dougsbaker

Build your first Microsoft Purview DLP Policy

by dougsbaker
Getting started with Microsoft Purview? Looking to build out your first DLP policy? In this video, I walk through the process of creating a DLP policy in monitor-only mode. Microsoft Documentation Rescources. Sensitive Info Dictionary: https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitive-information-type-entity-definitions?view=o365-worldwide Overview of data loss prevention: https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-worldwide Create, test, and tune a DLP policy: https://docs.microsoft.com/en-us/microsoft-365/compliance/create-test-tune-dlp-policy?view=o365-worldwide View the reports for data ... Read More

Conditional Access Policy Exporter

by dougsbaker
I perform best practice audits of customers’ Conditional Access (CA) policies on a regular basis. If you have ever done this, you will quickly notice that it can be a very intensive exercise due to Azure AD’s portal design. When customers only have a handful of CA policies it can be very easy and quick. ... Read More

Label all files in an SPO site

by dougsbaker
Oftentimes when deploying MIP Sensitive Labels, I run into use cases where customers want to auto label all files in an SPO site. This is usually for a site that will always contain proprietary data, such as a Project Site, or Departmental Site. When this comes up customers are typically looking at the Container Level ... Read More

Microsoft Chrome Extensions

by dougsbaker
Do you still have users that love their Chrome? Haven’t convinced the org to switch to the new Edge Chromium? Want to make sure the user/security experience with Chrome matches the new features built into edge? Well if you do you are going to need to deploy some Microsoft Chrome Extensions. To help with that ... Read More

Should I Integrate SharePoint sharing with Azure AD B2B

by dougsbaker
I was recently looking at new options available for controlling SharePoint and ran in into an interesting new feature I have never deployed. Specifically the Azure AD B2B integration with SharePoint and OneDrive. Azure AD B2B integration for SharePoint & OneDrive – SharePoint in Microsoft 365 | Microsoft Docs Seems like an easy enough feature ... Read More

Endpoint DLP PreReq Check

by dougsbaker
Looking to implement Microsoft’s Endpoint DLP? Concerned you haven’t met the prereqs for deployment? If you have that question then the first place you should check is the Edge URL’s. Microsoft has added a great little utility to help you identify the status of various DLP Utilities. Specifically in this case to check EndPoint DLP ... Read More

Defender for Identity Audit Deleted Objects

by dougsbaker
So recently I noticed in my new Server 2019 DFI lab I was not getting auditing when an object was deleted. This was curious to me as I have always in the past gotten this type of info from the product. Turns out there is one line I missed on pre-reqs that I have never ... Read More

Audit All Mailbox Activity

by dougsbaker
Note: Updated 11/12/2021 to include SearchQueryInitiated Ever wanted to make sure you are auditing all available activities in Exchange Online? Me too! So I wrote a PowerShell to turn on logging for every possible item EXO can audit. Adjust to your liking and license level! So why would you want this? Isn’t logging enabled by ... Read More

Find EOP – MDO Misconfig with KQL

by dougsbaker
One of the biggest/most common misconfigurations I have seen with EOP/MDO is an overuse of IP or domain allow lists. MSFT has updated its guidelines to no longer recommend customers use those features. However, the hard thing is determining how many emails are coming into your environment without scanning due to those settings. I needed ... Read More

Blog Update

by dougsbaker
Had a lot of life updates since Covid, New Job, New Home all the Covid stuff. As life is starting to normalize again I am again thinking blogging would be fun! And maybe just maybe some of the stuff I post helps someone else. So my goal is to start publishing more on this blog ... Read More