danielchronlund.com
Open in
urlscan Pro
192.0.78.24
Public Scan
Submitted URL: https://cda.ms/4rR
Effective URL: https://danielchronlund.com/2022/06/15/attack-surface-reduction-dashboard-for-microsoft-sentinel/?WT.mc_id=modinfra-00000-ro...
Submission: On June 15 via manual from NL — Scanned from NL
Effective URL: https://danielchronlund.com/2022/06/15/attack-surface-reduction-dashboard-for-microsoft-sentinel/?WT.mc_id=modinfra-00000-ro...
Submission: On June 15 via manual from NL — Scanned from NL
Form analysis 4 forms found in the DOM
POST https://danielchronlund.com/wp-comments-post.php
<form action="https://danielchronlund.com/wp-comments-post.php" method="post" id="commentform" class="comment-form" novalidate=""><input type="hidden" id="highlander_comment_nonce" name="highlander_comment_nonce" value="3230d11de9"><input
type="hidden" name="_wp_http_referer" value="/2022/06/15/attack-surface-reduction-dashboard-for-microsoft-sentinel/?WT.mc_id=modinfra-00000-rotrent">
<input type="hidden" name="hc_post_as" id="hc_post_as" value="guest">
<div class="comment-form-field comment-textarea">
<div id="comment-form-comment"><textarea id="comment" name="comment" title="Enter your comment here..." placeholder="Enter your comment here..." style="overflow: hidden; overflow-wrap: break-word; resize: none; height: 38px;"></textarea></div>
</div>
<div id="comment-form-identity" style="display: none;">
<div id="comment-form-nascar">
<p>Fill in your details below or click an icon to log in:</p>
<ul>
<li class="selected" style="display:none;">
<a href="#comment-form-guest" id="postas-guest" class="nascar-signin-link" title="Login via Guest">
</a>
</li>
<li>
<a href="#comment-form-load-service:WordPress.com" id="postas-wordpress" class="nascar-signin-link" title="Login via WordPress.com">
<svg xmlns="http://www.w3.org/2000/svg" role="presentation" viewBox="0 0 24 24"><rect x="0" fill="none" width="24" height="24"></rect><g><path fill="#0087be" d="M12.158 12.786l-2.698 7.84c.806.236 1.657.365 2.54.365 1.047 0 2.05-.18 2.986-.51-.024-.037-.046-.078-.065-.123l-2.762-7.57zM3.008 12c0 3.56 2.07 6.634 5.068 8.092L3.788 8.342c-.5 1.117-.78 2.354-.78 3.658zm15.06-.454c0-1.112-.398-1.88-.74-2.48-.456-.74-.883-1.368-.883-2.11 0-.825.627-1.595 1.51-1.595.04 0 .078.006.116.008-1.598-1.464-3.73-2.36-6.07-2.36-3.14 0-5.904 1.613-7.512 4.053.21.008.41.012.58.012.94 0 2.395-.114 2.395-.114.484-.028.54.684.057.74 0 0-.487.058-1.03.086l3.275 9.74 1.968-5.902-1.4-3.838c-.485-.028-.944-.085-.944-.085-.486-.03-.43-.77.056-.742 0 0 1.484.114 2.368.114.94 0 2.397-.114 2.397-.114.486-.028.543.684.058.74 0 0-.488.058-1.03.086l3.25 9.665.897-2.997c.456-1.17.684-2.137.684-2.907zm1.82-3.86c.04.286.06.593.06.924 0 .912-.17 1.938-.683 3.22l-2.746 7.94c2.672-1.558 4.47-4.454 4.47-7.77 0-1.564-.4-3.033-1.1-4.314zM12 22C6.486 22 2 17.514 2 12S6.486 2 12 2s10 4.486 10 10-4.486 10-10 10z"></path></g></svg> </a>
</li>
<li>
<a href="#comment-form-load-service:Twitter" id="postas-twitter" class="nascar-signin-link" title="Login via Twitter">
