Step 1: Adding Azure AD Privileged Identity Management

Privileged Identity Management (PIM) is used to manage user accounts’ access to higher-level administrative functions. All of the new compliance audits require that IT administrators operate at the lowest level of permissions possible. Besides, this is just good business practice. Here, we are using PIM to manage administrator access to the global administrator account. The user accounts that require access are set up as password administrators. This is a lower-risk admin account since all users in our environment are running multifactor authentication. So, if we have a bad actor as an administrator, that person can only reset account passwords that have a lower privilege level, and since those users are running MFA, the exposure is minimal (users can reset their own passwords and requires a mobile number to confirm identity). All of the administrator accounts have a Microsoft 365 E5 subscription assigned to them. In the configuration that we are walking through, the administrator account that is used to set up the PIM service has Microsoft 365 E5. If you are setting up the service with an account without Microsoft 365 E5, you will generate an error on the configuration. The error is generated because you need a EMS E5 license component, e.g. the Azure AD Premium P2 license. This license is included with the MS 365 E5 or EMS E5, but not with the EMS E3.

Adding Azure AD Privileged Identity Manager is straightforward. Click the Identity icon and then click Create (see Figure 4-4).

During the process, the Azure services will create the necessary components in Azure. If the Azure service has been already created or is hidden, watch for the pop-up message (see Figure 4-5) in the left corner. Click the message, which will launch the service to be configured. If you miss this step, just repeat adding the service until you have successfully clicked the message.

PIM creates a new level of security controls for your administrators. Typically, organizations like to maintain control over administrator accounts. So, the user operates at a lower level of administrator. When a user needs to operate at a higher level, such as a global admin, they use PIM to request approval for the higher level of service. The increased credentials permissions are provided for only a limited time, and then the user account is reduced to the previous level. This is a compliance requirement and allows you to control the access of users and verify their access for the type of work they are performing.

Step 2: Verifying Your Identity

Once you have selected the Azure service, the next step is to verify your identity. The Azure identity service will walk you through the steps to configure your user account and add the necessary information to Azure. The default configuration contains two forms of identification: e-mail address and mobile phone. Click “Verify my identity” and walk through the process of setting up MFA for your test account (see Figure 4-6). You will be prompted on a number of screens to verify your identity.

There are different ways you can verify your identity. I use the mobile app when I can. If you have not downloaded the mobile app from the mobile store, you will need to complete this step before you continue. Once you download the app, just select a new account and add the app. The Microsoft service will display a bar code, so scan the bar code to automatically configure the service (see Figure 4-7). Click Next and then enter the code. You will still be prompted to enter your cell number for access in case the mobile app fails (or you lose your phone).

Once you have completed the process, you will be redirected to the application to provide your consent. Click Consent to continue the configuration. You will be prompted to verify your actions before the PIM service will be configured. See Figure 4-8.

Step 3: Set Up PIM

The next step is to select the Active Directory role and sign up for access. This sets the user account as the security manager for the PIM process. Once you have PIM in place, the users’ access is managed. Configuring user access is described later in this chapter. At this point, the goal is to set up PIM so you can manage user access to the global admin account.

Select the Azure AD roles (see Figure 4-9). This will launch an investigation into your tenant and build the Azure AD roles for all users to access the Azure security services. Since you are a global administrator and you are the first user to use the services, the service will be configured around your credentials (see Figure 4-10).

Once you have completed the sign-up process, PIM is ready for additional users to access the service. The configured service should look like Figure 4-11.

There is one last item that you need to complete, and that is pinning the configured PIM service to the Azure dashboard. So before you forget, look in the right corner, and click the pin to pin PIM to the Azure dashboard (see Figure 4-12).

Step 4: Configure the Initial Role

After PIM is installed, the next step is to run the wizard and configure the user roles. The wizard looks for users with different permissions and allows you to assign them temporary administrator rights. The wizard is an important step to run to set up the baseline configuration (see Figure 4-13).

As an example, take a user who is a password administrator and wants to run as a global administrator. The user logs into Azure, accesses PIM, and requests the global administrator access. The role is assigned for a limited period of time (30 minutes in this example) to allow the user to perform the necessary actions. Global administrator rights are temporary. At the end of the time period, the user permission is restored to the nonglobal admin permissions.

PIM requires that the user have some administrator privilege level to use the service. We use a password administrator as the default administrator account (all our users have MFA deployed, so this has little impact on the user in the case of an issue with an authorized administrator). At this point, we will move to the next step and set up Identity Access Manager.

