free780

Here. https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal#configure-device-settings Be aware if you want users to use passwordless auth on personal devices this may be hindered.

The RC4 change has caused some issues. Looks like where a group policy setting has clashed with the change.

Explain more please I’m happy to be wrong.

This also works on Windows 10 and Windows Server 2022 even on prem. RDP can be subject to conditional access. https://techcommunity.microsoft.com/t5/azure-virtual-desktop-blog/announcing-public-preview-of-sso-and-passwordless-authentication/ba-p/3638244

I struggle to see what this is achieving. MFA prompts should only be triggered from new locations or devices (if you allow BYOD). If a bad actor has gained a foothold on your network then you really need defence in depth. Review your Anti-Malware solution and E-Mail filtering solution, given that E-Mail is the main way an attacker gains a foothold. If a bad actor has a foothold and a service account creds MFA isn't going to prevent Ransomware across multiple endpoints. Prehaps see if you can disable SMB and RDP Inbound to clients and any servers that don't require it.

I would imagine most environments should be Ok with the changes. You can monitor changes before enforcement. https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d How to manage the Kerberos protocol changes related to CVE-2022-37966 https://support.microsoft.com/en-us/topic/kb5020805-how-to-manage-kerberos-protocol-changes-related-to-cve-2022-37967-997e9acc-67c5-48e1-8d0d-190269bf4efb How to manage Kerberos protocol changes related to CVE-2022-37967 https://support.microsoft.com/en-gb/topic/kb5021130-how-to-manage-the-netlogon-protocol-changes-related-to-cve-2022-38023-46ea3067-3989-4d40-963c-680fd9e8ee25 How to manage the Netlogon protocol changes related to CVE-2022-38023 https://support.microsoft.com/en-us/topic/kb5008383-active-directory-permissions-updates-cve-2021-42291-536d5555-ffba-4248-a60e-d6cbc849cde1 Active Directory permissions updates (CVE-2021-42291) can't replicate this issue.

If you have the budget you can use mailgun or similar to send mail as long as your app/service supports authentication.

Make sure you are not SSL/TLS inspecting any Office 365 domains. Ideally don’t proxy any Office 365 traffic given the amount of persistent connections.

Yes. Is it limited to organisational owned devices? If not then you need a way to check for compliance.

In the pre covid and pre machine wide installer days I scripted a scheduled task to download the latest Teams Installer to sit somewhere on C. Then each user would need to start Teams. This reduced some of the time. It is Electron which is Chromium really. Primarily it’s was designed for 1:1 devices.

I knew there was a US one. Now finally a UK site!

MTA_STS requires placing a web server with inbound tcp/443 to validate sources of e-mail I believe.

What’s this Novell you speak of ? I wouldn’t use self signed certificates anymore. Best to use publicly trusted certs.

You can pay for A5 MS licensing and do something with Information protection to protect files with authentication and encryption. You can provide warning tooltips as part of M365 Compliance (not sure of licensing requirements) I can't see how recall can work without access to Gmail, Yahoo, Microsoft and every mail service in the world.

I'd go for split tunnelling and do filtering on the client.

There are some options yu can change in the CA policy depending on licensing. https://learn.microsoft.com/en-us/azure/active-directory/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime

It depends if you offer wi-Fi for guest devices which may include Windows 11 22H2. You may need to to have a capture site where a certificate can be generated upon successful authentication. If its for organisational owned devices you can disable cred guard so you can test.

Given the amount of Chrome CVEs I wouldn’t run EOL chromebooks. The expiry of root certificates will also start to cause issues.

You can use FSSO (Fortinet Single Sign On). Auth can come from radius or even SAML. Different subnets/VLANS would be easier.

Be aware that Credential Guard is enabled by default. So could cause issue with radius authentication due to stored passwords.

I think most be orgs will wait until Windows 12.

The C update was released last night. It’s like a preview for next months updates. You can run it on some test VMs. They don’t usually expired the A update though.

My impression is that Google don’t like the MITM certificate. You probably spend a lot of time putting domains in an exception list due to MITM breaking apps in Android and iOS. Even without MiTM the fortinet can check domains and block known bad domains. The filtering needs to move to browser extensions really. Not possible on Android and iOS though.

398 days is the limit for publicly trusted certs. I wouldn’t use self signed anymore. It’s pointless.

I was a bit put off as they said their OneDrive mapper didn’t use WebDAV. It did.