Notes

This is where I will keep notes on things I am researching as well as most of the quick tips that I share on social media :)

In this section

• Azure

  Start here

  • Ingest Azure Activity Logs into Sentinel: Collect the control-plane events before you need to investigate.
  • Check Log Analytics ingestion delay: See when records actually became available to query.
  • Limit Azure Arc management capabilities: Review what Azure permissions can do on your connected servers.
  • Check Log Analytics ingestion delay
    Compare event and ingestion timestamps to see how long records take to reach Log Analytics.
  • Enable Azure cost anomaly alerts
    Set up free cost anomaly alerts to help catch unexpected Azure spending.
  • Enable Defender for Servers Plan 1 on selected machines
    Use resource-level Defender for Servers Plan 1 and built-in Azure Policy for selected machines.
  • Ingest Azure Activity Logs into Sentinel
    Collect Azure Activity Logs in Sentinel and check which tables have ingestion charges.
  • Limit Azure Arc management capabilities
    Use monitor mode and local extension controls to limit what Azure Arc can do on your servers.
  • Look up Azure service IP ranges
    Retrieve Azure service tag address ranges with PowerShell for outbound filtering.
• Defender

  Start here

  • Keep Defender AV notifications visible: Let users see when Defender finds something malicious.
  • Check which Defender email policy wins: Check policy scope and precedence before changing more settings.
  • FQDN filtering and NRPT: Understand the shared-IP problem before blocking whole domains.
  • Check which Defender email policy wins
    Check preset policy scope before expecting a custom email protection policy to apply.
  • Defender Firewall FQDN filtering - prefer NRPT for broad blocks
    Prefer NRPT for DNS namespace blocks to avoid shared-IP fallout from broad Firewall FQDN rules.
  • Defender for Identity Labs
    Practice Defender for Identity alert investigation in an isolated, planned lab.
  • Keep Defender AV notifications visible
    Keep useful Defender Antivirus notifications without all the noncritical noise.
  • Query commonly abused binaries
    Hunt for copied or renamed ie4uinit processes with version metadata and context.
  • Simplify MDE for macOS deployment
    Bundle several Defender macOS permissions in one profile, then check the remaining deployment requirements.
• Entra

  Start here

  • Understand Conditional Access: Start with how authentication and policy requirements fit together.
  • Audit device code flow: Find legitimate use before testing a default block.
  • Review PIM alerts: Find identity recommendations and check the affected accounts before fixing them.
  • Audit device code flow before blocking it
    Find device code sign-ins and test a Conditional Access block before enforcing it.
  • Block unknown and unsupported platforms
    Block unknown client platform claims with a carefully tested Conditional Access policy.
  • Check Entra LAPS password history
    Retrieve available Entra LAPS password history with Get-LapsAADPassword.
  • Common misunderstandings of Conditional Access
    Check how authentication and policy requirements combine before treating a blocked sign-in as resolved.
  • Getting more data from the CA Insights and Reporting Workbook
    Quick tip on using workbooks to create KQL queries and get more data than provided by the workbook
  • Hello for Business Guidance
    Check cloud Kerberos trust prerequisites before using Hello for on-premises SSO.
  • Improving Microsoft's authentication rollout templates
    Save time on Entra rollout communications with Microsoft's customizable end-user materials.
  • Microsoft Graph PowerShell examples for Application Management
    Use reviewed Graph PowerShell samples to report application credential expiry.
  • PIM Alerts is a hidden gem
    Review PIM security alerts for useful identity recommendations and in-portal fixes.
  • Scope application access to mailboxes
    Limit Exchange application permissions to the mailboxes an app actually needs.
  • Use a browser profile for cloud admin accounts
    Keep admin sessions separate while allowing device-based Conditional Access checks.
  • Use the authentication registration report
    Filter the Graph authentication registration report instead of querying every user's methods.
• Intune
  • Check out Intune Multi Admin Approval
    Require a second admin to approve protected Intune changes before they are applied.
• Purview
  • Enable all auditable events
    The defaults are better than they used to be, but you can still do better.
• Other

  Start here

  • Capture browser network traffic: Troubleshoot awkward browser issues with the built-in NetLog capture.
  • Check lookalike domains: Start a reviewed baseline for domain impersonation checks.
  • Review Protected Users: Test stronger protections for privileged Active Directory accounts.
  • Capture network traffic in Chrome and Edge
    Use the browser's built-in NetLog capture to troubleshoot awkward network issues.
  • Check lookalike domains with dnstwist
    Find and triage domain variants that could be used to impersonate your organization.
  • Collect files with OneDrive file requests
    Use an upload-only link to collect files without exposing the destination folder.
  • PowerShell 7 and ForEach-Object -Parallel
    Process independent work in parallel with PowerShell 7 and a sensible throttle.
  • Privileged accounts and Protected Users
    Test Protected Users for privileged Active Directory accounts to restrict NTLM and credential delegation.
  • Restart Windows directly into firmware settings
    Skip the race to press a startup key with Windows' firmware restart switch.
  • Review guest resharing in SharePoint and OneDrive
    Review whether guests can reshare items they don't own, alongside their site permissions.
  • Use an allowlist for VS Code extensions
    Control VS Code extensions with an enforced allowlist and keep reviewing approved extensions.
  • Windows has a built-in openfiles utility
    Use Windows openfiles for local file-handle troubleshooting, with the required tracking and restart.