Completed Azure Solutions Architect certification

Last 2 months I’ve been working on renewing my Office 365 and Azure certifications. 4 years ago I already passed the “old” exams: 533, 534, 345, 346 and 347. This saved me a few exams. I was able to upgrade to Azure Administrator and Messaging administrator by passing the upgrade exams. For the Azure Solutions Architect I had to take the AZ-300 and AZ-301 exam as an upgrade exam was only valid for those who have passed the follow up exam of 534: 535.

So here is the final result, I will be looking into the Azure Security exam in the future (AZ-500) as well as the Microsoft 365 Certified Enterprise Administrator Expert (MS100 & MS101)

Office 365 Set mailbox default language

When you do large migrations, it might be convenient to change the default mailbox language settings for all your end users. By default each user needs to set the default language and time zone at first login to OWA in Office 365.

With the following PowerShell Script you should be able to change it within a few seconds. In this script we used the Dutch language code and Western European Standard time. Change it accordingly.

get-mailbox | Set-MailboxRegionalConfiguration -LocalizeDefaultFolderName: $true -DateFormat dd-MM-yy -Language 1043 -TimeZone "W. Europe Standard Time"
Continue reading “Office 365 Set mailbox default language”

Office 365 Cloud app security

If you want to improve your security in Office 365 it is recommended to add the EM+S E3 or E5 security suits. This gives you more information about what is happening with your users, but you can configure alerting and actions as well.

So if you have the EM+S licenses, you can go to https://portal.cloudappsecurity.com and start configuring your alerts and policies.

By default there are a lot of default policies, but you can create your own as well! Let me summarize the most important ones that you definitely need to look at:

Continue reading “Office 365 Cloud app security”

Go Azure AD joined with on-prem DC and fileserver!

Wouldn’t be cool to migrate all your laptops and desktops to Azure AD, but still have your on-premise file server for the people that can’t say goodbye to their network drives?

Now it is possible! Azure is supporting out of the box, Azure AD domain joined devices to connect with their on-premise domain joined counterparts with credentials (Kerberos) to the good old file and print server!

Requirements

To be able to set this up, you will still need a traditional domain controller with a file/print server. On top of that you will need to synchronize the identities to Azure AD. Make sure that you enable password sync, and start joining the devices to Azure AD.

One other important thing, your device needs to be Windows 10 1607 or higher! Older versions of Windows 10 do not support the Kerberos authentication.

If you now want to map a network drive with the existing NTFS permissions, just map the drive, and start using like you used to do before!

Let’s go password less, because passwords are bad! Part 1

Quite a statement, passwords are bad? Today I’d like to explain why you should work on better security by using other authentication methods than just 1 password.

Gerelateerde afbeelding

Why passwords are bad

Password are problematic, very often you see that passwords fall in the hands of unpleasant people. Here are a few things that might happen with a password:

Continue reading “Let’s go password less, because passwords are bad! Part 1”

Backup your Office 365 environment!

In the past two years, Over 50 percent of businesses experienced an unforeseen interruption, and the vast majority (81%) of these interruptions caused the business to be closed for one or more days.

Did you know that 80 percent of businesses suffering a major disaster go out of business in three years, while 40 percent of businesses that experience a critical IT failure go out of business within one year. In the case of suffering a fire, 44 percent of enterprises fail to reopen and 33 percent of these failed to survive beyond 3 years…

It’s a common mistake to think that Microsoft takes core of backups for your Office 365 environment. Yes, they do make backups, every 12 hours with a retention of 14 days. However, this is only designed for emergency purposes, and if you need it your self, they will charge you for that.

But then you might think that there is a recycle bin and versioning, yes, but these are limited as well. For email the retention is just 30 days, and for SharePoint it is 90 days. This can extended with the E3 and E5 subscriptions. But is this a real backup? and can this guarantee save data retrieval in case of a disaster? the answer is NO!

Continue reading “Backup your Office 365 environment!”

Deploy Office 365 plugins using the Admin Portal

From the Office 365 Admin portal it is possible to deploy Office plugins to users, both specific as all users. With this manual we will deploy a plugin from the store, but you can deploy custom apps as well. The advantage of using plugins from the store is that the plugins get automatically updated, so nothing you have to worry about anymore!

