Many companies are allowing staff to work from home and remote indefinitely, raising questions about how they can protect work data on personal or uncontrolled devices.

As IT experts for working remote Gold Coast IT Support offer the following information to help.

Because we can lose company data in a variety of ways across different devices, we need to apply a variety of protection measures. Let’s take a look at the features in Microsoft 365 that can allow companies to protect their data while users are working remotely.

Use Mobile Application Management

Despite the name, mobile application management doesn’t just apply to mobile devices, it can also protect Windows 10 devices. Mobile Application Management policies can protect company data on both managed and unmanaged devices.

It works by applying protections to the apps your teams use to access company data, like Outlook, Teams, OneDrive and SharePoint.

You can enforce restrictions on these apps to prevent data being saved, cut, copied or pasted.

Mobile Application Management Prevent Copy Paste

You can also require a PIN when the app starts or block the app from running on a jailbroken phone or tablet.

Mobile Application Management Pin Code

This feature can be used to selectively wipe company data from a users device, without affecting their personal files. This is handy for organisations where staff use their personal computers and mobile devices to access company information remotely.

Mobile Application Management Wipe Device

Set up conditional access policies

We can use Conditional Access to enforce restrictions on non-compliant or unmanaged devices. Such as blocking access entirely, or preventing particular actions like stopping users from saving attachments in Outlook on the web or syncing files to OneDrive

We can apply these protections in other ways to apps like OneDrive and SharePoint. Preventing users from syncing data to their personal devices by either blocking access or only allowing limited web only access

SharePoint Prevent Access From Unmanaged Device

Expert IT advice for working remotely

Use Cloud App Security to protect data on third-party apps

These protections don’t just relate to Microsoft 365 apps like OneDrive, SharePoint and Outlook; we can use Microsoft Cloud App Security to apply additional protections to apps like Dropbox Business too. Applying protection to a third-party app like Dropbox Business can prevent users from downloading your company data to unmanaged devices.

Control Dropbox Access Unmanaged Device

Apps like Dropbox Business also provide their own security measures, allowing you to block access and wipe company data when a device next comes online.Wipe Dropbox Device Remotely

Configure idle session time outs

To lessen the likelihood of the wrong people accessing company information on a shared device, we can configure idle session time outs. These will sign users out after a period of inactivity, just like your bank does.

Enable SharePoint Idle Session Timeout

Get alerts on suspicious activities

Cloud App Security includes built-in alerts that trigger on potentially suspicious activities. We can use these to get notified about things like mass deletions, mass downloads and unusual volumes of external sharing

Enable Cloud App Security Alerts

Protect sensitive data with Data Loss Prevention

We can use data loss prevention to restrict or impose conditions on the sharing of sensitive information. These policies can trigger on certain keywords like project names or sensitive information types like credit card numbers, driver’s license details or tax file information. Once a file containing this info is detected, it can display a warning, be blocked from being sent or have encryption applied.

Use Data Loss Prevention

Using Cloud App Security, we can apply additional data loss prevention measures to third party apps like Box and Dropbox Business

Use Sensitivity Labels

But what happens if this all fails, and someone downloads company data to a personal, unmanaged device. To protect against this, we can apply sensitivity labels. These labels define how sensitive a particular piece of content is and in turn can enforce protections on our data. What’s more, these protections apply no matter where it ends up. These baked-in protections can limit who can access the file and what they can do with it. Preventing the wrong people from opening, copying, saving, forwarding or printing sensitive documents or emails.

Protect Data With Sensitivity Labels

In many cases, these protections can be applied automatically by scanning for those same keywords and sensitive information types that data loss prevention uses.

Automatically Classify Content With Sensitivity Labels

As you can probably tell by now, there’s a lot you can do to protect your sensitive data when people are working from home. If you need help with any of this, reach out to us below.

  • This field is for validation purposes and should be left unchanged.

 

Org-Wide Teams in Microsoft Teams let you create a single Microsoft Team that includes all internal users in your organisation. However, Microsoft recommends that you make some changes to the team’s settings to cut down on excess noise and notifications.

What is an Org-Wide Microsoft Team?

An Org-Wide team in Microsoft Teams is just a team that includes everybody in your organisation. Its member list will automatically update as users come and go, and while it currently supports up to 1000 users, there are plans to increase this limit.

How do you create an Org-Wide Microsoft Team?

Creating an org-wide team is quite simple, just choose the Org-Wide team option from the drop-down when creating a new team at https://teams.microsoft.com

Create An Org Wide Microsoft Team

What are some best practices for Org-Wide Microsoft Teams?

If you have a lot of users in your organisation, these types of teams could quickly become very noisy and distracting.

To reduce excess notifications and noise, Microsoft have some best practice recommendations.

