Azure Active Directory

This page will list security settings and configurations that is advisable to implement in your environment.
Each environment is different where I believe the below settings are easy to setup and provides a way to get to a more mature security level.

Multi-factor authentication for all admins

There are a lot of admin roles a user can receive. Some admin roles are restrictive in what the user is able to do but for example global/SharePoint and Exchange administrators can change a lot of settings where you want an additional layer of authentication before they can log on. You have a single point of failure when not using multi-factor authentication. The username and password is enough to log on to a users mailbox or OneDrive folder. Fishing mails are mostly used to retrieve the users username and password where the attacker can then easily log on with these credentials. Multi-factor authentication makes it difficult for the attacker to log on as they will also need to have your phone where for example an SMS token is being sent. Although the attacker may steal your credentials, they are not able to get access to your information. Note that a lot of sites and applications offer multi-factor authentication, its normally not enabled by default.

Using PowerShell

You will need to install the MSOnline module to be able to use the below CMDlets. Run the below CMDlets to enable multi-factor authentication for all administrators.

$mf= New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement
$mf.RelyingParty = “*”
$mfa = @($mf)

Get-MsolRole | ForEach-Object { Get-MsolRoleMember -RoleObjectId $_.ObjectId } | Where-Object {-NOT $_.StrongAuthenticationRequirements.state} | Set-MsolUser -userprincipalname $_.UserPrincipalName -StrongAuthenticationRequirements $mfa

Multi-factor authentication for all users

It is just as important to enable multi-factor authentication for users as it is for administrators. Administrators have the ability to manage the environment but the users hold the data in their mailbox or in OneDrive. You will want to enable multi-factor authentication also for them. You have a single point of failure when not using multi-factor authentication. The username and password is enough to log on to a users mailbox or OneDrive folder. Fishing mails are mostly used to retrieve the users username and password where the attacker can then easily log on with these credentials. Multi-factor authentication makes it difficult for the attacker to log on as they will also need to have your phone where for example an SMS token is being sent. Although the attacker may steal your credentials, they are not able to get access to your information. Note that a lot of sites and applications offer multi-factor authentication, its normally not enabled by default.

Using conditional access

You can use conditional access to force multi-factor authentication for administrators but you will need to have the Azure Active Directory Premium plan 1 license. Click here for the direct link.

Create a new policy and select a group which has all the users. Preferably a dynamic group. In my case I use the same group I use for group based licensing as these are the users who have an active license to Office 365. A different conditional access policy restricts users without a license to log on to the environment.

Then select require multi-factor authentication and save the policy

Using PowerShell

You will need to install the MSOnline module to be able to use the below CMDlets. Run the below CMDlets to enable multi-factor authentication for all administrators.

$mf= New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement
$mf.RelyingParty = “*”
$mfa = @($mf)

Get-MsolUser -All | Where-Object {-NOT $_.StrongAuthenticationRequirements.state -and $_.isLicensed -eq $true} | Set-MsolUser -userprincipalname $_.UserPrincipalName -StrongAuthenticationRequirements $mfa

Password expiration to never expire

Users need to remember a lot of passwords, not only at work but also for other websites. You want to prevent users from writing down their passwords in a book that is next to the computer or using post-its sticked to the computer itself with their password. The need for a recycling of passwords is less when you implement multi-factor authentication as the password alone isn’t enough to get access to the account. You will still need to reset the password should there be signs of malicious activity for that user but forcing the user to create a new password every 3 months isn’t the way to go. The user will create simpler passwords to remember them as variations of the current password is most of the time not allowed. NIST also references this in NIST SP 800-63 https://pages.nist.gov/800-63-FAQ/#q-b05

Two to four global administrators

Global administrators have full permissions in Office 365 where you want to limit the amount of administrators with these permissions. It is also good to have at least two global administrators should the other administrator go on vacation. Administrators should receive the least amount of privilege to be able to do their day-to-day work. Exchange administrators should receive the Exchange admin role and the same for SharePoint or Team administrators. We also suggest to limit the amount of administrators for other admin roles as it is normally not required for more then 4 users to be a SharePoint administrator.

Using PowerShell

You will need to install the MSOnline module to be able to use the below CMDlets. Run the below CMDlets to verify the amount of administrators for each role.

$roles = Get-MsolRole
foreach ($role in $roles){
$members = Get-MsolRoleMember -RoleObjectId $role.ObjectId
$count = $members | Measure-Object | Select-Object Count
if ($count.count -lt 2 -or $count.count -gt 4 -and $count.count -ne 0){
write-host “Role $($role.name) has $($count.count) member(s)” -ForegroundColor red
}
}

Restrict users to grant consent to unmanaged applications

Users are by default able to grant consent to third party applications. They are for example able to logon to LinkedIn or Kahoot with their credentials. The third party application will then ask for consent where the user can grant it for themselves. It is advisable to block users from being able to give consent for these applications as they should be managed. It is possible for administrators to grant consent where all users or a group of users can then use this application. Most of the third party application won’t require much permissions but there are third party applications that wants read and write access to for example the users mailbox. Note that previous added apps will continue to work for the users that granted consent. There isn’t a good PowerShell CMDlet yet so I will use the GUI where this setting needs to be applied on two places.

Azure Active Directory