Azure Sentinel Daily Task: Investigate Incidents

This is part of a continuing series in relation to the Suggested Daily, Weekly, and Monthly Tasks for Azure Sentinel, which outlines tasks for security analysts. In this article, I'll talk about investigating incidents as part of a daily regimen for an Azure Sentinel analyst. There's deeper discussions and training that's required to get a … Continue reading Azure Sentinel Daily Task: Investigate Incidents

Newly Expanded Azure Sentinel Feature for Closing Incidents

Working with Azure Sentinel daily I see new features added regularly. I deliver a weeklong workshop and POC for Azure Sentinel and it's rare that I don't discover something new myself during each workshop and then have to learn it and teach about it on-the-fly. But that's a good thing. As with everything in Azure, … Continue reading Newly Expanded Azure Sentinel Feature for Closing Incidents

Suggested Daily, Weekly, and Monthly Tasks for Azure Sentinel

As more and more customers use Azure Sentinel to view and respond to security alerts and threats within their organization, it becomes more important to set aside some daily, weekly, and monthly tasks to provide care-and-feeding of the product. This vigilance ensures that operations are consistently at peak performance so analysts can focus on securing … Continue reading Suggested Daily, Weekly, and Monthly Tasks for Azure Sentinel

Tip: Capturing Devices to Manage in Intune Using Azure AD Connect

Working with customers who are starting their migration for identity and administration from on-premises to Azure, I see a couple options in the installation and configuration of Azure AD Connect that get missed. Particularly, once Azure AD Connect is installed and on-premises accounts are synced with Azure, customers find that their Active Directory managed devices … Continue reading Tip: Capturing Devices to Manage in Intune Using Azure AD Connect

Azure AD Best Practice: Using Azure AD Connect Standby for Redundancy and Failover

My big focus for Azure at Microsoft is in administration and identity. This includes a lot of heavy Azure AD work. I regularly help customers assess their Azure AD implementations and plans, which puts me in the unique position to hear about customer woes directly. One of the bigger pain points I hear from customers … Continue reading Azure AD Best Practice: Using Azure AD Connect Standby for Redundancy and Failover

Azure AD Best Practice: When to Consider Using a Full SQL Server Instance for Azure AD Connect

By default, Azure AD Connect installs with SQL Express. More specifically, the default is a SQL Server 2012 Express LocalDB (a light version of SQL Server Express). If you need to manage a higher volume of directory objects, you'll definitely want to point the installation wizard to a different installation of SQL Server. The type … Continue reading Azure AD Best Practice: When to Consider Using a Full SQL Server Instance for Azure AD Connect

Azure AD Best Practice: Requiring users to periodically re-confirm their authentication information

Disabling the authentication methods re-confirmation prevents users from updating potentially outdated information such as email or phone number and can decrease the effectiveness of Self-service Password Reset (SSPR). This may also result in password reset information being sent to an unintended recipient. The default setting in Azure AD is to require users to re-confirm authentication … Continue reading Azure AD Best Practice: Requiring users to periodically re-confirm their authentication information