Only let team owners post on the General channel

  1. You do this under Manage teamManaging A Microsoft Team
  2. Click Settings, then Member permissions, then select Only owners can post messages.Microsoft Teams Only Owners Can Post In Org Wide Teams General Channel

Disable @mentions for the whole team

You’ll probably want to disable @mentions for the whole team, since that can send a notification to up to a thousand people at once.

  1. You can do this do this under Settings, @mentions, Show members the option to @team or @[team name].

Dont Allow @Mentions In Org Wide Microsoft Teams

 

Automatically favorite important channels

Switch to the channels tab and tick Auto-favorite on the channels you would like to show up by default.

Auto-favourite Microsoft Teams Channels

Also note that while the video above states that the feature is still in development, it has since been marked as launched.

 

Connect Azure Functions To Office 365

In the past couple of weeks I’ve uploaded a few scripts to help manage Office 365 customer environments in bulk via delegated administration. These scripts work well for us, though they only work when they’re initiated by a delegated administrator here. Sure, we could set them up on a server as a scheduled task, though in the interest of keeping things in the cloud, we’re moving them to Azure Functions.

If you’re interested, the scripts I’ve posted so far regarding Delegated Administration are here:

What are Azure Functions?

The Azure Functions service is Microsoft’s Function as a Service offering (FaaS). It’s similar to Hook.io, Google Cloud Functions or AWS Lambda if you’ve used any of those. Basically it lets you run standalone scripts or functions of a program in the cloud. One of Azure Functions’ benefits is that you don’t have to look after the underlying infrastructure, you can just add in your code and you’re pretty much done. You can start an Azure function using a HTTP or Azure Storage Queue trigger, or just set it to run on a timer. Azure Functions can run a variety of languages, though in this scenario, we’ll convert a simple Office 365 PowerShell script into a timer trigger function that runs each weekday.

Consumption Plan vs App Service Plan

Azure Functions Consumption Plan vs App Service PlanFor the number of functions we’ll be running, Azure functions are pretty much free with a Consumption Plan. This plan gives you a grant of 1 million executions and 400,000 GB-s of bandwidth, which we’ll be well under. However, Azure functions can also run on top of a paid Azure App Service Plan – which we’ll be taking advantage of.

Why pay for an Azure App Service Plan to run Azure Functions?

One of the limitations of the (almost) free version of Azure Functions is that it’s executions have a 5 minute limit, after which time they are terminated automatically. Apparently this is because the underlying virtual machines that run the functions are regularly recycled. Since some of our scripts have the potential to run longer than five minutes, we need to provision a small Azure App Service resource and then run our Azure functions on top of this. The VM that runs our App service runs continuously and will support long running functions

Here’s what we want to achieve:

  1. Set up an Azure Function App running on an App Service Plan
  2. Connect an Azure Function to Office 365
  3. Modify an existing PowerShell script to run on an Azure function

In another post we’ll look at connecting Azure Functions to Azure Storage to use in reporting via Power BI, and triggers for Microsoft Flow.

How to set up a new Azure Function App

  1. Log on to https://portal.azure.com using an account with an active Azure subscription.
  2. Click the Green + button on the left menu, search for Functions, then click Function AppSearch For Azure Functions And Click Create
  3. Click Create on the bottom right
  4. Complete the required fields for the Function AppComplete Fields To Create Azure Function App
  5. Choose to create a new Resource Group and Storage Account. For the Hosting Plan option, choose App Service Plan, then select an existing subscription or create a new one. In my case, I chose an S1 Plan, which is probably overkill. You’ll be able to get by with something much smaller.Create A New App Service Plan For Azure Functions
  6. Once you’ve completed the required fields, click Create and wait for it to complete deploymentWait For Azure Function App To Complete Deployment
  7. After it’s finished deploying, open your function app and click the + button to create a new function.Create A New Function Within Azure Functions
  8. Choose Custom function at the bottomChoose To Create A New Custom Function
  9. On the dropdown on the right, choose PowerShellSelect PowerShell From Azure Functions Drop Down
  10. Choose TimerTigger-PowerShell and enter a name for your Azure Function.Create Timer Trigger PowerShell Azure Function
  11. For the Schedule, enter a cron expression. There used to be documentation at the bottom of the page on how to format these, though at the time of writing it hasn’t appeared. For a function that runs Monday to Friday at 9:30 AM GMT time, enter the following:
    0 30 9 * * 1-5

    Define Schedule For Azure Function

  12. Click Create, you’ll be greeted with an almost blank screen where you can start to enter your PowerShell script. Before we do this, we’ll set up the Azure function to connect to Office 365, and secure your credentials within the function app.

Set up your Azure Function to connect to Office 365

In this step, we’ll be doing the following:

Define and retrieve your FTP Details

The FTP Details of the Azure Function are needed to upload resources that the Azure Function requires to connect to Office 365.