<svg xmlns="http://www.w3.org/2000/svg" role="presentation" viewBox="0 0 24 24"><rect x="0" fill="none" width="24" height="24"></rect><g><path fill="#1DA1F2" d="M22.23 5.924c-.736.326-1.527.547-2.357.646.847-.508 1.498-1.312 1.804-2.27-.793.47-1.67.812-2.606.996C18.325 4.498 17.258 4 16.078 4c-2.266 0-4.103 1.837-4.103 4.103 0 .322.036.635.106.935-3.41-.17-6.433-1.804-8.457-4.287-.353.607-.556 1.312-.556 2.064 0 1.424.724 2.68 1.825 3.415-.673-.022-1.305-.207-1.86-.514v.052c0 1.988 1.415 3.647 3.293 4.023-.344.095-.707.145-1.08.145-.265 0-.522-.026-.773-.074.522 1.63 2.038 2.817 3.833 2.85-1.404 1.1-3.174 1.757-5.096 1.757-.332 0-.66-.02-.98-.057 1.816 1.164 3.973 1.843 6.29 1.843 7.547 0 11.675-6.252 11.675-11.675 0-.178-.004-.355-.012-.53.802-.578 1.497-1.3 2.047-2.124z"></path></g></svg> </a>
</li>
<li>
<a href="#comment-form-load-service:Facebook" id="postas-facebook" class="nascar-signin-link" title="Login via Facebook">
<svg xmlns="http://www.w3.org/2000/svg" role="presentation" viewBox="0 0 24 24"><rect x="0" fill="none" width="24" height="24"></rect><g><path fill="#3B5998" d="M20.007 3H3.993C3.445 3 3 3.445 3 3.993v16.013c0 .55.445.994.993.994h8.62v-6.97H10.27V11.31h2.346V9.31c0-2.325 1.42-3.59 3.494-3.59.993 0 1.847.073 2.096.106v2.43h-1.438c-1.128 0-1.346.537-1.346 1.324v1.734h2.69l-.35 2.717h-2.34V21h4.587c.548 0 .993-.445.993-.993V3.993c0-.548-.445-.993-.993-.993z"></path></g></svg> </a>
</li>
</ul>
</div>
<div id="comment-form-guest" class="comment-form-service selected">
<div class="comment-form-padder">
<div class="comment-form-avatar">
<a href="https://gravatar.com/site/signup/" target="_blank"> <img src="https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G" alt="Gravatar" width="25" class="no-grav grav-hashed grav-hijack" id="grav-ad516503a11cd5ca435acc9bb6523536-0">
</a>
</div>
<div class="comment-form-fields">
<div class="comment-form-field comment-form-email">
<label for="email">Email <span class="nopublish">(Address never made public)</span></label>
<div class="comment-form-input"><input id="email" name="email" type="email" value=""></div>
</div>
<div class="comment-form-field comment-form-author">
<label for="author">Name</label>
<div class="comment-form-input"><input id="author" name="author" type="text" value=""></div>
</div>
<div class="comment-form-field comment-form-url">
<label for="url">Website</label>
<div class="comment-form-input"><input id="url" name="url" type="url" value=""></div>
</div>
</div>
</div>
</div>
<div id="comment-form-wordpress" class="comment-form-service">
<div class="comment-form-padder">
<div class="comment-form-avatar">
<img src="https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G" alt="WordPress.com Logo" width="25" class="no-grav grav-hashed grav-hijack"
id="grav-ad516503a11cd5ca435acc9bb6523536-1">
</div>
<div class="comment-form-fields">
<input type="hidden" name="wp_avatar" id="wordpress-avatar" class="comment-meta-wordpress" value="">
<input type="hidden" name="wp_user_id" id="wordpress-user_id" class="comment-meta-wordpress" value="">
<input type="hidden" name="wp_access_token" id="wordpress-access_token" class="comment-meta-wordpress" value="">
<p class="comment-form-posting-as pa-wordpress">
<strong></strong> You are commenting using your WordPress.com account. <span class="comment-form-log-out"> ( <a href="javascript:HighlanderComments.doExternalLogout( 'wordpress' );">Log Out</a> /
<a href="#" onclick="javascript:HighlanderComments.switchAccount();return false;">Change</a> ) </span>
<span class="pa-icon"><svg xmlns="http://www.w3.org/2000/svg" role="presentation" viewBox="0 0 24 24">
<rect x="0" fill="none" width="24" height="24"></rect>
<g>
<path fill="#0087be"
