Windows Hello for Business uses a PIN or biometric data which is more secure than a password and always uses key-based or certificate-based authentication.

Windows Hello for Business

Windows Hello, an authentication feature built into Windows 10, replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that's tied to a device and uses a biometric or PIN.

Windows Hello lets users authenticate to:

• A Microsoft account.

• An Active Directory account.

• An Azure Active Directory (Azure AD) account.

•Identity Provider Services or Relying Party Services that support Fast ID Online (FIDO) v2.0 authentication (in preview)

After initial verification of the user during enrolment, Windows Hello is set up on their device and Windows asks the user to set a gesture, which can be a biometric, such as a fingerprint, or a PIN. The user provides the gesture to verify their identity. Windows then uses Windows Hello to authenticate them.

Windows stores PIN and biometric data securely on the local device; it's never sent to external devices or servers. That means there's no single collection point that an attacker might compromise.

There are two configurations for Windows Hello: Windows Hello convenience PIN and Windows Hello for Business.

• Windows Hello convenience PIN is configured by a user on their personal device. Windows Hello convenience PIN is not backed by asymmetric (public or private key) or certificate-based authentication.

• Windows Hello for Business is configured by Group Policy or mobile device management (MDM) policy such as Microsoft Intune, and always uses key-based or certificate-based authentication. Windows Hello for Business may still use a PIN, but because the PIN used to unlock the credential is backed by key-based or certificate-based authentication, it is more secure than Windows Hello convenience PIN.

Why is Windows Hello safer than a password?

Windows Hello in Windows 10 enables users to sign in to their device using a PIN. Although a PIN looks much like a password, a Windows Hello PIN is more secure because it's tied to the specific device on which it was set up. Without the hardware, the PIN is useless.

A regular password is transmitted to a server where it can be intercepted in transmission or stolen from a server. A PIN is local to the device; it isn't transmitted anywhere, and it isn't stored on a server.

The Windows Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto processor that's designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software can't tamper with the security functions of the TPM. Many mobiles phones and modern laptops have TPM.

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-overview

Azure Active Directory (Azure AD) is Microsoft’s cloud-based identity and access management service. Organizations use Azure AD to enable their employees, guests, and others to sign in and access the resources they need, including:

• Internal resources, such as apps on your corporate network and intranet, and cloud apps developed by your own organization.

• External services, such as Microsoft Office 365, the Azure portal, and any SaaS applications used by your organization.

Azure AD simplifies the way organizations manage authorization and access by providing a single identity system for their cloud and on-premises applications. Azure AD can be synchronized with your existing on-premises Active Directory, synchronized with other directory services, or used as a standalone service.

Azure AD also allows organizations to securely enable the use of personal devices, such as mobiles and tablets, and enable collaboration with business partners and customers.

Azure AD is used by IT admins to control access to corporate apps and resources, based on business requirements. It can also be set up to require multi-factor authentication when accessing important organizational resources. Azure AD can be used to automate user provisioning between an existing Windows Server AD and cloud apps, including Microsoft 365. Finally, Azure AD provides powerful tools to automatically help protect user identities and credentials and to meet an organization’s access governance requirements.

Subscribers to Azure services, Microsoft 365, or Dynamics 365 automatically use Azure AD. Each Microsoft 365, Office 365, Azure, or Dynamics 365 Online subscription automatically uses an Azure AD tenant. Users of these services can take advantage of Azure AD services such as self-service password reset, provided it has been configured by their organization’s admins.

Developers use Azure AD as a standards-based approach for adding single sign-on (SSO) to their apps, so that users can sign in with their pre-existing credentials. Azure AD also provides APIs that allow developers to build personalized app experiences using existing organizational data.

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis

Yes - The MailItemsAccessed event is a mailbox auditing action and is triggered when mail data is accessed by mail protocols and mail clients.

Advanced Audit in Microsoft 365

The unified auditing functionality in Microsoft 365 provides organizations with visibility into many types of audited activities across many different services in Microsoft 365. Advanced Audit helps organizations to conduct forensic and compliance investigations by increasing audit log retention required to conduct an investigation, providing access to crucial events (by using Audit log search in the Microsoft 365 compliance centre and the Office 365 Management Activity API) that help determine scope of compromise, and faster access to Office 365 Management Activity API.

Advanced Audit events

Advanced Audit helps organizations to conduct forensic and compliance investigations by providing access to crucial events such as when mail items were accessed, or when mail items were replied to and forwarded, and when and what a user searched for in Exchange Online and SharePoint Online. These crucial events can help you investigate possible breaches and determine the scope of compromise. In addition to the crucial events in Exchange and SharePoint, there are events in other Microsoft 365 services that are considered crucial events and require an appropriate Advanced Audit license to be logged.