Download, then upload the MSOnline PowerShell Module via FTP

Azure Functions have a lot of PowerShell Modules installed by default, though they don’t have the MSOnline module that lets us connect to Office 365. We’ll need to download the module on our local computer, then upload it into the Azure function. This method was borrowed from this article by Alexandre Verkinderen.

Secure your Office 365 Credentials within the Function App

Right now, Azure Functions don’t integrate with the Azure Key Vault service. While we can store credentials within the function, these credentials are stored in plain text where anyone with access to the function can view them. This method was borrowed from this article by Tao Yang.

How to define and retrieve the FTP credentials for your Azure function app

  1. Click on the name of your function on the left menu.Click Azure Function Settings To Retrieve FTP Details
  2. Click Platform Features at the top, then click Deployment CredentialsOpen Platform Features
  3. Define a username and password for your FTP CredentialsSet Deployment Credentials For FTP Access
  4. Next under General Settings, click Properties.Open Properties Under General Settings
  5. Copy the FTP Host Name and make a note of it. You’ll need it to connect to the function’s storage via FTP and upload the MSOnline ModuleCopy FTP Host Name And User Details For FTP Deployment

Download, then upload the MSOnline PowerShell Module via FTP

  1. Open PowerShell on your computer, then run the following command. Make sure there’s a folder called ‘temp’ in your C:\ drive.
    Save-Module msonline -Repository PSGallery -Path "C:\temp"

    Save MSOnline Module For Office365 PowerShell On Local PC

  2. Wait for it to download, then make sure it exists within C:\tempWait For MSOnline Module To Download
  3. Open Windows Explorer, and connect to your function via FTP using the FTP Hostname and credentials we retrieved earlier.Connect To Your Azure App Service Via FTP Credentials
  4. Navigate to site/wwwroot/YourFunctionName then create a new folder called binCreate Bin Directory Under Azure Function
  5. Open the bin directory, and upload the MSOnline folder from your C:\Temp DirectoryUpload MSOnline PowerShell Module To Bin Directory In Azure Function

Secure your Office 365 Credentials within the Azure Function App

  1. On your computer, open PowerShell again and run the following commands. When you’re asked for your password, enter the password for the delegated admin account that you’ll use to manage your customers Office 365 environments. Make sure you press Enter again to run the final command to output the EncryptedPassword.txt file.
    $AESKey = New-Object Byte[] 32
     $Path = "C:\Temp\PassEncryptKey.key"
     $EncryptedPasswordPath = "C:\Temp\EncryptedPassword.txt"
     [Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($AESKey)
     Set-Content $Path $AESKey
     $Password = Read-Host "Please enter the password"
     $secPw = ConvertTo-SecureString -AsPlainText $Password -Force
     $AESKey = Get-content $Path
     $Encryptedpassword = $secPw | ConvertFrom-SecureString -Key $AESKey
     $Encryptedpassword | Out-File -filepath $EncryptedPasswordPath

    Run PowerShell Script To Secure Password
    This will create two files on in your C:\temp folder. An EncryptedPassword text file and a PassEncryptKey file. Be sure to delete the EncryptedPassword file once we’re done.Locate Secure Password And Key In Temp Folder

  2. Return to the FTP connection and create a directory called keys under the bin directory
  3. Upload the PassEncryptKey file into the keys directory.Upload PassEncryptKey To Azure Function Via FTP
  4. Return to your Azure Function Platform Settings, then open Application Settings.
  5. Under Application Settings, create two new Key-Value pairs. One called user, which contains the username of your delegated admin account, and another called password, which contains the contents of your EncryptedPassword.txt file. Once you’ve added this, be sure to delete the EncryptedPassword.txt file from your computer.
  6. Before you leave Application settings, update the Platform from 32 bit to 64 bit.Update Azure Function Platform To 64 Bit
  7. Wait for the settings to apply, then return to the Develop Section of your Azure FunctionWait For Azure Function Web App Settings To Apply

Modify your Office 365 PowerShell script for Azure Functions

  1. Update the variables at the top of the script to ensure they match the function name, Module Name and Module Version.For your existing scripts, you may need to update your Write-Host references to Write-Output.This sample script is a modified version of this one. It will set the default password expiration policy for all of your customers’ domains to never expire.You can use this one or create your own script under the # Start Script comment
    Write-Output "PowerShell Timer trigger function executed at:$(get-date)";
    
    $FunctionName = 'SetPasswordExpirationPolicy'
    $ModuleName = 'MSOnline'
    $ModuleVersion = '1.1.166.0'
    $username = $Env:user
    $pw = $Env:password
    #import PS module
    $PSModulePath = "D:\home\site\wwwroot\$FunctionName\bin\$ModuleName\$ModuleVersion\$ModuleName.psd1"
    $res = "D:\home\site\wwwroot\$FunctionName\bin"
    
