Marcus Ekström

M365 Security @ Advitum, Microsoft Certified in Security and Modern Work

[Marcus Ekström @MarcusEkstromm]

@merill Can’t wait any longer! 😄

[Marcus Ekström @MarcusEkstromm]

@acjuelich @xenappblog @Microsoft @MSIntune You can still onboard servers to MDE with GPO without using Azure Arc. Then use direct onboarding in Defender for Cloud to cover the licensing. However, I would be cautious about recommending Azure Arc if the customer isn’t familiar with how to secure the deployment.

[Marcus Ekström @MarcusEkstromm]

@IAMERICAbooted Add Application Administrator and Cloud Application Administrator to your list.

How many organizations actually audit when someone creates a new client secret for an app registration that already has granted privilege permissions? 😊

[Marcus Ekström @MarcusEkstromm]

@IAMERICAbooted Production tenant with M365 E3 + E5 Security

[Marcus Ekström @MarcusEkstromm]

@JenMsft CTRL + SHIFT + V = Paste as plain text.

Have you ever had problems when doing copy + paste in Teams? 🙌🏼

[Marcus Ekström @MarcusEkstromm]

@IoanPopovici Will there be any differences compared to the functionality provided by PSADT?

[Marcus Ekström @MarcusEkstromm]

@bobiroc @samilaiho 0 = Disabled (does not work anymore)
1 = Compability mode
2 = Full Enforcement mode

[Marcus Ekström @MarcusEkstromm]

@NathanMcNulty If you use AVD, you can hide this prompt for your AVD-hosts. It might also be possible with Bastion if you consent and configure the service principal, but I’m not sure. However, it should not work in your case since you have Bastion in another tenant.

https://t.co/BgkrF6MLOP

[Marcus Ekström @MarcusEkstromm]

@machadof1p @EricaZelic Yes. You should also add your external address for VPN (if it’s another one).

Assume that you work from home and connects to your company’s VPN with force tunneling. Then Entra IP would raise a risk/event for impossible travel. With the IP specified, no risk will be raised.

[Marcus Ekström @MarcusEkstromm]

@RicksterCDN Nice!!

[Marcus Ekström @MarcusEkstromm]

@RicksterCDN @_lemitzi_ @events_msft Thanks for your feedback! 😊

[Marcus Ekström @MarcusEkstromm]

@_lemitzi_ @events_msft +1 on this!

[Marcus Ekström @MarcusEkstromm]

@blueteam_rob Great that everything is solved and thanks for your feedback.

[Ru Campbell @rucam365]

Updated guidance for emergency access accounts is to use FIDO2 or CBA.

This is part of the mandatory MFA requirement in Azure portals and clients.

FIDO2 has no dependency on the Azure MFA service; a common reason for break glass MFA exclusions.

ref: https://t.co/4DqGljXz3n

[Marcus Ekström @MarcusEkstromm]

@merill Ping @merill

[Marcus Ekström @MarcusEkstromm]

@merill Some new info around licensing for admin accounts? You and Alex Simons stated that it’s one license per human around 2021. But did Microsoft ever documented this?

[Ru Campbell @rucam365]

Can someone plz steel man the argument for this, because on the surface it just sounds like a problem waiting to happen.

[Marcus Ekström @MarcusEkstromm]

@Investeraren @AntonIngman Det är 30$ extra för dem med M365 E3, E5, Business Standard eller Premium.

Många företag tampas fortfarande med att komma upp i ”rätt” licensnivå för ökad säkerhet. Jag tror att de kommer ta tid innan företag även adderar denna licens.

https://t.co/FWWnLgEQCC

[Intune Support Team @IntuneSuppTeam]

We're excited to announce a new @Microsoft365 Apps for #EnterpriseSecurity baseline & an updated version of the @MicrosoftEdge security baseline - Now included in the May (2305) release of @MSIntune!

➡️ Learn more: https://t.co/CGBOmPF6le

#MSIntune #Microsoft365 #MicrosoftEdge