Step 1: Login to the office portal, go to the admin center, and from there go to Settings, Services & add-ins, and Deploy Add-in

Continue reading “Deploy Office 365 plugins using the Admin Portal”

Office 365 MFA is free of charge!

Where Azure MFA is only included in the paid Azure Active Directory Premium subscriptions (P1/P2 and EM+S suites), there is a free version for the Office 365 apps.

It is always a good idea to enable multi factor authentication, in case your credentials get stolen, the thief will not be able to use them because of the 2nd authentication factor. Microsoft is encouraging all their users to start using MFA, so the made it free of charge for all the apps of the office 365 suite, including Outlook, Teams, Excel, Word and many more.

First Sign in screen

The 2 factor authentication can be setup up fairly easily by the end users self. This can be enforced by the administrator by requiring 2 factor authentication. The first time a user logs on, he or she will get a notification message to setup MFA. Or you can redirect your users to the following portal to setup MFA: https://aka.ms/mfasetup

How to setup MFA for your end users?

In the office 365 portal go to the Active Users tab, and go to the Setup multifactor authentication page (see below)

In the preview version of the admin center, the More menu on the Active Users page, with Setup Azure multi-factor auth selected.
Continue reading “Office 365 MFA is free of charge!”

What is Microsoft Enterprise Mobility + Security (EM+S)?

Enterprise Mobility + Security is a Microsoft solution specially developed for management and securing users, company data and applications. This gives you and your users always secured access to your company information without ever worrying about security!

With EM+S we are moving from a managed device to data management and security. This means that it will not only protect your device, but most important, it will take care of security on a document level where you can prevent that confidential data is readable by unauthorized persons.

By using this security suite you can prevent abuse of stolen credentials when one of your users is tricked by a phishing email. You can limit access to company data to only trusted devices (Company and BYOD) by using the Intune portal. But we can limit access to it as well with IP black / white listing. This includes Geoblocking as well, it is impossible to travel from the Netherlands to Russia for example in 5 minutes.

To protect your valuable company data I recommend to always use EM+S for optimal protection. If you want the security to be at its best, E5 is your way to go!

Main features

  • Simple management and security of your devices
  • Multifactor authentication (MFA)
  • Selfservice portal for password reset en securitygroep management
  • Application company portal
  • Mobile device management (MDM)
  • Integrated device management (Laptop/Desktop)
  • Securing company data en restrict access to company data
  • Conditional access (geo-blocking and more)
  • Advanced Threat Protection with reporting
  • Risk-Based conditional access (E5 only)
  • Privileged identity management (E5 only)
  • Intelligent data classification and labeling (E5 only)
Continue reading “What is Microsoft Enterprise Mobility + Security (EM+S)?”

Uninstall Office 365 Click-To-Run Updates

There are cases where you want or need to uninstall an Office update. Office 365 installations use a different update than the old Office 2013 & 2016 installations. Where the old installations are a point in time installation, click-to-run always downloads the latest version and then runs the setup. You can revert to an older version but its different than in the past where you could just uninstall an KB update.

Steps

Step 1: Check build number and find previous build number

In one of your office programs go to the options menu and go to Office Account. Find your current and previous version on the Microsoft website: Update history Office365 ProPlus by date

Afbeeldingsresultaat voor office 365 build number

Continue reading “Uninstall Office 365 Click-To-Run Updates”

Sync existing office 365 tenant with local active directory

Recently we created an AAD tenant that has no on-premises AD domain counterpart.
Now we are facing an issue where we want to be able to use the identities in this tenant to log into some servers. It would appear that we would need to domain join these servers, but we can’t do this without AD. The question is, how can we continue to setup these servers?

If the servers are hosted on the Azure IaaS platform you can choose to go ahead with Azure AD Domain services as I wrote before:
https://www.cordenboer.nl/2019/04/22/azure-ad-domain-services-an-option-or-not/

But today we are going to install a new domain on-premise. The domain name isn’t relevant for the sync with Azure AD / Office 365. But the UPN for the end users is important! So first we can add the UPN domains by going to the Domain and Trusts console. Add the required domain names.