    Import-module $PSModulePath
    
    # Build Credentials
    $keypath = "D:\home\site\wwwroot\$FunctionName\bin\keys\PassEncryptKey.key"
    $secpassword = $pw | ConvertTo-SecureString -Key (Get-Content $keypath)
    $credential = New-Object System.Management.Automation.PSCredential ($username, $secpassword)
    
    # Connect to MSOnline
    
    Connect-MsolService -Credential $credential
    
    # Start Script
    
    $Customers = Get-MsolPartnerContract -All
    $PartnerInfo = Get-MsolCompanyInformation
    
    Write-Output "Found $($Customers.Count) customers for $($PartnerInfo.DisplayName)"
    
    
    foreach ($Customer in $Customers) { 
    
    	Write-Output "-----------------------------------------------"
    	Write-Output " "
    	Write-Output "Checking the Password Expiration Policy on each domain for $($Customer.Name)"
    	Write-Output " "
    
    	$domains = Get-MsolDomain -TenantId $Customer.TenantId | Where-Object {$_.Status -eq "Verified"}
    
    	foreach($domain in $domains){
     
    		$domainStatus = Get-MsolPasswordPolicy -TenantId $Customer.TenantId -DomainName $domain.Name
    
    		if($domainStatus.ValidityPeriod -eq 2147483647){
    
    			Write-Output "Password Expiration Policy is set for $($domain.name) already"
    
    			$PasswordsWillExpire = $false
    
    			$MsolPasswordPolicyInfo = @{
    
    				TenantId = $Customer.TenantId
    				CompanyName = $Customer.Name
    				DomainName = $domain.Name
    				ValidityPeriod = $domainStatus.ValidityPeriod
    				NotificationDays = $domainStatus.NotificationDays
    				PasswordsWillExpire = $PasswordsWillExpire
    			}
    
    		}
    
    
    
    		if($domainStatus.ValidityPeriod -ne 2147483647){
    
    			Write-Output "Setting the Password Expiration Policy on $($domain.Name) for $($Customer.Name):"
    			Write-Output " "
    
    			Set-MsolPasswordPolicy -TenantId $Customer.TenantId -DomainName $domain.Name -ValidityPeriod 2147483647 -NotificationDays 30
    
    			$PasswordPolicyResult = Get-MsolPasswordPolicy -TenantId $Customer.TenantId -DomainName $domain.Name
    
    			if($PasswordPolicyResult.ValidityPeriod -eq 2147483647){
    
    				$PasswordsWillExpire = $false
    				Write-Output "Password policy change confirmed working"
    			}
    
    			if($PasswordPolicyResult.ValidityPeriod -ne 2147483647){
    
    				$PasswordsWillExpire = $true
    				Write-Output "Password policy change not confirmed yet, you may need to run this again."
    			}
    
    			$MsolPasswordPolicyInfo = @{
    
    				TenantId = $Customer.TenantId
    				CompanyName = $Customer.Name
    				DomainName = $domain.Name
    				ValidityPeriod = $PasswordPolicyResult.ValidityPeriod
    				NotificationDays = $PasswordPolicyResult.NotificationDays
    				PasswordsWillExpire = $PasswordsWillExpire
    
    			}
    
    		}
    	}
    }
    
  2. Click Run to manually start the script. You should see following output under LogsAzure Functions Output Log

What Is Microsoft 365 Business Premium

On April 21, 2020, Microsoft rebranded it’s small and medium business Office 365 products to Microsoft 365. This resulted in a name change for the popular Microsoft 365 Business product as well, which is now called Microsoft 365 Business Premium. GCITS provide Office 365 Support on the Gold Coast and Brisbane.

Note that the pricing and makeup of the plans haven’t changed, just the names.
Previously calledNow calledWhat it has
Office 365 Business EssentialsMicrosoft 365 Business BasicCloud Services
Office 365 Business PremiumMicrosoft 365 Business StandardCloud services and desktop apps
Microsoft 365 BusinessMicrosoft 365 Business PremiumCloud services, desktop apps and advanced security

We’ve been advocates of Microsoft 365 Business Premium for a while now. We believe it’s the best value Microsoft 365 product around for businesses with under 300 users. As providers of Micorsoft 365 support here on the Gold Coast and Brisbane, we can assist you in the easy management of this terrific resource.

Want to know how to protect your data in Microsoft 365 Business Premium? Download our free guide to learn what features to switch on.

 

So why do we think you should go with Microsoft 365 Business Premium over Basic or Standard?

For us, it comes down to the Microsoft 365 Business Premium’s advanced security and compliance features.

