Windows 10: Privileged access management in Office 365 is now Generally Available

Brink · Sep 25, 2018

Having privileged access to an application is all that’s needed to execute commands with malicious intent to inflict damage to or exfiltrate data from an organization. Such high privileges can be misused to create fake accounts, grant excessive permissions, exfiltrate sensitive data, cause damage to infrastructure, wipe out or hold data for ransom, and set rules and policies that make it extremely hard to detect and restore state back. In fact, it’s estimated that 80% of security beaches involve privileged credentials1. Therefore, privileged accounts commonly become lucrative attack vectors for both internal and external attackers.

On top of this, organizations are constantly evolving (acquisitions, divestitures, entering new markets, ect.) – making it challenging to monitor and manage privileged accounts and respond to various compliance requirements regarding privileged access to sensitive data at scale.

One way to address these risks and complexities is to operate on the principle of Zero Standing Access, which means users do not have privileges by default, and when permissions are provided, it’s at the bare minimum with just enough access to perform the specific task.

Microsoft operates on this principle for data center access, or also known as service provider access to customer content, through Lockbox and Customer Lockbox. In fact, Microsoft goes a step further than traditional PAM solutions by eliminating standing privileged access to your data within your organization.

We believe that operating on the principle of zero standing access with just in time and just enough access to perform a privileged task is key to effectively manage accounts with privileged access.

Therefore, we are excited to announce that we are extending the security rigor that Microsoft uses for data center access, to enable customers to enforce Zero Standing Access for privileged admin access within your organization, with privileged access management in Office 365, which is generally available today.

To understand how it works – read further below.

How it works

Privileged access management in Office 365 goes beyond traditional access control capabilities by enabling access governance more granularly for specific tasks.

It’s based on the principle of Zero Standing Access, which means users who need privileged access, must request permissions for access, and once received it is just-in-time and just-enough access to perform the job at hand.

Therefore, Zero Standing Access, combined with access governance, can be an effective deterrent to misuse of privileged access by:

Requiring users to elevate permissions to execute tasks that may expose sensitive data.

Providing Just-Enough-Access (JEA) to specific tasks, coupled with Just-In-Time access so access is only allowed for a specific period of time.

Removing the dependency on having a set of privileged accounts with standing access.

The approval workflow can be enumerated in following steps:

(0) First, set up designed approvers and the privileged access management policy
First the global admin needs to set up a privileged access management group for authorizing privileged tasks within the Microsoft 365 admin center. Once the group is created members need to be added as well.

Once the members have been added to the group, under Settings then Security & privacy turn on privileged access management in Office 365 to require approvals for privileged tasks, and select the approval group. Once turned on, you can configure the specific access policy – in this example, an access policy has been added to prevent users from executing journal rules without Manual-approval so that users can’t send copies of sent and received emails to a shadow mailbox without immediate detection.

However, Auto-approval is practical for high-volume tasks such as password resets, but in this case, members of the Privileged Access Approver group will be responsible for reviewing and approving tasks of this nature.

(1) Admin requests privileged access to execute high risk task
Once a policy is in place, an admin is now required to request permissions for privileged access through the Microsoft 365 admin center.

Typically, the admin will know that they need to elevate permissions when they try to execute the command and the system prohibits the admin from running the task because they have insufficient permissions to execute this command.

To request access, the admin must go to the Microsoft 365 Admin center, where privileged access management in Office 365 is managed, under Settings then Security & privacy, to make a new request. Once a request is made, and additional information is provided, such as the type of request, for what workload, task, and the duration.

(2) Designated approver reviews request and takes action
Since the policy requires a manual approval, the request is sent to the designated approval group. The notification message provides the details of the request including who is requesting access, what task they want to execute, for how long and the reason why. All this information is available to help the designated approver decide if the request is appropriate.

To approve or deny the request, the designated approver must log into the Microsoft 365 admin center to take action.

(3) Admin receives notification and takes action for specific amount of time
If the request is appropriate and the designated approver receives an email notification of the request being approved, the requesting user gets access to the privileged tasks and can execute the task for the specified amount of time.

(4) Privileges expire access is no longer available
With privilege access management, each request expires after a specified length of time to reduce the risk of a malicious user stealing access. After the access period has expired, the requester doesn’t have any privileged access to the task anymore.

Managing access governance and responding to compliance obligations

With privileged access management in Office 365, access within an organization is governed, and all instances related to the capability will generate logs and security events. This can be extremely useful to monitor and build alerting on.

Event logs – with information about requests, duration, approvals, and actions performed – are audit ready, and can be aggregated and presented as evidence to meet growing compliance requirements.