Step 1: Installing Azure AD Identity Protection

To install Azure AD Identity Protection, open the Azure dashboard at https://portal.azure.com , click “Create a resource,” click Identity, and click Azure AD Identity Protection(see Figure 4-16). This will start the installation of the Azure AD Identity Protection service. The Azure AD Identity Protection service is the service that monitors user access to Office 365 and Azure resources. Once you select the resource, then click Create and pin the resource to your Azure dashboard. This will create the Azure subsystems necessary to use the resource you selected.

Step 2: Setting Alerts in Azure Identity Protection

We are focusing on the settings and the configuration. At this point, we want to have alerts in place to let us know when an event happens and to take the appropriate action. After we set up the alerts, we will configure the user policies to manage those alerts. To configure the alert settings, click Alerts (see Figure 4-17) and follow the next steps. In this case, we are sending the alerts to the o365admin test account.

1. 1.

   Click Alerts.

    
2. 2.

   Set the alert to level Low.

    
3. 3.

   Click Included and then + Add (to add a user for the alerts).

    
4. 4.

   Select the user.

    
5. 5.

   Click the Select button.

    
6. 6.

   Click Done.

    
7. 7.

   Click Save.

    

Step 3: Setting Up a Weekly Digest in Azure Identity Protection

After you click Save, the next step is to set up the weekly digest. The weekly digest has similar configuration steps that we just completed: you enable the digest and select the user. After you select the user, the screen should look like Figure 4-18 before you click Save.

The Azure Identity Protection service will send you a weekly summary of the different activities so you can verify the access (Figure 4-19). What you are looking for are attack trends. The trends of the access by bad actors will give you a better understanding of the threats that you will need to defend yourself.

Step 4: Configure the Risk Policy

There are three different configurations for a risk policy. Risk policy is actions taken on a user account to protect company information. A risk can be a password attack, or any type of activity that is nonstandard user behavior. Risk level is what the business assigns to different levels of attacks on an account that may become compromised (e.g. the credentials are stolen). To combat risk, you may force users to authenticate with MFA. Keep in mind that any action you take on risk policy is a global action and effects all users. After you have configured Office 365 and see the type of events that are happening, you can tighten the different risk policies to have better control over the Office 365 user access. The critical users that you want to worry about are the administrators. The administrators are the targeted users in Office 365.

Configuring risk policies for the administrators and making them subject to MFA is simple. You add the administrator users that you want subject to the MFA authentication and you enforce the MFA policy. In this example, we selected two users, set the controls to require MFA, and set enforced to on (see Figure 4-20).

At this point, you have configured the alerting activity for privilege access. You can now turn on additional security features to help manage user accounts. We recommend that you enable only a few test accounts to verify the functionality. Once you are satisfied, then you can roll this out in mass to all users. The next step is to configure Azure Information Protection.

Step 1: Install Information Protection

The first step is to enable the AIP service in the Office 365/Azure tenant. To set up the service, go to the Azure dashboard and add the service to the dashboard. You can pin the AIP service, or you can add it to your favorites. See Figure 4-22.

Once we have selected the service, we will create the service (see Figure 4-23). This is a simple process; just select the service under Identity and Azure Information Protection and then click Create to start the service. This will start the service and set up some of the background configuration that is required for your Office 365 account. Once you have enabled the service, you can add this to your dashboard by selecting All Services, finding the services, and then adding them to the favorites (by clicking the star next to the service). Microsoft is working to make this more of an automatic process that is tied to the subscription type.

Once you have created the service, the next step is to set up the service (see Figure 4-24). In our service setup, we will be executing two steps. First, we will activate the service, and then we will come back to the service and set up new document classification and organization policies. We highlighted two areas in Figure 4-24: the protection activation and the labels. Click Activation to activate the service. Once you completed this step, the protection status will say “Protection status is activated.” After we have activated the service, our next action items will be to create a simple documentation classification (detection for credit card numbers) and then the policy to implement the document protection and classification.

Setting up a policy on credit cards is simple and has little effect on the organization. Do not get me wrong; protecting the organization from sending out credit card information in the e-mail is critical. We need to protect the organization from violations that will result in fines. Under the new California law (CCPA), this data breach could result in fines of up to $750 per record, on the assumption that the consumer was harmed. The changes that we see in the new laws (like CCPA) are over assumed harm. Under old laws, harm had to be proven by the consumer. Under the new laws, harm is assumed. Businesses need to prove that protected personal information was not distributed to unauthorized third parties. This is why the Azure Information Protection is so critical to businesses, and the distribution of information needs to be tracked.

