Getting started with FIDO2 authentication in Office 365

Arjan Cornelissen
With this post, I will take you on the journey to enable FIDO authentication for Office 365 as an alternative to the Authenticator app or as an addition to the Authenticator app. What is FIDO FIDO stands for “Fast IDentity Online” and provides a passwordless authentication method with a passkey like the Yubikey 5. FIDO allows you to log into many websites and devices without entering a password. In-depth information about FIDO can be found on the FIDO Alliance website.

Enable PIM role thru Microsoft Graph PowerShell

Arjan Cornelissen
Five years ago, I wrote an article about enabling PIM roles with Powershell, and last week I took it upon myself to convert it using the Microsoft Graph PowerShell modules Why would you move? The primary reason to start moving to the graph modules is that the AzureAD and other modules were declared deprecated last year; see this post for all the details The modules still work but will not get any updates anymore.

Three easy tips on reducing SPAM in Office 365

Arjan Cornelissen
I wanted to do a write up of the tips I found in Office 365 to reduce the number of unwanted messages in Office 365. I will skip the most basic ones like adding the SPF record as this is told by the domain configuration that you need that. The more advanced once and usually not configured settings can bring you more. Let us start with the anti-spam policy, this one is configured with the basic settings, but are very loose.

Access reviews

Arjan Cornelissen
So, what is Access Review? It is an Azure solution that can assist in the reduction of access to guests in your tenant and access to applications for your users. This tool can assist you in doing automated reviews of access to certain Enterprise applications or on AD groups in your tenant. See this YouTube video for a detailed explanation The downside of this tool is that it is only available when you have Azure AD P2 or EMS E5 license.

How to set up a break glass account and why in Office 365

Arjan Cornelissen
Let’s kick this post of what I mean with a break glass account. What is a break glass account? A break glass account is a non-personal in case of an emergency account that is never used and is stored in a vault where only a few people have access too. This account is a global admin on your tenant and in some sense is the top-level account of your environment.

How to use Azure AD Terms of use

Arjan Cornelissen
What is Azure AD Terms of use? Within Azure AD conditional Access there is an option called Terms of use. As Microsoft explains it: “Azure AD Terms of use provides a simple method that organizations can use to present information to end users. This presentation ensures users see relevant disclaimers for legal or compliance requirements.” So basically, you will give the end users a popup or screen when they login with a disclaimer for legal or compliance reasons.

DIWUG December 2018

This week I had the privilege to speak at DIWUG about securing your Office 365 environment. This time I started from a governance point of view. So what policies do we have and do we need before we can set up the security in Office 365. Also what licenses are available and do we need additional licenses to satisfy our security needs. In the demos I showed how Conditional Access can help securing the environment and how Terms of use can be used for certain user groups or applications.

SharePoint Saturday Genève

Today I had the privilege to speak at SharePoint Saturday Genève. I did a session about security in a cloud environment when you are moving from an on-premises environment to the cloud. The security then moves from your perimeter network to the user’s identity. The session gave an overview of the tools in Azure AD to secure the cloud identity. [slideshare id=125157044&doc=20181206-spsgenevewearemovingtothecloudwhataboutsecurity-181206131838]

Enable PIM role with PowerShell

Arjan Cornelissen
At my customer we are using Privileged Identity Management (PIM) for all admin related tasks, no employee has standing access within the company. What is PIM Let’s first start by explaining Privileged Identity Management. It is a service that is available in Azure AD and is part of Azure AD Plan 2. For a user to use it, they need this plan enabled. PIM makes it possible to give a user the privilege to elevate his or her access rights for a preset amount of time to a higher role such as User Administrator or SharePoint Administrator.