Office365

Enable self-service Password reset with Azure AD Premium (Best Practice 4/10)

Carlos A Lopez (Twitter: @CLopezDC) Office365

Self-Service Password Reset (SSPR) enables users to quickly get unblocked and continue working no matter where they are or the time of day. By allowing users to unblock themselves, your organization can reduce the non-productive time and high support costs for most common password-related issues.

Best practice: Set up self-service password reset (SSPR) for your users. Use the Azure AD self-service password reset feature.

Best practice: Monitor how or if SSPR is really being used. Monitor the users who are registering by using the Azure AD Password Reset Registration Activity report. The reporting feature that Azure AD provides helps you answer questions by using prebuilt reports. If you’re appropriately licensed, you can also create custom queries.

Best practice: Extend cloud-based password policies to your on-premises infrastructure. Detail: Enhance password policies in your organization by performing the same checks for on-premises password changes as you do for cloud-based password changes. Install Azure AD password protection for Windows Server Active Directory agents on-premises to extend banned password lists to your existing infrastructure. Users and admins who change, set, or reset passwords on-premises are required to comply with the same password policy as cloud-only users.

Enable single sign-on for the Microsoft Cloud and all other Cloud Services (Best Practice 2/10):

Carlos A Lopez (Twitter: @CLopezDC) Office365

We live now in a mobile-first, cloud-first world and to simplify the authentication process it is recommended to enable single sign-on (SSO) to devices, apps, and services, allowing the users to access cloud resources from anywhere. The challenge we have seem with the end-users it’s that when you have multiple identity solutions to manage, this becomes an administrative problem not only for IT but also for users who have to remember multiple passwords. By using the same identity solution for all your apps and resources, you can achieve SSO. And your users can use the same set of credentials to sign in and access the resources that they need, whether the resources are located on-premises or in the cloud.

Best practice: Enable SSO. Azure AD extends on-premises Active Directory to the cloud. Users can use their primary work or school account for their domain-joined devices, company resources, and all of the web and SaaS applications that they need to get their jobs done. Users don’t have to remember multiple sets of usernames and passwords, and their application access can be automatically provisioned (or deprovisioned) based on their organization group memberships and their status as an employee. And you can control that access for gallery apps or for your own on-premises apps that you’ve developed and published through the Azure AD Application Proxy.

Organizations that don’t create a common identity to establish SSO for their users and applications are more exposed to scenarios where users have multiple passwords. These scenarios increase the likelihood of users reusing passwords or using weak passwords.

Prevent Data Leakage using Exchange Online Transport Rules and Raise the Office365 Secure Score

Carlos A Lopez (Twitter: @CLopezDC) AAD Connect, Cloud Security, Exchange Online, Microsoft Security, Office365 , , ,

Over the last month, two clients contacted me requesting immediate support to mitigate and stop the data leakage caused by compromised credentials of specific users in Office365 and Exchange Online. The use of Multi-Factor Authentication has become a best practice and could have prevented this situation. However, there are other security controls that we recommend putting in place to prevent data leakage from Office365.

The bad actors’ “modus operandi” it is usually the same. After compromising the account, hackers access the compromised mailbox using OWA or perhaps Outlook, and setup multiple mailboxes rules. Some of these rules are to exfiltrate data of the organization such as auto-forwarding or send phishing emails to saved contacts and expand their malicious activity. Usually, the last mailbox rules we have identified is to automatically delete their activity from the “Sent Items” folder so it will be unnoticeable by the user.

One of the ways we can help stop data exfiltration from client created rules is using Exchange Transport Rules. Implementing a Transport Rule based around the following can stop emails that are set to be Auto-Forwarded to an external address.

In summary you create a rule based on the following logic.

  • IF The Sender is located ‘Inside the organization’
  • AND IF The Recipient is located ‘Outside the organization’
  • AND IF The message type is ‘Auto-Forward’
  • THEN Reject the message with the explanation ‘External Email Forwarding via Client Rules is not permitted’.

Transport Rule

This will stop delivery of the Auto-Forward message and issue an NDR message to the sender. Exceptions can be also created if needed.

Similarly, this will help you to increase your Office365 Secure Score which now has a new security control called ‘Client Rules Forwarding Blocks’ that implements a Transport Rule to help mitigate client created rules that Auto-Forward to external addresses.