Module 3 – Technical Fundamentals
Security
Presenter name
Date
Microsoft 365 Course agenda
Business Premium Module 0 Overview
Technical
Fundamentals Module 1
Introduction to Microsoft
365 Business Premium
2 hours
Day 1
Module 2 Partner Transform platform
Module 3 Security 2 hours
Teams administration and
Module 4 2 hours
Day 2 governance
Module 5 Device management 2 hours
Module 6 Business Voice 2 hours
Day 3
Module 7 Scenarios: Make it real 2 hours
In this module, Secure M365 Business premium
you learn to: (customer environment)
Plan for security with customers
Enable secure remote work
Session agenda Security foundation
Identity security
Email protection
Information governance
Endpoint / Device security
Bringing it all together
Security foundation
Cyberthreats– primer
Phishing Fraud in which an attacker masquerades as a reputable person. It’s often easier to
trick someone than to hack in.
Ransomware Malicious encryption software that blocks access to systems and demands a sum
of money to unlock. An infected PC can spread the ransomware to other computers on your
network.
Fileless attacks use malicious scripts that hijack legitimate software and load malware into
memory, without saving to the file system. This makes the malware harder to detect.
Live off the land attacks use trusted software and system tools to carry out their work.
Examples are administrative shells, antivirus programs, RMM software, etc. This makes it
difficult to detect and/or determine who is behind the activity.
Why should SMB customers Perception
I am too small a business for hackers
care about security? to attack me…only large enterprises
need to worry about security…
Reality
“Someone was fooled by the email from the CEO and
used his Corp card to send the iTunes gift cards. We
lost about $5,000.”
—Adam A., equipment rentals, 150 employees
“The only reason we caught it was that it was a 6-digit
sales order and our sales orders are 7 digits.”
— Joe B, food distribution, 250 employees
“They got someone’s password, and sent an email to
our CFO, who sent the $40,000 wire transfer.”
— Bob K., property management, 150 employees
Small businesses are vulnerable to cyberthreats
61% 70%
50% of small of small businesses that of SMBs agree that
businesses have experienced a recent their business would
experienced an attack attack were not able to be crippled by a
in the past year operate successful cyberattack
Source: Forrester Research, 2020
What is Microsoft 365 Business Premium?
A comprehensive security solution that is integrated with Office 365
Defend against Protect Secure
cyberthreats business data your devices
All the capabilities of Microsoft 365 Business Standard, plus
advanced cybersecurity, data protection, and device management
Security built into Microsoft 365
Microsoft 365 includes built-in security protections
Encryption of data at rest and in transit
Continuous data backup via replication to geo-redundant servers
Robust spam and virus filtering
“Red team / Blue team” exercises
Microsoft invests $1B per year on security
Protections are on by default; no action necessary
Check your Secure Score
The problem:
You want to improve your customer’s
security, but don’t know where to start
The solution:
Check Microsoft Secure Score
What it is:
Microsoft Secure Score analyzes your
Microsoft 365 overall security and assigns a
score. Secure Score also recommends next
steps to consider in order to improve security.
How to access:
[Link]
Complete Setup Wizard
Check Secure Score
Demo/Exercise
Pop quiz
01
As we progress through the
lab exercises our Secure Score
should go up. When should
we expect to see changes
reflected in Secure Score?
Immediately Tomorrow
M365 Security at a glance
Set up tenant
Configure identity protection
Configure email protection
Corporate data containment
Advanced Security
Device management & security
Secure remote access
Checklist: [Link]
How to use the checklist
Review the guidance
Download the checklist
Determine your customer’s risk scenario
• Typical customer
• Higher risk / lower tolerance for risk
Checklist: [Link]
Identity security
Start with single sign-on
Azure Active Directory as your identity control plane
Microsoft
Azure AD
Single sign-on
Enable MFA to keep remote employees protected
Verify user identities to establish trust
Other methods to verify identity
Signals Device
Windows Hello FIDO2 security Push notification
Microsoft key
Microsoft
Azure AD Microsoft
Azure AD Authenticator
User and Soft Hard SMS,
location tokens OTP tokens OTP voice
Application
Multi-factor authenticationReal-time
prevents 99.9% of identity attacks.
risk
Protect access for any user from anywhere
Apply consistent risk-based policies with Conditional Access
Signals Verify every Apps and data
access attempt securely connected
User and Device
location Allow access
Require MFA
Microsoft
Azure AD
Limit access
Application Real-time Block access
risk
Enable Self Service Password Reset
Enable combined security information registration
Enable Security Defaults
Enable MFA with Conditional Access policies
Demo/Exercise
Pop quiz
02
Can I use Security Defaults
to enable MFA if my
customer also requires
Conditional Access policies?