d="M12.158 12.786l-2.698 7.84c.806.236 1.657.365 2.54.365 1.047 0 2.05-.18 2.986-.51-.024-.037-.046-.078-.065-.123l-2.762-7.57zM3.008 12c0 3.56 2.07 6.634 5.068 8.092L3.788 8.342c-.5 1.117-.78 2.354-.78 3.658zm15.06-.454c0-1.112-.398-1.88-.74-2.48-.456-.74-.883-1.368-.883-2.11 0-.825.627-1.595 1.51-1.595.04 0 .078.006.116.008-1.598-1.464-3.73-2.36-6.07-2.36-3.14 0-5.904 1.613-7.512 4.053.21.008.41.012.58.012.94 0 2.395-.114 2.395-.114.484-.028.54.684.057.74 0 0-.487.058-1.03.086l3.275 9.74 1.968-5.902-1.4-3.838c-.485-.028-.944-.085-.944-.085-.486-.03-.43-.77.056-.742 0 0 1.484.114 2.368.114.94 0 2.397-.114 2.397-.114.486-.028.543.684.058.74 0 0-.488.058-1.03.086l3.25 9.665.897-2.997c.456-1.17.684-2.137.684-2.907zm1.82-3.86c.04.286.06.593.06.924 0 .912-.17 1.938-.683 3.22l-2.746 7.94c2.672-1.558 4.47-4.454 4.47-7.77 0-1.564-.4-3.033-1.1-4.314zM12 22C6.486 22 2 17.514 2 12S6.486 2 12 2s10 4.486 10 10-4.486 10-10 10z">
</path>
</g>
</svg></span>
</p>
</div>
</div>
</div>
<div id="comment-form-twitter" class="comment-form-service">
<div class="comment-form-padder">
<div class="comment-form-avatar">
<img src="https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G" alt="Twitter picture" width="25" class="no-grav grav-hashed grav-hijack" id="grav-ad516503a11cd5ca435acc9bb6523536-2">
</div>
<div class="comment-form-fields">
<input type="hidden" name="twitter_avatar" id="twitter-avatar" class="comment-meta-twitter" value="">
<input type="hidden" name="twitter_user_id" id="twitter-user_id" class="comment-meta-twitter" value="">
<input type="hidden" name="twitter_access_token" id="twitter-access_token" class="comment-meta-twitter" value="">
<p class="comment-form-posting-as pa-twitter">
<strong></strong> You are commenting using your Twitter account. <span class="comment-form-log-out"> ( <a href="javascript:HighlanderComments.doExternalLogout( 'twitter' );">Log Out</a> /
<a href="#" onclick="javascript:HighlanderComments.switchAccount();return false;">Change</a> ) </span>
<span class="pa-icon"><svg xmlns="http://www.w3.org/2000/svg" role="presentation" viewBox="0 0 24 24">
<rect x="0" fill="none" width="24" height="24"></rect>
<g>
<path fill="#1DA1F2"
d="M22.23 5.924c-.736.326-1.527.547-2.357.646.847-.508 1.498-1.312 1.804-2.27-.793.47-1.67.812-2.606.996C18.325 4.498 17.258 4 16.078 4c-2.266 0-4.103 1.837-4.103 4.103 0 .322.036.635.106.935-3.41-.17-6.433-1.804-8.457-4.287-.353.607-.556 1.312-.556 2.064 0 1.424.724 2.68 1.825 3.415-.673-.022-1.305-.207-1.86-.514v.052c0 1.988 1.415 3.647 3.293 4.023-.344.095-.707.145-1.08.145-.265 0-.522-.026-.773-.074.522 1.63 2.038 2.817 3.833 2.85-1.404 1.1-3.174 1.757-5.096 1.757-.332 0-.66-.02-.98-.057 1.816 1.164 3.973 1.843 6.29 1.843 7.547 0 11.675-6.252 11.675-11.675 0-.178-.004-.355-.012-.53.802-.578 1.497-1.3 2.047-2.124z">
</path>
</g>
</svg></span>
</p>
</div>
</div>
</div>
<div id="comment-form-facebook" class="comment-form-service">
<div class="comment-form-padder">
<div class="comment-form-avatar">
<img src="" alt="Facebook photo" width="25" class="no-grav">
</div>
<div class="comment-form-fields">
<input type="hidden" name="fb_avatar" id="facebook-avatar" class="comment-meta-facebook" value="">
<input type="hidden" name="fb_user_id" id="facebook-user_id" class="comment-meta-facebook" value="">
<input type="hidden" name="fb_access_token" id="facebook-access_token" class="comment-meta-facebook" value="">