Privileged access management is available in the Microsoft 365 Admin Center, and organizations can now also manage Customer Lockbox requests, and Data Access requests from Azure Managed Apps from a single management pane for privileged access to your Microsoft 365 data.

This is the first step towards enabling customers to protect their sensitive data though the principle of Zero Standing Access, with Just-in-Time & Just-Enough-Access. Stay tuned for further updates here on TechCommunity blog.

Get Started Today!
Privileged access management in Office 365 is now generally available for our customers with Office 365 E5 and Advanced Compliance SKUs.

You can get started by reviewing the below resources:

2 Min Video

Reading this whitepaper on Zero Standing Access

Review the Technical Documentation

Click to expand...

Read more: Privileged access management in Office 365 is now Generally Available - Microsoft Tech Community - 261751

:)

Douglas Clelland · Sep 25, 2018

Cortana & Office 365 Integration

We are trying to integrate Cortana with our Office 365 subscription, but it never works. Here are the steps we have done:

Turned on Cortona in the Office 365 Admin portal

We are using Windows 10 1703 – connected Office 365 service to Cortana

Did the same on windows 10 mobile with no luck, Cortana says its connected to Office 365, but sees no data and we are getting zero errors

We went rough office 365 support first and tried all fo their suggestions, they kicked us over to Windows support which is currently closed.

We are on v1703 with all updates in place, it does not work on Windows 10 desktop or mobile

any ideas? I can give you all steps 365 support had us run through if that will be helpful

Thank you

Doug

Brink · Sep 25, 2018

The Office 365 Education Roadmap is now available

Office 365 is available to students and teachers at no cost through their academic institution. Visit Office in education to check eligibility and to download onto multiple devices.

When you make any investment in technology you are investing in a living thing. The pace of development of technology in today’s world is such that improvements and alterations are seemingly continuously available to software, hardware and infrastructure. And with the increasing utilization of the cloud, platforms and tools can be upgraded “on the fly” by the providers without the end users having to break stride. This also enables product developers to be much more receptive to user feedback and incredibly agile when it comes to implementing features and functionality based on these suggestions.

Anyone investing in technology for their school, college or university has the added responsibility of building an environment that will shape the learning paths of hundreds or even thousands of young people. Therefore, it’s important to know not only what the current capabilities of technology are, but where it’s going in the future.

Office 365 Education Roadmap

We’re pleased to share the Office 365 Education Roadmap, which lists updates currently planned for applicable subscribers. Updates for the various stages—from in development to rolling out to customers, to being generally available for applicable customers worldwide—are easily accessible in the Office 365 Roadmap.
To see what’s coming up specifically for Education, simply do the following:

Go to roadmap.office.com.

Open Filters.

Under Services, select Education.

Click the launch status (i.e., in development) to see product/feature items.

Click the item for a description and other information available.

If you don’t see a feature on this roadmap that you or your users would like to see, just add your request to our Education UserVoice.
Click to expand...

Source: The Office 365 Education Roadmap is now available - Office Blogs

Brink · Sep 25, 2018

Announcing general availability of Office 365 in South Korea

Today, as part of our deep and continued commitment to make Office 365 the most trusted cloud service for productivity, we are announcing the general availability of Office 365 from our new cloud datacenters in Seoul and Busan, South Korea. We are pleased to be the first global cloud productivity provider offering customer data residency in South Korea.

Since October 2014, we have expanded our global cloud footprint and opened new datacenter regions in Japan, Australia, India, Canada, U.K. and now South Korea. In addition to the same highly secured productivity capabilities already enjoyed by Office 365 customers all over the world, these new datacenter regions add local data residency, failover and disaster recovery to help effectively address the legal and regulatory needs of customers in industries like banking, public sector and healthcare.

To learn more about Office 365 and our security and compliance capabilities, please visit our website and the Office 365 Trust Center. To easily access Microsoft Cloud audit reports, security assessments and technical white papers, please visit our Service Trust Preview webpage.
Click to expand...

Source: Announcing general availability of Office 365 from local datacenters in South Korea - Office Blogs

Windows 10: Privileged access management in Office 365 is now Generally Available

Privileged access management in Office 365 is now Generally Available

Privileged access management in Office 365 is now Generally Available

Privileged access management in Office 365 is now Generally Available

Privileged access management in Office 365 is now Generally Available - Similar Threads - Privileged access management

New Office mobile app now generally available for Android and iOS

Microsoft Stream Live Events now generally available in Microsoft 365

New Gmail now generally available

Now no office 365

The Office 365 Education Roadmap is now available

Announcing general availability of Office 365 in South Korea

New Resume Assistant feature now available in Office 365

Announcing School Data Sync general availability in Office 365

Microsoft StaffHub now available for Office 365