YES NO
Always use Security Defaults or Conditional Access for MFA
Do not enable MFA on a per user basis in Users pane of the
Admin Center
Always exclude an admin account from the policy to ensure you
can correct a mistake
Best practice tips
Start with one target group of users
Ensure your users know what to expect
Test your policies with a test user before rolling out
Enable SSPR in Azure AD
Enable Combined Security Information Registration in Azure AD
Create an emergency access admin account
Enable common conditional access policies
Block Legacy Authentication
Common tasks
•
• Require MFA for admins
• Require MFA for all users
• Secure security info registration
• Block access by location
• Require compliant devices
Password hash sync
Sync Agent
Microsoft
Azure AD Active
Directory
Enable cloud authentication
Flexible options based on your situation On-premises
apps
SaaS apps
No real-time on-premises dependency
or new infrastructure needed.
Run the hybrid identity wizard
Run Idfix
Install and configure Azure AD Connect
Demo/Exercise
Email Protection
Exchange Online Protection (EOP)
Blocks commodity spam and malware
Transport Rules
Block auto-forward
Add warnings
The basics DNS records
MX, SPF, DKIM, & DMARC
Office 365 Advanced Threat Protection (ATP)
Analyzes email & files for anything suspicious
EOP & ATP
Does not address endpoint or network security
Exchange Online Protection (EOP)
Blocks commodity spam and malware
Email Protection Transport Rules
Block auto-forward
Add warnings
Enable EOP Common Attachments Filter
Create a transport rule to mark External email
Demo/Exercise
DNS records
The basics MX, SPF, DKIM, & DMARC
Enable email authentication
(SPF, DKIM, and DMARC)
Demo/Exercise
Office 365 Advanced Threat Protection (ATP)
The basics Analyzes email & files for anything suspicious
Safe Attachments
Set policies to identify if email attachments are
malicious
Catch identified threats in corporate mail before
they reach the inbox
Extend protection to files in SharePoint Online,
OneDrive for Business, and Microsoft Teams
View ATP reports in the Office 365 Security and
Compliance Center dashboard
How it works: Email attachments are opened and
tested in a virtual environment. If malicious, the
attachment is blocked. Protection also applies to
attachments shared via SharePoint Online, OneDrive
or Teams.
Safe Links & URL Detonation
Prevent users from being compromised by
files linked to malicious URLs
Safe Links policy can allow users to bypass
warnings and enable tracing
How it works :Each time a user clicks on a
URL, the link is checked by ATP Safe Links
before redirecting to the website.
ATP Anti-phishing
What it is: How it works:
Mitigation against spoofing attacks / An array of techniques, updated as threats evolve, help block
forged domains sophisticated impersonation attempts.
Identifies senders that fail • Detection of forgery of the 'From: header’
authentication
• Understanding the history of the source’s email infrastructure
• Machine learning algorithms that understand a user’s normal
patterns of contact with others
Emails may be blocked, sent to junk mail, quarantined, or have a
Safety Tips displayed
Examples:
Có[Link] instead of [Link]
meganb@[Link] instead of meganb@[Link])
Enable ATP Safe Attachments Policy
Enable ATP Safe Links Policy
Enable ATP Anti-Phishing Policy
Demo/Exercise
Information Governance
Do you have a strategy for protecting and
managing sensitive and business critical data?
Do you know where your business critical and
sensitive data resides and what is being done
with it?
Do you have control of this data as it travels
inside and outside of your organization?
Are you using multiple solutions to classify,
label, and protect this data?
Information Understand your data landscape and identify
important data across your hybrid environment
Protection &
Governance
KNOW
Protect and govern data YOUR DATA
– wherever it lives
Apply flexible protection Automatically retain,
actions including PROTECT GOVERN delete, and store
encryption, visual data and records in
markings and DLP
YOUR DATA YOUR DATA compliant manner
Powered by an intelligent platform
Unified approach to automatic data classification, policy
management, analytics and APIs
Protect and control your data and documents
Encrypt Apply restrictions Protect against Archive
email to email and data leaks email data
documents
Encrypt emails
The problem:
Sensitive information is sometimes sent via email
The open nature of email systems means this information is
at risk of being read by unauthorized people
The solution:
Encrypt email sent from Microsoft 365 Business, so only
the intended recipient can access it.
Email encryption
What it is: How it works:
Azure Information Protection The message text and all attachments are encrypted.
provides easy-to-use email
encryption capabilities for sending Only the recipient can decipher the message for reading.
encrypted email Anyone else who tries to open the email sees indecipherable text.
Basic encryption on be default Identity verification:
The way the recipient verifies their identity depends on their
email system:
• For Office 365 users, authentication happens automatically
• Google, Yahoo, or [Link]/Hotmail users sign in with
their Google, Yahoo, or Microsoft account
• All others sign in with a one-time passcode
Send an encrypted email
Demo/Exercise
Protect your data using sensitivity labels
Customizable Manual or Automated Labels
Persists as container Apply to content or
metadata or file metadata containers
Label data at rest, data in use,
Readable by other systems
or data in transit
CO N F I D E N T I A L
Determines DLP policy based Enable protection actions
on labels based on labels
Seamless end user experience
Extensible to partner solutions
across productivity applications
Sensitivity Labels
What it is:
Azure Information Protection helps an
organization to classify protect its
documents and emails, either by
restricting the ability to forward and print,
or by applying labels.