<p class="comment-form-posting-as pa-facebook">
<strong></strong> You are commenting using your Facebook account. <span class="comment-form-log-out"> ( <a href="javascript:HighlanderComments.doExternalLogout( 'facebook' );">Log Out</a> /
<a href="#" onclick="javascript:HighlanderComments.switchAccount();return false;">Change</a> ) </span>
<span class="pa-icon"><svg xmlns="http://www.w3.org/2000/svg" role="presentation" viewBox="0 0 24 24">
<rect x="0" fill="none" width="24" height="24"></rect>
<g>
<path fill="#3B5998"
d="M20.007 3H3.993C3.445 3 3 3.445 3 3.993v16.013c0 .55.445.994.993.994h8.62v-6.97H10.27V11.31h2.346V9.31c0-2.325 1.42-3.59 3.494-3.59.993 0 1.847.073 2.096.106v2.43h-1.438c-1.128 0-1.346.537-1.346 1.324v1.734h2.69l-.35 2.717h-2.34V21h4.587c.548 0 .993-.445.993-.993V3.993c0-.548-.445-.993-.993-.993z">
</path>
</g>
</svg></span>
</p>
</div>
</div>
</div>
<div id="comment-form-load-service" class="comment-form-service">
<div class="comment-form-posting-as-cancel"><a href="javascript:HighlanderComments.cancelExternalWindow();">Cancel</a></div>
<p>Connecting to %s</p>
</div>
</div>
<script type="text/javascript">
var highlander_expando_javascript = function() {
function hide(sel) {
var el = document.querySelector(sel);
if (el) {
el.style.setProperty('display', 'none');
}
}
function show(sel) {
var el = document.querySelector(sel);
if (el) {
el.style.removeProperty('display');
}
}
var input = document.createElement('input');
var comment = document.querySelector('#comment');
if (input && comment && 'placeholder' in input) {
var label = document.querySelector('.comment-textarea label');
if (label) {
var text = label.textContent;
label.parentNode.removeChild(label);
comment.setAttribute('placeholder', text);
}
}
// Expando Mode: start small, then auto-resize on first click + text length
hide('#comment-form-identity');
hide('#comment-form-subscribe');
hide('#commentform .form-submit');
if (comment) {
comment.style.height = '10px';
var handler = function() {
comment.style.height = HighlanderComments.initialHeight + 'px';
show('#comment-form-identity');
show('#comment-form-subscribe');
show('#commentform .form-submit');
HighlanderComments.resizeCallback();
comment.removeEventListener('focus', handler);
};
comment.addEventListener('focus', handler);
}
}
if (document.readyState !== 'loading') {
highlander_expando_javascript();
} else {
document.addEventListener('DOMContentLoaded', highlander_expando_javascript);
}
</script>
<div id="comment-form-subscribe" style="display: none;">
<p class="comment-subscription-form"><input type="checkbox" name="subscribe" id="subscribe" value="subscribe" style="width: auto;"> <label class="subscribe-label" id="subscribe-label" for="subscribe" style="display: inline;">Notify me of new
comments via email.</label></p>
<p class="post-subscription-form"><input type="checkbox" name="subscribe_blog" id="subscribe_blog" value="subscribe" style="width: auto;"> <label class="subscribe-label" id="subscribe-blog-label" for="subscribe_blog"
style="display: inline;">Notify me of new posts via email.</label></p>
</div>
<p class="form-submit" style="display: none;"><input name="submit" type="submit" id="comment-submit" class="submit" value="Post Comment"> <input type="hidden" name="comment_post_ID" value="1363" id="comment_post_ID">
<input type="hidden" name="comment_parent" id="comment_parent" value="0">