Advanced Auditing provides the following crucial events:

• MailItemsAccessed

• Send

• SearchQueryInitiatedExchange

• SearchQueryInitiatedSharePoint

• Other Advanced Audit events in Microsoft 365

https://docs.microsoft.com/en-us/microsoft-365/compliance/advanced-audit?view=o365-worldwide

Yes - Compliance Manager tracks Microsoft managed controls, customer-managed controls, and shared controls.

Microsoft Compliance Manager

Microsoft Compliance Manager is a feature in the Microsoft 365 compliance centre that helps you manage your organization’s compliance requirements with greater ease and convenience. Compliance Manager can help you throughout your compliance journey, from taking inventory of your data protection risks to managing the complexities of implementing controls, staying current with regulations and certifications, and reporting to auditors.

https://www.microsoft.com/en-us/videoplayer/embed/RE4FGYZ

Compliance Manager helps simplify compliance and reduce risk by providing:

• Pre-built assessments for common industry and regional standards and regulations, or custom assessments to meet your unique compliance needs (available assessments depend on your licensing agreement; learn more).

• Workflow capabilities to help you efficiently complete your risk assessments through a single tool.

• Detailed step-by-step guidance on suggested improvement actions to help you comply with the standards and regulations that are most relevant for your organization. For actions that are managed by Microsoft, you’ll see implementation details and audit results.

• A risk-based compliance score to help you understand your compliance posture by measuring your progress in completing improvement actions.

Your Compliance Manager dashboard shows your current compliance score, helps you see what needs attention, and guides you to key improvement actions. Below is an example of what your Compliance Manager dashboard will look like:

https://docs.microsoft.com/en-us/microsoft-365/compliance/compliance-manager?view=o365-worldwide

Taneleer should use incidents to identify the devices that are affected by a particular alert in Microsoft 365 Security Centre.

Incident response with Microsoft 365 Defender

An incident in Microsoft 365 Defender is a collection of correlated alerts and associated data that make up the story of an attack.

Microsoft 365 services and apps create alerts when they detect a suspicious or malicious event or activity. Individual alerts provide valuable clues about a completed or ongoing attack. However, attacks typically employ various techniques against different types of entities, such as devices, users, and mailboxes. The result is multiple alerts for multiple entities in your tenant.

https://www.microsoft.com/en-us/videoplayer/embed/RE4Bzwz?

Because piecing the individual alerts together to gain insight into an attack can be challenging and time-consuming, Microsoft 365 Defender automatically aggregates the alerts and their associated information into an incident.

Grouping related alerts into an incident gives you a comprehensive view of an attack. For example, you can see:

• Where the attack started.

• What tactics were used.

• How far the attack has gone into your tenant.

• The scope of the attack, such as how many devices, users, and mailboxes were impacted.

• All of the data associated with the attack.

If enabled, Microsoft 365 Defender can automatically investigate and resolve alerts through automation and artificial intelligence. You can also perform additional remediation steps to resolve the attack.

Incidents and alerts in the Microsoft 365 Defender portal

You manage incidents from Incidents & alerts > Incidents on the quick launch of the Microsoft 365 Defender portal (security.microsoft.com).

Selecting an incident name displays a summary of the incident and provides access to tabs with additional information.

The additional tabs for an incident are:

• Alerts

• All the alerts related to the incident and their information.

• Devices

• All the devices that have been identified to be part of or related to the incident.

• Users

• All the users that have been identified to be part of or related to the incident.

• Mailboxes

• All the mailboxes that have been identified to be part of or related to the incident.

• Investigations

• All the automated investigations triggered by alerts in the incident.

• Evidence and Response

• All the supported events and suspicious entities in the alerts in the incident.

• Graph (Preview)

• A visual representation of the attack that connects the different suspicious entities that are part of the attack with their related assets such as users, devices, and mailboxes.

Here's the relationship between an incident and its data and the tabs of an incident in the Microsoft 365 Defender portal.

https://docs.microsoft.com/en-us/microsoft-365/security/defender/incidents-overview?view=o365-worldwide

Encryption

Encryption is an important part of your file protection and information protection strategy.

The encryption process encodes your data (referred to as plaintext) into ciphertext. Unlike plaintext, ciphertext can't be used by people or computers unless and until the ciphertext is decrypted. Decryption requires an encryption key that only authorized users have. Encryption helps ensure that only authorized recipients can decrypt your content. Content includes files, email messages, calendar entries, and so on.

Encryption by itself doesn't prevent content interception. Encryption is part of a larger information protection strategy for your organization. By using encryption, you help ensure that only authorized parties can use the encrypted data.

