What’s a Token?
Storm-0558 is a China-originated attack against sensitive Exchange Online mailboxes. The attack exposed several flaws in Microsoft's processing of data. Microsoft says that the holes are now closed, but it's still a good idea to check that your tenant is not being attacked in the same way.
On the show this week, we're talking about Microsoft unbundling Microsoft Teams in response to Slack, new features coming to Teams that are long awaited, plus Justin Kohler from SpecterOps joins us on the show to talk about his TEC session.
In this article, Damian Scoles discusses what DNS records should be in place for Exchange Online, why these records are needed, and how to validate that DNS is properly configured.
Microsoft has changed the way that the Search-UnifiedAuditLog cmdlet works without saying anything to Microsoft 365 customers. The results is that some scripts don't work and others won't return the expected results. This article explains what's happened and offers a workaround. Microsoft's actions are unexplainable, but it's the norm in this area where audit log changes happen without communication all the time.
A reader asked how to use a CSV file for bulk license assignment with the Microsoft Graph PowerShell SDK. We didn't have one to hand, so we wrote a new script to illustrate the principles of how to process license assignments for a set of user accounts (which don't necessarily have to come from a CSV file). We even included some error handling!
A Multi-Forest Hybrid Exchange scenario is complicated and requires extensive planning. In this article, we discuss some good practices to help organizations prepare for a Hybrid Exchange Online sim in a multi-forest environment, including collapsing the ERF to create a simplified environment.
The multi-tenant organization (MTO) is a Microsoft 365 solution built on top of Entra ID cross-tenant synchronization. An MTO can span up to five tenants each with up to 100,000 synchronized users. It's an interesting solution that should be of interest to many large enterprises.
In this blog, James Yip reviews Microsoft's Entra ID Cross-Tenant Sync feature, and how it can make things a lot easier when deploying a M&A project.
What would happen to your organization if your top Admin disappeared? Well, it could be catastrophic... In this blog, Paul Robichaux discusses BRT attacks and how to prepare for them.
In this blog, Jaap Wesselius goes over how to set up an Exchange 2019 Edge Transport Server in an on-premises environment.
In this blog, Paul Robichaux covers a recent TEC Talk where he discusses AD-Based Attacks in 2023 and what we've learned so far.
The Microsoft Graph PowerShell SDK uses a default enterprise app to hold its permissions. Over time, the SDK can accrue many permissions, so it's important to control interactive access to it. In this article, we review how to lock down the SDK app and how to create new registered apps for use with the Graph SDK.
