Before V3, credentials like a username and password (safely stored in Azure Key Vault) could be used to sign into an administrator account and run Exchange cmdlets. Previously, I covered how to use Exchange Online PowerShell with Azure Automation.
Exchange Online, Azure Automation, and Managed Identities This sparked the idea of writing about how to use the new support for managed identities in the Exchange Online management module (V3) to check for audit events that might disclose problems. DART likes to look in the Azure AD audit log, Azure AD sign-ins, and the Office 365 audit log (aka the unified audit log) to find traces of bad guy activity. Microsoft VP for Security Alex Weinert’s words about the importance of protecting all Azure AD accounts with MFA must have had special meaning to the folks who owned the compromised tenant.Īll of which brings me to an article by the Microsoft cybersecurity team (DART) where they review important sources of forensic information for investigations. However, as we covered before, a compromised Azure AD administrator account can lead to attackers hijacking Exchange Online in a tenant. On-premises servers that aren’t so well managed are easy targets for the bad guys, and there are just too many of those kinds of servers still around.īecause of the barriers erected to protect Microsoft 365, Exchange Online is usually safe from these kinds of exploits. On the on-premises front, two new day-zero vulnerabilities appeared as another unpleasant reminder of the dangers lurking on the internet when attackers figure out new ways to penetrate even well-managed servers. It’s been a busy time for those who worry about the security of Exchange.
Securing Mailboxes Against Applications.Assigning Graph Permissions to a Managed Identity.Exchange Online, Azure Automation, and Managed Identities.
0 kommentar(er)
