Everyone likes reports. Well, here's a PowerShell script to create a report of Exchange Online mailbox content. The script uses the Graph API to list every item more than a year old (you can remove the filter if you like) and creates an Excel workbook containing the data. What you do with the information afterwards is up to you!
The bad news is that Exchange Server has two more day-zero vulnerabilities to cope with. The good is that Microsoft has figured out some mitigations. The ongoing problem remains that attackers like to go after Exchange Server because so many servers are in a poor state of maintenance.
Outlook mobile is Microsoft's preferred option for a mobile email client for Exchange Online. However, many still use Exchange ActiveSync (EAS)-based clients like the native iOS mail app. What's the best choice? :Like many things, it all depemds/
A report by the Microsoft 365 Defender Research team explained how attackers compromised admin accounts in a Microsoft 365 tenant. They then created a malicious OAuth app, granted the app some high-priority permissions, and used it to update the Exchange Online configuration to allow spam traffic to flow. All of this comes down to allowing attackers to compromise admin accounts.
At the TEC 2022 conference, Alex Weinert, Microsoft VP for Identity, outlined the need to deploy Azure AD MFA to protect accounts in Microsoft 365 tenants. Only 26.64% of all Azure AD accounts use MFA today, and while that percentage has grown from 1.8% in 2018, it's still disappointing.
Security researchers report that Teams stores the access token it uses in clear text on user workstations. Is this an issue? Well, it's not good, but it's probably not going to lead to many compromised workstations.
The Teams external access configuration includes an allow list that defines which Microsoft 365 tenants are allowed to collaborate with your users through chats and meetings. To make sure that your allow list is complete, we can check the guest accounts present in the tenant and update the configuration with the domains used by guests. All in a matter of some straightforward PowerShell code.
Microsoft 365 tenants usually include many Entra iD apps. These apps hold permissions, including permissions that hackers like to exploit. This article explains how to use PowerShell to detect apps with high-priority permissions and report them to administrators for review.
The GIFShell attack describes how attackers can penetrate Teams to run commands using special GIFs, including the ability to exfiltrate data. One practical and quick way to stop similar attacks is to limit the set of Teams organizations your tenant will communicate with by establishing an allow list for external access.
The great remove basic authentication from Exchange Online project is rapidly approaching the October 1 date when Microsoft will start removing support for basic authentication for seven email connectivity protocols. We've known about this date for well over a year, but some organizations need a little extra time to be ready. Microsoft is offering a one-time three-month extension to January 1, 2023. After that, they're going to proceed with the final termination.
On August 26, Microsoft announced that they will retire Kaizala in August 2023. The Kaizala retirement is not big news because it's been coming for a while. If you want to get ahead of the game, you can remove the Kaizala service plans from the Office 365 licenses assigned to user accounts. We explain how to do the job in an example PowerShell script.
Until the arrival of V3.0 of the Exchange Online management module, Microsoft didn't support using an Azure Automation managed identity with Exchange Online PowerShell. In this article we explore how to use Exchange Online PowerShell with Azure Automation to get work done.