</p>
<p style="display: none;"><input type="hidden" id="akismet_comment_nonce" name="akismet_comment_nonce" value="5ffa9c9db5"></p>
<input type="hidden" name="genseq" value="1655314934">
<p style="display: none !important;"><label>Δ<textarea name="ak_hp_textarea" cols="45" rows="8" maxlength="100"></textarea></label><input type="hidden" id="ak_js_1" name="ak_js" value="1655314934993">
<script>
document.getElementById("ak_js_1").setAttribute("value", (new Date()).getTime());
</script>
</p>
</form>GET https://danielchronlund.com/
<form role="search" method="get" class="search-form" action="https://danielchronlund.com/">
<label>
<span class="screen-reader-text">Search for:</span>
<input type="search" class="search-field" placeholder="Search …" value="" name="s">
</label>
<input type="submit" class="search-submit" value="Search">
</form>POST https://subscribe.wordpress.com
<form method="post" action="https://subscribe.wordpress.com" accept-charset="utf-8" style="display: none;">
<div class="actnbr-follow-count">Join 240 other followers</div>
<div>
<input type="email" name="email" placeholder="Enter your email address" class="actnbr-email-field" aria-label="Enter your email address">
</div>
<input type="hidden" name="action" value="subscribe">
<input type="hidden" name="blog_id" value="154548003">
<input type="hidden" name="source" value="https://danielchronlund.com/2022/06/15/attack-surface-reduction-dashboard-for-microsoft-sentinel/?WT.mc_id=modinfra-00000-rotrent">
<input type="hidden" name="sub-type" value="actionbar-follow">
<input type="hidden" id="_wpnonce" name="_wpnonce" value="c531e9db6c">
<div class="actnbr-button-wrap">
<button type="submit" value="Sign me up"> Sign me up </button>
</div>
</form><form id="jp-carousel-comment-form">
<label for="jp-carousel-comment-form-comment-field" class="screen-reader-text">Write a Comment...</label>
<textarea name="comment" class="jp-carousel-comment-form-field jp-carousel-comment-form-textarea" id="jp-carousel-comment-form-comment-field" placeholder="Write a Comment..."></textarea>
<div id="jp-carousel-comment-form-submit-and-info-wrapper">
<div id="jp-carousel-comment-form-commenting-as">
<fieldset>
<label for="jp-carousel-comment-form-email-field">Email</label>
<input type="text" name="email" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-email-field">
</fieldset>
<fieldset>
<label for="jp-carousel-comment-form-author-field">Name</label>
<input type="text" name="author" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-author-field">
</fieldset>
<fieldset>
<label for="jp-carousel-comment-form-url-field">Website</label>
<input type="text" name="url" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-url-field">
</fieldset>
</div>
<input type="submit" name="submit" class="jp-carousel-comment-form-button" id="jp-carousel-comment-form-button-submit" value="Post Comment">
</div>
</form>Text Content
Skip to content
Daniel Chronlund Cloud Tech Blog
News, tips and thoughts for Microsoft cloud fans
* Twitter
* LinkedIn
Menu
* Home
* DCToolbox
* Conditional Access Baseline
* Conditional Access Automation
* About Daniel
ATTACK SURFACE REDUCTION DASHBOARD FOR MICROSOFT SENTINEL
Daniel Chronlund Cloud, Microsoft, Microsoft Sentinel, Security June 15,
2022June 15, 2022 2 Minutes
Before we start, my Microsoft Sentinel contributions have a new home on GitHub!