As an example, we can create a credit card protection rule where we allow documents (that contain credit card information) only to be read internally but not e-mailed externally. If a user e-mails the document externally, our labeling will block external user access to the document. The document rules are managed in the Office 365 Security & Compliance Center.

Step 2: Define Additional Label Classification

The first step after you have enabled the service is to define an additional documentation label that can be used to govern your business. Once you have defined the labels, the labels are now part of the documentation classification in the Office 365 Security & Compliance Center administration center.

Our approach is to walk you through the label configuration process on how to set up a credit card for detection and analysis. Once we are completed with this, we will quickly review the automatic label generation process.

The first step in configuration is to review the label structure and create the necessary sublabels and behavior that we want to see on the Office 365 user. In our case, the document that contains credit cards will be marked Confidential. We are going to create a sublabel for this document, as shown in Figure 4-25. Right-click Confidential and select Add a sub-label.

This launches the Sub-label windows. Change the default settings as described next (see Figure 4-26).

There are 13 steps we need to follow to enable the credit card protection in our document. The steps are cumbersome because there are many different options that organizations need to follow based on their security polices (so there is no one-size-fits-all solution). The changes that we are making are numbered 1–8 (see Figure 4-26) and described here, and steps 9–13 are shown in Figure 4-27.

1. 1.

   Turn on the service (enable it and define the label), in our example we used Credit Card as the name of the rule.

    
2. 2.

   Select the label to protect the documents.

    
3. 3.

   Select Azure Protection; this will launch the protection options.

    
4. 4.

   Select Add permissions to the document. (If you want to restrict e-mail distribution, select set user define permissions).

    
5. 5.

   Specify the users and groups who will access this document label; in our case, this is only users from our e-mail domain.

    
6. 6.

   Define the type of access users will have (make them all reviewers). Click OK and Save to return to the main blade.

    
7. 7.

   Set visual marketing’s (watermark) on the document.

    
8. 8.

   Define a header for the document and a color (in this case red) .

    

The basic label has been created. Save the changes on each of the blades. The next step is to apply the new document classification to all documents. There are additional document selection parameters. I recommend you leave these at the defaults and change them later after you have tested the document in production.

At this point, we have set up a new document classification label called Credit Card (see Figure 4-28). Let’s apply the changes throughout the Office 365 tenant.

Step 3: Applying the Document Classification Globally

So far, we created a new document classification called Credit Card. This document has a subtype of Confidential, and we have restricted access to the document to users in our company with the e-mail address getoffice365security.com (remember step 5 in Figure 4-26). The restriction that we placed on the document is as a reviewer. Next, let’s select Policies (under Classification in Figure 4-29) and then select Global (there should be only one policy in place unless you added a policy).

In Figure 4-29, we need to add the new document classification to our global default policy. This simply requires adding the document classification type. In Figure 4-29, once you are in the global document classification, the next step is to add the document and select Credit Card. This will immediately begin the document classification process. The next step is to download the right management protection tool.

Step 4: Downloading the Document Classification Tool

Documents are automatically classified based on the process that we defined in step 3. The document classification tool allows users to classify documents according to our company standards. There is so much information that we have created; the only way that we can truly become compliant is that we train the users in document classification. Granted, not all users think the same, which is why we create special rules and procedures to keep our users in check (so to speak). From a compliance management perspective, if you rely only on automated tools, you will not catch everything. You need the users’ help.

Once you have downloaded the client, install the client (see Figure 4-30) and start Word (or PowerPoint, etc.). This will display the document classification menu (see Figure 4-31).

After you have installed the AIP client, you will need to sign up for the Azure Rights Management Service (RMS) to make sure the document is tracked. Open Word, and select Track and Protect under the AIP icon in the toolbar. Then click Protect, then Track and Revoke (see Figure 4-32). This is the process you will use to mange access to documents you distribute. This is in addition to any label controls that were created globally on documents.

Keep in mind that the user needs to control the flow of information that is sent externally and manage the documentation workflow. As an IT administrator, you can set polices on documents from a global sense, but it will be the individual users who need to manage the document they distribute to their customers. As an example, say we have a sales document that we use and distribute to potential clients. As a salesperson, I will manage my own information based on client needs. You cannot do this action globally; otherwise, you will affect sales in the organization.