Security and Compliance features of Microsoft 365 Business Premium

Microsoft 365 Business Premium includes advanced security features that are not present in the lower tier plans. These include:

Malware and Phishing protection with Office 365 Advanced Threat Protection

Microsoft 365 Safe Links and Safe Attachment policies protect against known and zero-day malware. Anti-Phishing policies protect users against phishing attacks using mailbox intelligence and machine-learning enhanced sender reputation checks.

Enhanced security for identities with Conditional Access

Conditional Access policies help balance security and productivity by applying the right security measures at the right time. For instance, if Microsoft 365 detects a risky sign-in from an unexpected location or non-compliant device, it can prompt for multi-factor authentication or block access to the user.

Enforce encryption on devices using Microsoft Intune

We can use Microsoft Intune to protect data on devices in the event of loss or theft. Microsoft Intune can configure Windows BitLocker, Apple’s File Vault, and encryption settings on Android and iOS devices.

Classify and protect confidential information with Azure Information Protection

Azure information protection helps companies use sensitivity labels and policies to classify and protect data. Built-in labels include Personal, Public, General, Confidential and Highly Confidential.

Depending on what label is applied, a policy can be used to protect it. These policies can enforce encryption, apply watermarks, prevent it from leaving your organisation and more.

Control company data on PCs with Windows Information protection

Many people use the same computer for both work and personal tasks. Windows Information protection tags files as ‘Work’ if they are generated by, or saved from, a corporate app. Files tagged as ‘Work’ are subject to the controls defined in your Information Protection policies. These files can:

  • be encrypted
  • prevented from being uploaded or shared via unmanaged apps
  • remotely wiped without affecting personal data.

Control access to sensitive emails with Information Rights Management

Information Rights Management allows your team to apply restrictions like “Do Not Copy” for specific documents and emails. When a recipient receives the email or document, they’ll be unable to forward, save, print or copy it.

Prevent sharing of sensitive info with Data Loss Prevention

Data Loss Prevention policies monitor the types of data that are uploaded to and shared outside your company. This info could be tax file numbers, credit card information, drivers license details and many more. When sensitive information is detected, the Data Loss Prevention policy can encrypt the message, notify the sender, alert an admin or block the message from being sent or file uploaded.

Remotely wipe company data and enforce security on devices with Microsoft Intune

Microsoft Intune lets us enforce security requirements on the devices that access company data. These could include requiring a strong password and encryption on phones and only allowing access via company-approved apps. When employees leave the company, Microsoft 365 can remotely wipe company data from the device without affecting personal info.

Unlimited archive for email

Microsoft 365 Business Premium provides practically unlimited storage for your email. Alongside the standard 50GB mailbox, users can access an unlimited archive of their email in Outlook.

Office 365 Support Gold Coast and Brisbane

Our expert assessment will have you supported the right way.

Want to enable advanced security in Microsoft 365 Business Premium?

While you get all the above features with Microsoft 365 Business Premium, you still need to configure them to suit your business and requirements. You can outsource the security of your cloud environment to GCITS. Get in touch for an expert assessment, and we can ensure the ongoing state management of these essential security policies.

  • This field is for validation purposes and should be left unchanged.

Skykick automates the migration of email from other platforms onto Office 365, though occasionally it needs a bit of help.

This is especially true when moving from Google Apps or Google for Work to Office 365. These mailboxes can bloat in size due to how both systems manage email folders.

Office 365 (Microsoft Exchange) stores email in folders, while Google gives email labels. The difference is, in Exchange an email can be in only one folder, while in Google an email can have multiple labels. When migrating from Google for Work to Office 365, SkyKick will create Exchange folders for every Google label, and migrate emails that are assigned multiple labels into multiple folders.

This results in a bunch of duplication on the destination system.

When you’re using Skykick to migrate large mailboxes from Google for Work, you may occasionally receive a message advising that the mailbox may exceed the storage limits on Office 365. While this message appears, synchronisation will be paused.SkyKick May Exceed The Maximum Allowed in Office 365

In order to resume the migration for this mailbox you’ll need to do the following:

  1. Confirm you’re using the right retention policy
  2. Enable archiving on the mailbox.
  3. Ensure the archive is running.
  4. Mark the alert as completed.

What are Exchange Retention Policies?

In Exchange, each mailbox is assigned a Retention Policy that contain the retention settings for mail within the mailbox. Retention policies are made up of Retention Policy Tags.

Retention Policy Tags outline how long Exchange is going to keep a user’s mail before performing a specific action on it. For Retention Policy Tags, this action can be PermanentlyDelete, DeleteAndAllowRecovery or MoveToArchive.

You can also create Retention Policy Tags that only affect a specific type of folder, for example DeletedItems or JunkEmail. For a full list of options, see this Technet Article: https://technet.microsoft.com/en-us/library/dd335226(v=exchg.160).aspx

Why create your own Retention Policy?