I will gather all my Sentinel resources in one central repo called
DCSecurityOperations. This is a sister project to my DCToolbox repo.
Today I’m happy to announce my new Attack Surface Reduction Dashboard. This
dashboard helps you implement the ASR rules of Windows/Defender, and to monitor
them over time. The dashboard can filter on rules in Audit mode and Block mode.
WHAT YOU CAN SEE IN THE DASHBOARD
Before showing you the data in your tenant, the dashboard will give you an
overview of all available ASR rules in Windows, with descriptions and docs
links. There are currently (as of 15/6-22) 16 different ASR rules in Windows.
You can find their documentation here. The rules reference is followed by some
instructions on how to use the dashboard.
Now it gets interesting. There are some filters you can apply in the dashboard.
First you need to decide if you are interested in rules running in audit mode or
block mode. Select the time range. After that you can, if you want to, filter on
specific rules, devices or users. This is optional. The filters you set will
affect all graphs in the dashboard.
The first graph is a timeline of all ASR events in the current time frame. This
is great for understanding when problems arise, key indications in a security
incident investigation, etc.
You will then see pie charts of the number of ASR events by Rule, Device or
User. Finally, at the bottom, you will get a detailed event log where you can
dive into specifics about ASR events, like which application triggered it, and
what it tried to do. This is incredibly powerful when investigating ASR
incidents, or when building exclusion policies during ASR deployment.
INSTALL THE ATTACK SURFACE REDUCTION DASHBOARD IN MICROSOFT SENTINEL
First, download (or copy) the latest version (it’s a JSON file) of Attack
Surface Reduction Dashboard from my GitHub.
Go to your Microsoft Sentinel workspace and click on Workbooks. Add a new
workbook.
A new workbook will appear based on the default template. Click on Edit and the
Advanced Editor button. This will allow you to replace the entire JSON content
with the one from my GitHub repo.
Replace the JSON content and click on Apply. The new workbook will now appear
and you can start to use it. Easy!
Finally, to permanently save the workbook in Sentinel, click on the save icon at
the top and select the same Azure resource group as your Sentinel workspace (or
else it won’t show up in Sentinel). Also set the Title to Attack Surface
Reduction Dashboard. You’re all set!
Note that you can do this without Microsoft Sentinel as long as you are
exporting your Azure AD audit logs to an Azure Log Analytics workspace. Just do
the same procedure in Azure AD workbooks instead:
https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Workbooks
SUMMARY
I hope that the Attack Surface Reduction Dashboard can help you understand the
ASR rules and their events in your tenant, and prevent bad configuration,
security incidents, and ease deployment.
Please follow me here, on LinkedIn, and on Twitter!
@DanielChronlund
SHARE THIS:
* Twitter
* Facebook
*
LIKE THIS:
Like Loading...