Continue reading “Sync existing office 365 tenant with local active directory”

Outlook 2016 search not working

Recently I was notified by a customer that Outlook search wasn’t working anymore as expected (Search not working at all, or missing results). After some searching I found out that this was caused by a Windows 10 Update where a shared DLL was updated: KB4467684

In the the end there is a quick fix by running a simple command that repairs the effected MSWB7.dll file.: sfc/scannow (run as administrator)

Continue reading “Outlook 2016 search not working”

Microsoft Advanced Threat Protecion

Microsoft bied op verschillende diensten Advanced Threat protection aan. Helaas zit er marketing technisch nog steeds hier en daar de naam Defender aan vast, waar het onder water een compleet ander product is. Het is inmiddels geen simpel antivirus pakket meer, maar een all-in-one oplossing tegen aanvallen van buitenaf en binnenuit. Dit gebeurt door Windows ATP voor bescherming van je device, Office 365 ATP voor bescherming van je Email, SharePoint, OneDrive en teams data en als laatste Azure ATP voor bescherming van alle identiteiten.

Als kers op de taart is er voor on-premise omgevingen is het Azure Security center ontworpen, die net als Windows, constant in contact staat met de Microsoft Azure datacenters om data en informatie uit te wisselen. Inmiddels zijn alle bedreigingen zo uitgebreid en geavanceerd geworden dat 1 enkele computer de rekenkracht ontbreekt om alles te analyseren. De kracht van de Cloud komt hier om de hoek kijken. Informatie die verzameld is bij andere klanten wordt gebruikt om jouw omgeving en apparaat veilig te houden. Het mooie is dat de ATP client standaard in Windows 10 is ingebouwd waardoor er relatief weinig hoeft te gebeuren om het in te zetten.

Continue reading “Microsoft Advanced Threat Protecion”

Modernizeer je identiteits en toegangs beheer met Azure AD

Door Azure AD als je centrale Identiteit opslag te gebruiken word beheer een stuk makkelijker en veiliger. Door Azure AD te gebruiken kan je voortaan makkelijk samen werken met andere bedrijven. Door gebruikers van een andere organisatie uit te nodigen, is het niet meer noodzakelijk om deze ook nog is lokaal in je eigen AD aan te maken. Mocht een medewerker van een ander bedrijf uit dienst gaan hoeft deze alleen nog maar uitgeschakeld te worden in de partner organisatie. Doordat er alleen een koppeling is vanuit jouw Azure AD wordt ook automatisch de toegang ontzegt tot de data van jouw organisatie.


Hoe zorg je er voor dat je huidige Active Directory modern beschikbaar komt?

Microsoft heeft een tool beschikbaar gesteld waarmee je alle identiteiten, of een selectie daarvan, kan synchroniseren naar Azure AD. Deze tool heet AD Connect en dient lokaal geïnstalleerd te worden op een server. Er zijn 3 mogelijke synchronisatie scenario’s.

Continue reading “Modernizeer je identiteits en toegangs beheer met Azure AD”

Microsoft Secure Score

Microsoft Secure Score is een manier om te meten hoe veilig je organisatie is in Office 365, Windows 10 en EM+S (Enterprise Management + Security). Hiermee kan je zien hoe veilig je organisatie is ten opzichte van het door Microsoft geadviseerde beleid, als ook andere bedrijven in dezelfde sector.

Microsoft laat met deze tool, die beschikbaar is via EM+S E3 of E5, zien hoe veilig je organisatie nu is, maar ook in het verleden. Door analyses en trends te bekijken kunnen er specifieke aanbevelingen voor jouw organisatie gemaakt worden waardoor je snel ziet hoe je je beveiliging kan verbeteren.

Door de aanbevelingen van Microsoft op te volgen kunnen we de ideale bedrijf score bepalen en deze samen behalen. Het kan soms wenselijk zijn om een aanbeveling niet op te volgen omdat dit de bedrijfsprocessen teveel beperken. In alle aanbevelingen word ook aangegeven wat de mogelijke gebruiksimpact kan zijn door een impact classificatie: Low, Medium en High.

Continue reading “Microsoft Secure Score”