You can have multiple layers of encryption in place at the same time. For example, you can encrypt email messages and also the communication channels through which your email flows. With Office 365, your data is encrypted at rest and in transit, using several strong encryption protocols, and technologies that include Transport Layer Security/Secure Sockets Layer (TLS/SSL), Internet Protocol Security (IPSec), and Advanced Encryption Standard (AES).

https://docs.microsoft.com/en-us/microsoft-365/compliance/encryption?view=o365-worldwide

Sign-in risk is the real-time calculation that a given authentication request was made by the specific user’s identity.

Conditional access and its benefits

Conditional Access is a feature of Azure AD that provides an extra layer of security before allowing authenticated users to access data or other assets. Conditional Access is implemented through policies that are created and managed in Azure AD. A Conditional Access policy analyses signals including user, location, device, application, and risk to automate decisions for authorizing access to resources (apps and data).

A Conditional Access policy might state that if a user belongs to a certain group, then they're required to provide multifactor authentication to sign in to an application.

https://youtu.be/ffMAw2IVO7A

Conditional Access signals

Conditional Access can use the following signals to control the who, what, and where of the policy:

• User or group membership. Policies can be targeted to specific users and groups (including admin roles), giving administrators fine-grained control over access.

• Named location information. Named location information can be created using IP address ranges, and used when making policy decisions. Also, administrators can opt to block or allow traffic from an entire country's IP range.

• Device. Users with devices of specific platforms or marked with a specific state can be used.

• Application. Users attempting to access specific applications can trigger different Conditional Access policies.

• Real-time sign-in risk detection. Signals integration with Azure AD Identity Protection allows Conditional Access policies to identify risky sign-in behaviour. Policies can then force users to perform password changes or multifactor authentication to reduce their risk level or be blocked from access until an administrator takes manual action.

• Cloud apps or actions. Cloud apps or actions can include or exclude cloud applications or user actions that will be subject to the policy.

• User risk. For customers with access to Identity Protection, user risk can be evaluated as part of a Conditional Access policy. User risk represents the probability that a given identity or account is compromised. User risk can be configured for high, medium, or low probability.

Access controls

When the Conditional Access policy has been applied, an informed decision is reached on whether to grant access, block access, or require extra verification. Common decisions are:

• Block access

• Grant access

• Require one or more conditions to be met before granting access:

• Require multifactor authentication.

• Require device to be marked as compliant.

• Require hybrid Azure AD joined device.

• Require approved client app.

• Require app protection policy.

• Require password change.

• Control user access based on session controls to enable limited experiences within specific cloud applications. As an example, Conditional Access App Control uses signals from Microsoft Cloud App Security (MCAS) to block, download, cut, copy and print sensitive documents, or to require labelling of sensitive files. Other session controls include sign-in frequency and application enforced restrictions that, for selected applications, use the device information to provide users with a limited or full experience, depending on the device state.

Conditional Access policies can be targeted to members of specific groups or guests. For example, you can create a policy to exclude all guest accounts from accessing sensitive resources. Conditional Access is a feature of paid Azure AD editions.

Interactive guide

In this interactive guide, you'll create a Conditional Access policy for a group of users.

https://edxinteractivepage.blob.core.windows.net/edxpages/Security%20fundamentals/LP02M04%20-%20Create%20a%20Conditional%20Access%20Policy/index.html

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access

No - You don't need to install an agent or any software on your browser or your Azure virtual machine. The Bastion service is agentless and doesn't require any additional software for RDP/SSH.

Azure Bastion

Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal. The Azure Bastion service is a fully platform-managed PaaS service that you provision inside your virtual network. It provides secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over TLS. When you connect via Azure Bastion, your virtual machines do not need a public IP address, agent, or special client software.

Bastion provides secure RDP and SSH connectivity to all of the VMs in the virtual network in which it is provisioned. Using Azure Bastion protects your virtual machines from exposing RDP/SSH ports to the outside world, while still providing secure access using RDP/SSH.

https://docs.microsoft.com/en-us/azure/bastion/bastion-overview

Secure Score in the Microsoft 365 Defender portal is a measure of the security posture of the organization across your apps, devices, and identities.

Microsoft Secure Score

Microsoft Secure Score, one of the tools in the Microsoft 365 Defender portal, is a representation of a company's security posture. The higher the score, the better your protection.

Secure Score helps organizations:

• Report on the current state of their security posture.

• Improve their security posture by providing discoverability, visibility, guidance, and control.

• Compare benchmarks and establish key performance indicators (KPIs).

Points are given for the following actions:

• Configuring recommended security features.

• Doing security-related tasks.

• Addressing the improvement action with a third-party application or software, or an alternate mitigation.

Some improvement actions only give points when fully completed. Others give partial points if they're completed for some devices or users. If you can't, or don't want to, enact one of the improvement actions, you can choose to accept the risk or remaining risk.