* Tagged
* Cloud
* Microsoft
* Microsoft Sentinel
* Security
PUBLISHED BY DANIEL CHRONLUND
Daniel is an IT consultant at Altitude 365, specialized in Microsoft cloud
infrastructure design and implementation. Daniel provides consultative services
around Azure IaaS and PaaS services, Microsoft 365, EM+S and Office 365. He
helps customers to work smarter, more secure and to get the most value out of
the Microsoft cloud. View all posts by Daniel Chronlund
Published June 15, 2022June 15, 2022
POST NAVIGATION
Previous Post A Powerful Conditional Access Change Dashboard for
Microsoft Sentinel
LEAVE A REPLY
Fill in your details below or click an icon to log in:
*
*
*
*
Email (Address never made public)
Name
Website
You are commenting using your WordPress.com account. ( Log Out / Change )
You are commenting using your Twitter account. ( Log Out / Change )
You are commenting using your Facebook account. ( Log Out / Change )
Cancel
Connecting to %s
Notify me of new comments via email.
Notify me of new posts via email.
Δ
Search for:
RECENT POSTS
* Attack Surface Reduction Dashboard for Microsoft Sentinel
* A Powerful Conditional Access Change Dashboard for Microsoft Sentinel
* Monitor Conditional Access with Microsoft Sentinel
* Using Windows 365 for Cloud Based Privileged Access Workstations (PAW)
* The Attackers Guide to Azure AD Conditional Access
* How To Find Valuable Targets in an Azure AD Tenant by Mapping the
Entire Organisation
* Scary Azure AD Tenant Enumeration… Using Regular B2B Guest Accounts
* Require Privileged Workstation for Admin Access with Conditional Access
* Azure MFA SMS and Voice Call Methods Cleanup Tool
* Conditional Access Ring Based Deployment with DCToolbox
* Activate your Azure AD PIM roles with PowerShell
* Find Your Weakest Link and Fix It! – A Layered Approach to Microsoft
365 Security
* “My Azure AD has been breached! What now?”
* Manage Teams External Access for Allowed Domains Using PowerShell and
Teams Approvals
* How To: Optimize Office 365 Network Performance
* How To: Get Started With Zero Trust in Microsoft 365
* Azure AD Conditional Access Policy Design Baseline with Automatic
Deployment Support
* How to Manage Conditional Access as Code – The Ultimate Guide
* DCToolbox PowerShell Module for Microsoft 365 Security, Conditional Access
Automation, and more
* Export your Conditional Access Policy Assignments to Excel
CATEGORIES
* Azure
* Azure AD
* Azure Automation
* Azure DevOps
* Cloud
* Conditional Access
* EMS
* Exchange Online
* Flow
* Graph
* Intune
* MFA
* Microsoft
* Microsoft 365
* Microsoft Endpoint Manager
* Microsoft Sentinel
* Microsoft Teams
* Office 365
* Office 365 ATP
* Password-less
* PAW
* PowerShell
* Secure Score
* Security
* Windows 365
* Zero Trust
RECENT POSTS
* Attack Surface Reduction Dashboard for Microsoft Sentinel June 15, 2022
* A Powerful Conditional Access Change Dashboard for Microsoft Sentinel April
21, 2022
* Monitor Conditional Access with Microsoft Sentinel April 13, 2022
* Using Windows 365 for Cloud Based Privileged Access Workstations (PAW)
January 13, 2022
* The Attackers Guide to Azure AD Conditional Access January 7, 2022
* How To Find Valuable Targets in an Azure AD Tenant by Mapping the
Entire Organisation November 23, 2021
* Scary Azure AD Tenant Enumeration… Using Regular B2B Guest Accounts November
18, 2021
* Require Privileged Workstation for Admin Access with Conditional Access
November 2, 2021
* Azure MFA SMS and Voice Call Methods Cleanup Tool October 7, 2021
* Conditional Access Ring Based Deployment with DCToolbox September 21, 2021
* Activate your Azure AD PIM roles with PowerShell September 17, 2021
* Find Your Weakest Link and Fix It! – A Layered Approach to Microsoft
365 Security April 5, 2021