Step 5: Enabling the RMS Tracking Service

Clicking Track and Revoke will launch the Azure RMS tracking service. You will need to sign in or sign up for the service (see Figure 4-33). This allows you to track documents worldwide (once the document is classified). You can revoke access and grant access.

Once you have completed the sign-up process, download the clients for the different devices that you are using (see Figure 4-34). This way you will have a 360-degree view of all documents and be able to track and revoke rights from users.

Step 6: Test the Document Classification Service

Testing the service is easy. Search the Web for a demo credit card number. The best way to test this is to create a Word document with the information. The AIP systems will prompt you for permission to send the document (see Figure 4-35). If you drop the e-mail into a document, the e-mail will be sent but will be encrypted per company policies.

The e-mail encryption is automatically handled, but what about a user trying to send a Word document with protected information (Figure 4-36)? The service works the same way. The e-mail in Figure 4-37 is the document as received by the end user.

I sent the Word document using the share function, and when Outlook finished loading, I was prompted to sign in to the Azure information service. If my system was Azure, then there would be no login prompt. If I was an external user and not permitted to read the document, I would be blocked from document access.

Step 7: Configure the Data Loss Prevention Rules

The DLP rules allow you to automatically classify e-mail based on content and leverage AIP client for special features (such as Do Not Forward and other actions). In the use of AIP, we customize our e-mail portal and define labels for our document classes. AIP will process the document and recommend a classification based on the document content (see Figure 4-38). Define the document class, and the users will help you with the document classification. Keep the document classification and types to a minimum number for the best results.

Step 1: Setting Up the Office 365 Rights Management Service

Office 365 encryption is easy to set up and configure. The first step to use encryption is to enable the Office 365 Rights Management service. Once you have enabled the Rights Management service, you select the various rules that you want the Rights Management service to use in automatic processing communications external to your organization, as well as manual configuration of a confidential service.

Log on to Office 365 and enable the Rights Management service (only global administrators can activate this). Click Settings, click “Services & add-ins,” and then click Azure Information Protection (see Figure 4-43).

After you click Azure Information Protection, select “Manage Microsoft Azure Information Protection settings.” This will redirect you to an admin screen that shows the settings of the service. This will show you the status (see Figure 4-44). If the service is not activated, then activate the services. Keep in mind it will take 30 minutes to fully activate the services.

Step 2: Enable Azure Information Protection

Next, click “advanced features.” This will take you to the Azure Information Protection application; then select “Protection activation.” This will enable the encryption service. This should be already enabled from the earlier steps (see Figure 4-45).

Step 3: (Optional) Configure the Automatic Encryption Rules for HIPAA and PII

You can configure DLP rules in the Office 365 Security & Compliance Center. To configure the rules, go to the Office 365 admin center, and select Security & Compliance Center. Once in the Security &Compliance Center, select Data Loss Prevention and Policy. We are going to create a new policy, so click Create Policy (see Figure 4-46). In our case, we are going to select the “Medical and health” option for our policy and US Health Insurance Act (HIPAA) .

Click Next and name your policy (leave as default); see Figure 4-47.

Click Next and choose the locations (leave as default); see Figure 4-48.

Click Next to restrict the encryption to e-mail only (see Figure 4-49). In this example, we are only setting up HIPAAA rules for Exchange e-mails that are sent externally.

Click Next to customize the content you want to protect. In this case, we are looking only at HIPAA information. In Figure 4-50, if you click Edit, you can define the accuracy of the content match. As an example, for PII information (such as Social Security numbers), you have a range that starts at 75 percent.

It is important that you check your business rules in your organization on the PII information and what risk factor you want to have. If you set it too high, then all e-mail will be encrypted. If you set too low, then you will have no e-mail encrypted. The recommended setting is the default at 75 percent, but this is really an organization decision on PII/HIPAA information distribution.

Click Next to automatically encrypt the content (see Figure 4-51). In one of the previous steps, we excluded OneDrive and SharePoint. This is the reason why. We are encrypting the e-mail that is being sent externally from the organization.

Click Next; then choose your label that is appropriate for this content (see Figure 4-52).