When archiving is enabled on a mailbox, the default policy is to archive anything older than two years. This may be enough to get the migration running again, but just in case it’s not, you can create a new Retention Policy Tag with a shorter archive time limit, apply it to a new Retention Policy, then apply the policy to the user you want to archive mail for.

Alternatively, you can edit the default policy (known as Default MRM Policy) or its tags, though this will affect all users that have archiving enabled.

You can create a new Retention Policy and Retention Policy Tags via PowerShell or via the Exchange Control Panel. In Exchange Control Panel, these actions are performed under Compliance Management. In this tutorial we’ll be working in PowerShell.

Setting up a Retention Policy in PowerShell

This new Retention Policy will move any mail older than 1 year into a users archive. It will have one tag.

  1. Connect to Exchange Online via PowerShell as an Exchange Online Administrator
  2. Run the following PowerShell cmdlet
    New-RetentionPolicyTag "1 year move to archive" -Type All -RetentionEnabled $true -AgeLimitForRetention 365 -RetentionAction MoveToArchive

    Create New Retention Tag

  3. Create the new Retention Policy and link the tags
    New-RetentionPolicy "One Tag Policy" -RetentionPolicyTagLinks "1 year move to archive"

    Create New Retention Policy

  4. Assign a retention policy to a user
    Set-Mailbox -Identity UserAliasOrEmail -RetentionPolicy "One Tag Policy"

    Apply Policy To The User

  5. Confirm the Retention Policy was applied correctly by running:
    Get-Mailbox -Identity UserAliasOrEmail | ft Name,RetentionPolicy

    Confirm Policy Is Applied

Enable Archiving on a mailbox.

Once you’ve assigned the policy, you can enable archiving on the user’s mailbox. This can be done in the Exchange Control Panel under Recipients, Mailboxes on the right menu.

  1. In Powershell, you can run the following cmdlet while connected to Exchange Online.
    Enable-Mailbox -Identity UserAliasOrEmail -Archive

Ensure the Archive is running.

  1. The Archive won’t run immediately, though you can force it along. You can check the size of the archive using the Get-MailboxStatistics cmdlet.
    Get-MailboxStatistics -identity UserAliasOrEmail -Archive
  2. The default cmdlet return is to display the Name, ItemCount, StorageLimitStatus and LastLogonTime of the mailbox. To see more info, append ‘| fl *‘ (minus the quotations) to the cmdlet.
    Get-MailboxStatistics -identity UserAliasOrEmail -Archive | fl *
  3. Your archive will probably be empty right now. To start the archive, run the following cmdlet.
    Start-ManagedFolderAssistant UserAliasOrEmail

    Force Archive To Run Using StartManaged Folder Assistant

  4. Now, if you run the Get-MailboxStatistics cmdlet a few times more, you’ll see the ItemCount increasing. Providing of course, that there’s email older than a year in the mailbox.Confirm Archive Is Running
  5. You can also append ‘| fl *‘ to the end of the cmdlet to get the available statistics for the user’s mailbox too. Try it a few times and watch it reduce as items are archived.
    Get-MailboxStatistics -Identity UserAliasOrEmail | fl *

    Get All Mailbox Statistics

    Get-MailboxStatistics -Identity UserAliasOrEmail -archive | fl *

    Archive Size

Mark the alert as complete

Once your archive has begun processing, you can return to SkyKick and mark the alert as complete. The migration for the mailbox will kick off again.

What are phishing emails?

Phishing emails are fake messages, designed to look legitimate.

They cost businesses around the world billions of dollars each year. And they get opened by about 30% of people. These emails will generally impersonate a person or company that you trust or deal with, and attempt to trick you using one of three things:

They’ll use a fake person – someone pretending to be someone you know, so that you share information or transfer money into an attacker’s bank account.

They’ll set up a fake site – So that you enter your private information, like passwords or credit card details, or provide a rogue app with permission to access your data.

They’ll create fake attachments – attackers will disguise malware in fake invoices and shipping notification to remotely access your computer or encrypt your files.

How can I prevent phishing emails with Microsoft 365?

To give our teams the best chance of avoiding phishing emails, not only do we need to make people aware of the methods above, we need to configure the features in Microsoft 365 that address them. Starting with Office 365 Advanced Threat Protection

Start with Office 365 Advanced Threat Protection

This is your companies primary defence against phishing emails. While all Office 365 plans come with a built-in anti-phish policy, it’s not even close to what’s offered in Office 365 Advanced Threat Protection, also known as Office 365 ATP.

Once you’ve purchased Office 365 ATP, you should jump into the Security and Compliance centre and check out your anti-phishing policy.

Detect User Impersonation Phishing Emails in Microsoft 365

Its default controls are pretty good for detecting phishing emails that impersonate your users, your domains and external contacts. It develops an understanding of how your users and their contacts interact, the addresses and sending infrastructure they use, and identifies anything out of the ordinary. If it detects an impersonation attempt, the message is either quarantined or delivered with a warning.