If you have a license for one of the supported Microsoft products, you'll see related recommendations. Secure Score will show all possible improvements for the product, whatever the license edition, subscription, or plan. You'll then see all the security best practices and improvements that can be made to your score.

Your absolute security posture, represented by Secure Score, stays the same whatever licenses your organization owns for a specific product. Keep in mind that security should be balanced with usability, and not every recommendation can work for your environment.

Currently Microsoft Secure Score supports recommendations for Microsoft 365 (including Exchange Online), Azure Active Directory, Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Cloud App Security. New recommendations are being added to Secure Score all the time.

The image below shows an organization's Secure Score, a breakdown of the score by points, and the improvement actions that can boost the organization's score. Finally, it provides an indication of how well the organization's Secure Score compares to other similar organizations.

Differences between the Azure and Microsoft Secure Score

There's a Secure Score for both Microsoft 365 Defender and Azure Defender, but they're subtly different. Secure Score in the Azure Security Centre is a measure of the security posture of your Azure subscriptions. Secure Score in the Microsoft 365 Defender portal is a measure of the security posture of the organization across your apps, devices, and identities.

Both the Azure and Microsoft Secure Score provide a list of steps you can take to improve your score. In Microsoft 365 Secure Score, these steps are called improvement actions. In the Azure Secure Score, scores are assessed for each subscription. The steps you can take to improve your score are called security recommendations and they're grouped into security controls.

Use Microsoft Secure Score to understand and rapidly improve your organization’s security posture.

https://docs.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score?view=o365-worldwide

The Microsoft 365 Compliance Centre Content Search feature can be used to identify all the documents on a Microsoft SharePoint Online site that contain a specific key word.

The Content Search tool in the Security & Compliance Centre can be used to quickly find email in Exchange mailboxes, documents in SharePoint sites and OneDrive locations, and instant messaging conversations in Skype for Business. The first step is to starting using the Content Search tool to choose content locations to search and configure a keyword query to search for specific items.

Search for content using the Content search tool

Use the Content search tool in the Microsoft 365 compliance centre to quickly find email in Exchange mailboxes, documents in SharePoint sites and OneDrive locations, and instant messaging conversations in Skype for Business. You can use the content search tool to search for email, documents, and instant messaging conversations in collaboration tools such as Microsoft Teams and Microsoft 365 Groups.

Search for content

The first step is to starting using the Content search tool to choose content locations to search and configure a keyword query to search for specific items. Or, you can just leave the query blank and return all items in the target locations.

• Create and run a Content search

• Feature reference for Content search

• Build search queries and use conditions to narrow your search

• Configure search permissions filtering so that an eDiscovery manager can only search subset of mailboxes or sites in your organization

• Run an ID list search to search for specific email messages

• Search cloud-based mailboxes for on-premises users in Microsoft 365

• View keyword statistics for the results of a search and then refine the query if necessary

• Search for third-party data that your organization has imported to Microsoft 365

• Retry a Content search to resolve a content location error

• Preserve Bcc recipients so you can search for them

Perform actions on content you find

After you run a search and refine it as necessary, the next step is to do something with the results returned by the search. You can export and download the results to your local computer or in the case of a email attack on your organization, you can delete the results of a search from user mailboxes.

• Export the results of a content search and download them to your local computer

• Search for and delete email messages, such as messages that content a virus, dangerous attachments, or phishing messages

• Export a report about the results of a content search, without exporting the actual results

Learn more about content search

Content search is easy to use, but it's also a powerful tool. Behind-the-scenes, there's a lot going on. The more you know about it and understand its behaviour and its limitations, the more successful you'll be using it for your organization's search and investigation needs. Learn about:

• Partially indexed items in Exchange and SharePoint and how to include or exclude them when you export and download search results

• Investigate partially indexed items and determine your organization's exposure to them

• Limits of the Content search tool, such as the maximum number of searches that you can run at one time and the maximum number of content locations you can include in a single search

• Estimated and actual search results and the reasons why there might be differences between them when you export and download search results

• De-duplication in search results that you can enable when you export email messages that are the results of a search

Use scripts for advanced scenarios

Sometimes you have to perform more advanced, complex, and repetitive content search tasks. In these cases, it's easier and faster to use commands in Security & Compliance Centre PowerShell. To help make this easier, we've created a number of Security & Compliance Centre PowerShell scripts to help you complete complex content search-related tasks.

• Search specific mailbox and site folders (called a *targeted collection) when you're confident that items responsive to a case are located in that folder

• Search the mailbox and OneDrive location for a list of users

• Create, report on, and delete multiple searches to quickly and efficiently identify and cull search data

• Clone a content search and quickly compare the results of different keyword search queries run on the same content locations; or use the script to save time by not having to re-enter a large number of content locations when you create a new search

https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-content?view=o365-worldwide