Labels are becoming more important to organizations. Data needs to be typed and configured. In Figure 4-52, we have different labels that we have already configured. We recommend that you look at the documents in your organization and define a tighter granularity for documents. Minimize the creation of new labels as much as possible. A lot of labels, adds complexity and confuses the end users (who will be doing most of the work on classification). Make the label classification process a simple process. This will make your job much easier to manage the document configurations.

Once you have configured the rules, you can test the policy or have it implemented. In this case, we will implement the policy. I recommend that you put the policy in test mode until you have the Outlook Message Encryption (OME) environment configured with your company headers and portal customization. See Figure 4-53.

Click Next to review your settings. If everything looks correct, then click Create. This will create the encryption rules for you in your Office 365 tenant. This process of rule creation will take a few minutes. Once the rules are completed, they will show up in the Office 365 Security & Compliance Center’s DLP portal.

Step 4: Customize the E-mail Encryption Service for Your Business

There are four customizations you can make to set up an encrypted e-mail: adding your logo, customizing the encryption message, customizing the encryption center, and adding instructions to the encrypted e-mail. These configuration changes are made in PowerShell and are described here.

• Adding your logo

  In Figure 4-54, we branded the encrypted e-mail to use our KAMIND IT logo. To add your logo to Office 365 encryption, run the PowerShell commands shown here. Your customized logo will be displayed to the recipient.

  #Load the JPG file to the user tenant

  Set-OMEConfiguration -Identity "OME configuration" -Image (Get-Content "C:customerskamindkamind_new_2014_v3.jpg" -Encoding byte)

• Adding your customized text

• In Figure 4-54 we added customized text to display information for KAMIND IT. To add your customized text, execute the PowerShell command shown here:

  #Load the JPG file to the user tenant

  Set-OMEConfiguration -Identity "OME configuration" -DisclaimerText "This message contains confidential information and is intended for the recipient. If your e-Mail account is not set up to read encrypted e-Mail, you can add this feature by adding security credentials to your existing e-Mail using the Microsoft website at http://account.live.com. If you have any questions, please call KAMIND IT at (503) 726-5933."

• Customizing the encrypted e-mail portal

• In Figure 4-55, we added customized text to display the branded portal and our KAMIND message. To add your customize text, execute the PowerShell command shown here:

  #Set the Customize text and Portal Text

  Set-OMEConfiguration -Identity "OME configuration" -EmailText "Encrypted message from [email protected]" -PortalText "KAMIND IT Inc. Secure E-Mail Portal – www.kamind.com (503) 741-8922"

Step 5: Download the AIP Client

We have already downloaded the AIP client and installed it in Outlook. There is no additional configuration necessary. For the installation instructions, please review the previous section on Azure rights management. That is all that is required to set up Office 365 e-mail encryption and to customize the portal for our clients to use. Once you have set up the e-mail encryption portal, you can extend the service to other parts of AIP. As an example, you can set up documents with metadata policy strings that the DLP rules can process to determine the best way to control information that is being sent externally. As an example, strategic plans may have a “Company Confidential” description placed in the metadata. The DLP rules can be configured to find the information and block the distribution of documents externally from the company.

Step 1: Create a New Rule in the Exchange Admin Center

To create a new rule in Exchange admin center, select the plus sign (See Figure 4-57 ) to create the rule. The next step is to configure the rules characteristics.

Step 2: Enter the Name for the Rule ManualEncryptEmail, and Select the Conditions of the Rule

The exchange steps for the legacy configuration are easy to set up and configure. Follow these steps:

1. 1.

   Click the blue link “More options” to expand the encryption options (see Figure 4-58).

    

Step 3: Add the Encryption Rule Actions

Define where the recipient is located (outside of the organization) and set the message header sensitivity to include Confidential. In “Do the following,” select “Apply Office 365 Message Encryption to message” (see Figure 4-59).

The final rule should look like Figure 4-60.

Step 4: Test the E-mail, and Use Outlook to Send an E-mail

Open Outlook and send a test encrypted message. Select the optional options on the message (icon below Low Importance), change Sensitivity to Confidential, and send the message as shown in Figure 4-61.

The e-mail received by the client will look like Figure 4-62. Click the e-mail to read it and unencode it. In our example, we sent the e-mail with the option “Do Not Forward” (see red “do not enter” icon).

The secret on using encrypted email is to make sure your portal is branded with your business logo. You need to train your customers visually on what is an accepted email from your organization. The customized portal helps your customer recognize messages that come from your organization.