You can enhance your protection by adding users in roles like CEO or CFO to the targeted user protection feature. You can also add external domains, that you frequently interact with, to the targeted domains feature.

Protect CEO And CFO From Phishing Emails

 

Use a mail transport rule to warn on external impersonation

You can configure a mail rule that applies a warning to messages where an external sender uses a display name that matches someone internally in your company. We have an example rule on our website that has been pretty popular amongst smaller organisations.

Warn On External User Impersonation For Phishing

So that helps address fake senders, how about fake attachments and fake websites? Office 365 ATP addresses these with the Safe Attachments and Safe Links policies.

Detect malicious attachments with Safe Attachments policy

The safe attachments policy can protect your users from malware sent by phishing emails, like the COVID-19 phishing campaign that used Excel files to install a malicious remote access tool. The Safe Attachments feature analyses your attachments in a separate environment, running a bunch of checks for malware then blocking the email or removing the unsafe attachment.

Block Malware With Safe Attachments in Office 365 ATP

 

Detect malicious websites with a Safe Links Policy

The Safe links policy scans your URLs in emails for links to malicious sites. If a malicious website is detected, Safe Links blocks users from visiting it.

Block Malicious Site With Safe Links In Office 365 ATP

 

Remove phishing emails from mailboxes after delivery

These tools work by analysing messages for known malware, bad links or untrusted senders and stopping them arriving. But what happens if a bad email gets through, and the system doesn’t realise until later?

You should configure Zero Hour Auto Purge. Zero Hour Auto purge removes bad messages from your mailboxes retroactively and sends them junk, quarantine or deleted items.

Remove Phishing Emails From Mailboxes With Zero Hour Auto Purge

 

Set up Office 365 ATP and Exchange Online Protection with recommended best practices

I’ve just discussed four different security policies in a few minutes. If you’ve spent any time looking at ATP or Exchange Online Protection policies, you’ll probably notice there’s a lot of policies, and most of them are already set up. Should you change anything or leave them as they are?

It would help if you changed them, and Microsoft has two levels of recommended best practices that they say will prevent most unwanted messages from reaching your team.

Configure Best Practices For Phishing In EOP and ATP

These two levels are called Strict and Standard. In our experience, Strict is very strict, but it’s a good starting point that you can enable first, and adjust later.

Test users by simulating a phishing campaign

Once your policies are set up, you should test your users. If you purchase Office 365 ATP Plan 2, you can run attack simulations against your team. Attack Simulations can help you identify and find vulnerable users before a real attack impacts them.

Simulate Phishing Attack With Office 365 ATP

 

Protect your accounts if your team gives up their credentials

But what happens when messages get through? What happens when users get duped and provide their login details to attackers?

Protect your accounts. If a user enters their credentials into a fake website, we need to make sure an attacker can’t use these credentials alone to log in. All Office and Microsoft 365 plans allow you to configure multi-factor authentication; this will ensure that attackers can’t log in without having access to an additional form of verification such as a phone or authentication token.

Set Up Multi Factor Authentication

If you have a plan that includes Azure Identity Protection, you should set up a sign-in risk policy to monitor for unusual logins. These policies use machine learning to detect suspicious activity and can temporarily block sign-ins and accounts if something’s amiss.

Configure Sign In Risk Policy In Azure Identity Protection

 

Monitor for unusual applications with access to your users’ data.

Now that accounts are getting more secure by default, attackers are requesting access to user data via apps. And it’s worse if they manage to trick an admin user because then attackers can have longstanding access to an entire organisation that persists even when passwords are changed.

Detect Phishing Attacks Via OAuth Apps Microsoft Cloud App Security

It can be challenging to detect if a user clicks a phishing link and provides a rogue app with access to their mailbox, OneDrive or SharePoint data. So you use Microsoft Cloud App Security to get alerted to unusual oAuth applications with access to your teams’ information.

Ban Uncommon Apps Via Microsoft Cloud App Security

 

Be extra vigilant if your data has been exposed in the past

Take extra care if you, or companies you regularly interact with, have been breached before. If attackers have had access to your company data and know who usually communicates with who, and for what purposes, they will try to exploit that information by setting up fake emails to hold their fake conversations with their fake invoices to get your real money.

Need help with phishing in Office 365 or Microsoft 365?

If you need assistance setting-up these policies in your organisation or need a hand cleaning up after a successful phishing attack in Microsoft 365, we’d be happy to help. Reach out to us via chat, or using the form below.

  • This field is for validation purposes and should be left unchanged.

Dropbox Vs OneDrive and SharePoint

Now more than ever, being able to work remotely is of critical importance. Ensuring that employees have the right tools to work from home or in isolation, is a real concern for business owners.

Why do we recommend Dropbox Business instead of OneDrive and SharePoint?

