Chapter 11: Endpoint and Security Management

At the core of Microsoft 365 is the concept of identity-based security management. One of the benefits of using Microsoft 365 is that it includes a directory service, Azure Active Directory (AAD), which can be used to define an organization's cloud service security baseline.

Identity and security administrators alike should understand the main security features that can be integrated between their new and existing solutions. In the case of Microsoft 365, this will likely mean integrating an existing AD on-premises deployment with Azure AD.

In this chapter, we'll highlight some of the basic security features present in both AD (part of an organization's on-premises identity infrastructure) and AAD. Specifically, we'll cover the following topics:

• Understanding directory-based security features
• Addressing common threats with AAD
• Understanding BYOD

By the end of this chapter, you should have an...

Understanding directory-based security features

Both AD and AAD have several identity and security features built in to help prevent or mitigate threats. In this section, we'll look at some core security features of AD, as well as features available with both AAD Premium Plan 1 and AAD Premium Plan 2, that can be used to help protect organizations.

Active Directory

AD is an on-premises identity store service. It's used to authenticate and authorize computers and internal applications. The core functional container for a security boundary in AD is called a domain. A domain contains all of an organization's related security principals, groups, and other objects. Domains are grouped into trees, which are logical collections of related objects from either a security or organizational perspective. At the top level, forests are made up of one or more trees. The domains in a tree share a contiguous namespace. Each tree in a forest has a namespace, as shown in the following...

Addressing common threats with AAD

Attackers are constantly developing new threats. Microsoft 365 provides organizations with several tools, guidance, and built-in features (such as Secure Score at https://security.microsoft.com/securescore) that can be used to improve security.

In this next section, we will explore some examples of common threats and see which Microsoft 365 capabilities can be used to protect against them:

• Compromised accounts
• Compromised devices
• Phishing attempts

First, let's look at compromised user accounts.

Compromised accounts

Credential compromise is one of the most common threats an organization can face. This can happen through any number of mechanisms, such as brute-force password cracking attempts, malware, or social engineering. This can lead to several security issues in the organization, such as the loss of intellectual property or the exposure of customer data.

Microsoft 365 has several features that can be used...

Understanding BYOD

Recently, there have been several business, health, and environmental concerns that have caused businesses to consider allowing employees, contractors, or other individuals access to organizational resources with personal devices.

This shift, termed Bring Your Own Device (or BYOD), provides a lot of flexibility to organizations. It even can be seen as a cost-reduction mechanism (forgoing capital expenditure for devices or even reducing office space). However, it comes with a new set of risks and challenges. Securing organizational data is paramount for security professionals,
administrators, and business professionals, and the introduction of personal devices that may be out of date or have been compromised by malware underscores the risk that these devices present.

However, Azure AD Premium features can help mitigate these threats as well.

Mobile device management

The more traditional approach to mobile devices usually involves some sort of device...

Summary

Both AD and Azure AD Premium provide organization administrators with several security features that can be used to safeguard critical data and systems. As we saw, there are controls available to verify and authenticate access, enforce MFA based on several usage and risk scenarios, and detect anomalous behavior patterns.

You also learned about how additional tools in the Microsoft 365 suite, such as the attack simulator, can be used to help train users to respond appropriately to threats. You should now understand some of the core features of Azure AD Premium (such as Conditional Access) and how they can be used to enhance an organization's security.

In the next chapter, we'll begin examining Service Trust Portal and Compliance Manager, which can be used to help organizations achieve and manage compliance with industry standards.

Questions

Answer the following questions to test your knowledge of this chapter. You can find the answers in Chapter 18, Assessments:

1. Conditional Access is a feature of ___________.
   1. AAD Premium P1
   2. AD
   3. Cloud App Security
   4. Privileged Identity Management
2. Risk-based Conditional Access is a feature of _____________.
   1. AAD Premium P1
   2. AAD Premium P2
   3. AD
   4. Privileged Identity Management
3. A self-service password reset can update on-premises and cloud passwords.
   1. True
   2. False
4. The Office 365 attack simulator is part of _____________.
   1. Office 365 E3
   2. Microsoft 365 E3
   3. Office 365 E5
   4. Microsoft 365 E5
5. The feature that allows just-in-time rights management and access rights elevation is which of the following?
   1. Privileged Identity Management
   2. Access reviews
   3. Baseline security policies
   4. Security defaults
   5. Conditional Access
6. You are the security administrator for your organization. You want to automate a process to check on group memberships and remove stale accounts from groups. What tool or feature should you...