My whining thread :p

I couldn't find any reports, queries, etc., to help us assess impact :(

The responsibilty to discover licensing costs was left to the customer with sparse instructions to go figure it out...

"Just look at your audit logs!"

learn.microsoft.com/en-us/entra/...