This is a question we’re asked occasionally and it’s something we’ve given a lot of consideration. Why do we deploy Dropbox Business for our customers? We’re a Microsoft Gold Partner, it’d make sense for us to go with OneDrive and SharePoint, right?

Ultimately it comes down to reliability and user experience. We can still roll out and secure Dropbox Business using Microsoft identities and security tools while providing a simple, reliable experience to our customers.

Here’s an overview of why we deploy Dropbox Business over OneDrive & SharePoint:

Download the full article here

  • This field is for validation purposes and should be left unchanged.

Reliability

Generally speaking, the Dropbox client just works.

This is extremely important to us. A Dropbox keynote speaker once commented: “Dropbox doesn’t just keep files in sync, it keeps teams in sync.” It’s marketing talk, but it makes sense.

When the tool that keeps your team in sync doesn’t work reliably, not only can you lose trust in it, but you can lose trust in your team. You’ll never know if the reason the files aren’t there is because the syncing isn’t working, or because your team members haven’t done their job. And when it does come back online, are all the changes and files there? Are there conflicts? How will we know without checking each affected device and team member? It may seem trivial, but in our experience, the emotional impact of an unreliable sync client is a very real thing.

Ease of Use

Dropbox eases the digital transformation curve for users who are familiar with working via Windows Explorer or Mac Finder. Users can take advantage of the improved mobility, security and external collaboration features at their own pace.

The New Dropbox Desktop App is good

The new Dropbox Desktop App actually works quite well. It has a familiar file explorer/finder layout with additional enhancements that make it easier for employees to collaborate and comment on files and turn folders into productive workspaces called Dropbox Spaces.

Dropbox Business Desktop App

Single Sign-on is simple to use

Single Sign-on allows users to use their Office 365 account to log into multiple services. If a user is signed into their computer with Office 365, they can sign into the Dropbox App or website without needing to re-enter their credentials. Granted, this is also the case for OneDrive and SharePoint, but we are often asked about how seamless Dropbox’s integration is.

Simple sharing

Dropbox has an easy sharing interface, in the browser, on the desktop and using mobile apps.

  • On the desktop, users can right-click on folders, click Share and send off an invitation to collaborate on the file or folder.
  • In the browser, users can mouse over a file or folder, click Share and do the same.
  • In mobile apps, users can tap the menu icon under each file or folder to share with anyone.

Office 365 and GSuite support

Dropbox supports both Microsoft’s Office Online and Google GSuite web apps to allow for the creation and editing of documents from anywhere. Users who work on files via the browser in Office 365 or GSuite will see little difference when switching to Dropbox Business.

Edit In Office 365 and GSuite

Microsoft Cloud App Security

Microsoft Cloud App Security provides an additional level of alerting and data protection policy over Dropbox Business. This is especially handy for detecting malicious insider activity such as mass deletes and downloads. Using Cloud App Security we can guard against scenarios where employees accidentally or intentionally delete or download company data.

Built-in security policies

The built-in security policies are also quite good for Dropbox Business. Unlike the basic Office 365 plans, Dropbox actually notifies you if someone accesses your account from a new browser, or connects a new device to your account.

Dropbox Business New Sign In Notification

It’s also very simple to lock down sharing as required for certain files and folders. It’s easy to ensure that certain files and folders cannot be shared outside the company, or shared with anyone at all.

Dropbox Business Security Policies

Want more information? For a comprehensive White Paper on why we choose Dropbox Business, fill out the form below.

  • This field is for validation purposes and should be left unchanged.

This update will bring extra document management capabilities from SharePoint into Microsoft Teams.

The current Microsoft Teams files experience

The document storage and collaboration functionality in Microsoft Teams is built on SharePoint. Every Microsoft Team is also an Office 365 Group, and each team has a group-connected SharePoint site which stores all the files shared amongst the team.

You can already reach this site from the files tab of your Microsoft Teams channels, however the experience within Teams is a bit limited.

Microsoft Teams Open In SharePoint

An updated Document Library experience in Microsoft Teams

This update brings the full functionality of a SharePoint Document Library into Microsoft Teams. With the ability to add and manage custom columns, sort and filter files with custom views, trigger workflows and much more.

Sync files from Microsoft Teams with your PC or Mac

This is the standout feature in this update. The ability to sync files with a PC or Mac will be available from within Microsoft teams. At Ignite this year, Microsoft demonstrated the new interface during the Content Collaboration in the Modern Workplace – BRK2451 session.

This screen capture demonstrates custom columns, views and formatting, as well as the new sync button within Microsoft Teams.

The roadmap update for this feature listed a general availability date of Q3 of calendar year 2018, so it should be rolling out any minute now.

For more info on this feature, see the Content Collaboration in the Modern Workplace session from Microsoft Ignite.