Create a sensitivity label
Demo/Exercise
Protect and control your data and documents
Encrypt Apply restrictions Protect against Archive
email to email and data leaks email data
documents
Protect against accidental data leaks
The problem:
It is difficult and unrealistic to expect employees to
manually check every email or document shared for
sensitive information before sharing files outside the
company.
The solution:
Enable Data Loss Prevention (DLP) policies to automatically
identify sensitive information and inform users before
sharing this data externally.
Data Loss Prevention
DLP Policy Templates:
DLP comes with templates to save you the work of building a
new set of rules from scratch.
You can modify these requirements to fine tune the rule to
meet your organization's specific requirements.
Examples of DLP policy templates:
• HIPAA data
• PCI-DSS data
• Gramm-Leach-Bliley Act data
• Locale-specific personally identifiable information
Create a DLP policy
Experience DLP by sending sensitive email
Demo/Exercise
Long-term preservation of email
The problem:
After an employee leaves, you may need to access to
emails they sent or received.
Or, your company may have a policy of retaining email for a
period of time, such as 7 years, to meet regulatory
requirements
The solution:
Utilize the capabilities of Exchange Online Archiving to
archive and preserve email and other relevant information.
Archiving
(In-place hold)
How it works:
You can use In-Place Hold to accomplish the following
What it is: goals:
In-Place Hold and Litigation Hold, • Enable users to be placed on hold and preserve mailbox
part of Exchange Online Archiving, items immutably
can help companies preserve • Preserve mailbox items deleted by users or automatic
electronically stored information deletion processes
that could be relevant to a pending
• Protect mailbox items from tampering, changes by a user,
or current legal case. or automatic processes
• Preserve items indefinitely or for a specific duration
Additionally, you can:
• Preserve the entire mailbox of an employee who leaves or
is terminated
• Use In-Place eDiscovery to search mailbox items, including
items placed on hold
Endpoint Proteciton
Protect your PCs against advanced
malware with Windows Defender
The problem:
Bad actors can avoid traditional AV by executing
ransomware attacks without ever needing to write
anything to the disk.
These fileless attacks, which compose over 50% of all
threats, are extremely dangerous and constantly
changing.
The solution:
Windows Defender Exploit Guard helps protect
users against advanced forms of ransomware.
Microsoft Defender consistently rated top AV
AV-TEST: Protection score of 6.0/6.0 in
1 the latest test
AV-Comparatives: Protection rating of
2 99.9% in the latest test
3 SE Labs: AAA award in the latest test
[Link]
Explore Mobile App Management
for iOS and Android
Enforce Windows updates and
endpoint protection
Demo/Exercise
Bringing it all together:
Resources that can help
Practical security resources
Microsoft Secure Score
[Link]
Secure Remote Work Kit
Guide & Checklist
IT ProMentor CIS based Security Assessment tool
[Link]
CIS Controls v7.1
[Link]
NIST CSF
[Link]
Security frameworks
Pop quiz
01
On the journey to the cloud, if
a customer is running classic
ERP on AnyDB, does (s)he need
to upgrade to S/4 to take
advantage of HANA?
YES NO
Pop quiz
02
When designing
infrastructure for SAP or
Azure, where should we
focus first?
Azure
Storage
regions and VM sizing
accounts
network
Pop quiz
03
If deploying TST in the DR
region to optimize cost,
what other benefit can that
bring?
Ensuring
Ease of Faster DR
resource capacity
operations failover
at DR events
Pop quiz
04
We discussed a number of
valuable consideration points
for large migrations. Which one
stuck in your mind the most?
Setup
Review SAP
support Flight plan Others
notes
agreement
Resources
All content that is linked through out this document can be found at these sites.
Microsoft 365 Business Partner Page ([Link]
The one stop show for all product content related to Microsoft 365 Business, including product pitch material,
licensing and deployment kits.
Microsoft SMB Tech Community ([Link]/smbtc):
Forum for technical discussion & questions. The place for the experts.
Microsoft 365 Business Service Description ( [Link]/M365BSD):
The place to answer all your questions on the product and what is included from a licensing perspective.
Microsoft 365 SMB Plays ([Link]/mwsmb):
The place to get deep dive information on core SMB partner opportunities including partner playbooks,
customer marketing material & tele sales scripts.
Commercial Consulting Tool ([Link]
This tool empowers sellers to comprehensively assess complex customer scenarios, help customers discover the
benefits of the Microsoft's modern workplace solutions, and provide customer-friendly recommendations that
increase sales and customer success.
Thank you.
End of Module 3 - Technical Fundamentals
Security
© Copyright Microsoft Corporation. All rights reserved.