* “My Azure AD has been breached! What now?” March 29, 2021
* Manage Teams External Access for Allowed Domains Using PowerShell and
Teams Approvals February 22, 2021
* How To: Optimize Office 365 Network Performance January 20, 2021
* How To: Get Started With Zero Trust in Microsoft 365 January 13, 2021
* Azure AD Conditional Access Policy Design Baseline with Automatic
Deployment Support November 26, 2020
* How to Manage Conditional Access as Code – The Ultimate Guide November 25,
2020
* DCToolbox PowerShell Module for Microsoft 365 Security, Conditional Access
Automation, and more November 9, 2020
* Export your Conditional Access Policy Assignments to Excel October 20, 2020
* Is it necessary to back up your data in Office 365 externally? September 16,
2020
* Checklist: How to Not Fall for Fake Office 365 Email Phishing Attempts August
5, 2020
* The Excel version of my Azure AD Conditional Access Policy Design Baseline is
Now Available Online August 3, 2020
* Quickly Check and Manage your Exchange Online DNS Records for SPF, DKIM and
DMARC with PowerShell April 29, 2020
* Azure AD Log Export Security Considerations April 27, 2020
* Azure AD Password Spray Attacks with PowerShell and How to Defend your Tenant
March 17, 2020
* Automatic Azure AD User Account Enumeration with PowerShell (Scary Stuff)
March 13, 2020
* How to Automate Renewal of Android Dedicated Devices Enrollment Tokens and QR
Codes in MEM (Solve the 90 Day Limit Issue) February 26, 2020
* My Collection of Basic Microsoft Graph PowerShell Functions February 26, 2020
* Microsoft Endpoint Manager Multi-Platform Compliance Security Misses January
23, 2020
* Monitor your Azure AD Break Glass Accounts with Azure Monitor January 22,
2020
* MEM Enrollment Slideshow – Corporate iOS Device via Apple Business Manager
January 9, 2020
* MEM Enrollment Slideshow – Corporate iOS Device via Apple Configurator
January 8, 2020
* Configure Office 365 ATP Like a Pro with ORCA January 7, 2020
* MEM Enrollment Slideshow – Corporate Fully Managed Android Device via QR Code
January 3, 2020
* MEM Enrollment Slideshow – Personal Android Device with a Work Profile via
Company Portal January 3, 2020
* MEM Enrollment Slideshow – Personal iOS Device via Company Portal January 2,
2020
* Gamification with Microsoft Secure Score December 16, 2019
* Automatic Deployment of Conditional Access with PowerShell and
Microsoft Graph November 7, 2019
* Safe Conditional Access Deployment with Report-Only Mode and the
Insights Dashboard November 7, 2019
* Intune App Protection Policies vs Android Enterprise Work Profiles October
29, 2019
* Microsoft EMS in Plain English October 9, 2019
* The Fearsome Five – Top Five Cyber Threats in the Cloud in 2020 October 1,
2019
* An Azure AD Break Glass Routine Template for your Organization September 30,
2019
* Measure your Azure AD MFA and Self-Service Password Reset Success August 26,
2019
* Global Admins – Why are humans so lazy? August 23, 2019
* Monitoring Microsoft 365 with Azure Sentinel (From a Hammock) July 2, 2019
* Password Hash Sync – You Already Trust Microsoft with Your Data so Why not
Trust Them with the Authentication as Well? May 16, 2019
* Source Control for All Your Automation using Azure DevOps and Azure
Automation Together May 15, 2019
* Build Information Barriers in Microsoft Teams to Segregate Groups of Users
May 2, 2019
Blog at WordPress.com.
* Follow Following
* Daniel Chronlund Cloud Tech Blog
Join 240 other followers
Sign me up
* Already have a WordPress.com account? Log in now.
* * Daniel Chronlund Cloud Tech Blog
* Customize
* Follow Following
* Sign up
* Log in
* Copy shortlink
* Report this content
* View post in Reader
* Manage subscriptions
* Collapse this bar
Loading Comments...
Write a Comment...
Email Name Website
%d bloggers like this: