Latest Event Updates

Adding users in bulk to Microsoft DLP and retention policies for Microsoft Teams

Posted on

It is possible to perform a bulk addition of users to Microsoft DLP and retention policies for Microsoft Teams with PowerShell cmdlets. It’s actually pretty simple and straight forward, as you will see below.

A few tips:

  • This uses the Exchange Online Management V2 module – install the module before importing it.  Install the EXO V2 module | Microsoft Docs
  • To install and connect to EXO, follow the top 2 commands outlined at Connect to Security & Compliance Center PowerShell using the EXO V2 module | Microsoft Docs.
  • My observation is that the cmdlets will insert new records, not overwrite them.  Test this on a sample retention policy first! I recommend adding a second test user account immediately after, so that you can experience that the users are truly added to the existing list (i.e. the list is not overwritten with just that single user).
  • Remember to first connect using the Connect-IPPSSession cmdlet.

Two example commands to get you started:


Scoping Office 365 ATP Policies

Posted on

Policies within Office 365 ATP can be applied to (or scoped) in several ways, as in the screenshot below. By far the simplest method, and most secure, is to protect the entire domain. But what if your organization doesn’t own the licensing to cover everyone in the domain? This post will walk through an example of how to setup and configure the policies to be scoped to a specific group along with a couple of the configuration best practices.

Aside from applying O365 ATP policies to all users of a domain, applying to groups requires using an Exchange Online (EXO) distribution list (DL) or Microsoft 365 group. The challenge with using either of these, as you might suspect, is that users can send/receive messages and/or collaborate in that shared DL/group. So we need to further limit and restrict the actions that users can take. My examples/process below will focus on using an M365 Group.

  1. In Azure AD > Groups, create a new Microsoft 365 group. Create this group without any members since we’ll need to make other changes and test before adding production users.

Second, we need to configure this group to limit interactions/notifications with users . Before running these commands, there are a couple notes that are of great importance.

  • The latest preview version of the EXO module needs to be used.
  • To get these commands to function, it may be necessary to update [Windows 10] with the latest package management and PowerShellGet modules in order to have the latest Install-Module cmdlets that support newer parameters such as “AllowPrerelease”.
  • After updating PowerShellGet, restart the PowerShell/ISE app.
Install-Module -Name PackageManagement -Repository PSGallery -Force
Install-Module -Name PowerShellGet -Repository PSGallery -Force
  1. Install and import the Exchange Online PowerShell v2 module (if not already done). The abbreviated version of these instructions are as follows.
Install-Module -Name ExchangeOnlineManagement -RequiredVersion 2.0.3-Preview -AllowPrerelease
Import-Module -Name ExchangeOnlineManagement
  1. Connect to Exchange Online instance (with admin user).
  1. Configure the group to be hidden in Office clients and in the GAL.
Set-UnifiedGroup -Identity "Group Name" -HiddenFromExchangeClientsEnabled:$true
  1. Disable notifications to users about being added to the group.
Set-UnifiedGroup -Identity "Group Name" -UnifiedGroupWelcomeMessageEnable:$false 

Next, the group needs to be updated to restricted to accept only messages from a specific list of users.

  1. Update group settings in Exchange Online Admin Center > Recipients > Groups.

Finally, update the M365 group to:

  1. Update group to use a dynamic membership – single user to test and confirm settings as desired.
  2. Update group to use a dynamic membership – users assigned O365 ATP licenses.
  3. Scope O365 ATP policies (Safe Links, Safe Attachments, etc.) to the new M365 group.

List guest users of Microsoft Teams

Posted on Updated on

Imagine for a moment that your organization deployed Microsoft Teams through the business so as to advance user productivity, but the organization wasn’t quite ready to address the governance, security, or potential data exfiltration of Teams. That decision to postpone security and compliance may have occurred simply due to awareness of the risk, desire or resources to plan and implement, the knowledge of the technology to use, ability to use the technology (i.e. licenses), or even the capability to reinforce the organizational stance.

Now imagine that your Teams deployment has reached thousands of users and their productivity is on the rise, which is great….but now that you have found there are also thousands of “guest” users in your Azure AD users list which have likely been invited into Teams from within your company. Even guest users from the likes of Gmail, Yahoo, and the various Microsoft consumer domains.

The risk of data exfiltration or even device and user identity security is much higher – and now you need to really truly address it. What can be done? Assuming that you had already identified that there are guest users in your organization via the Azure AD users list, then you may want to further refine which of those guest users are part of a Team within Microsoft Teams. To do that, use the following PowerShell script to grab this information. Note that this script relies upon having installed the PS module for MicrosoftTeams (Install-Module MicrosoftTeams) and also logged into Azure AD (Connect-MicrosoftTeams).

#Login to Azure AD manually

# Define log file
$OutFile = "C:\TeamsGuestUsers.txt"

# Get a collection / array of all Teams
$AllTeams = Get-Team

# Process each Team
ForEach ($Team in $AllTeams) {
# Do not process $Team if it is null
If (($Team).GroupID -ne $null) {
# Get all the Guest users of a Team
$GuestUsers = Get-TeamUser -Role Guest -GroupID ($Team).GroupID

# If no guest users exist in Team, skip logging
If ($GuestUsers -ne $null) {
# Log the Team and GroupID
Write-Output ("Team: " + ($Team).DisplayName + ", GroupID: " + ($Team).GroupID ) | Out-File $OutFile -Append
# Log each guest user in the Team
ForEach ($User in $GuestUsers) {
Write-Output (" => Guest user: " + ($User).User) | Out-File $OutFile -Append

With this information, you can next develop your plan guest access. Including for which domains to restrict or allow with Azure AD B2B controls. A good place to get started with your planning is:

Windows 10 Endpoint Security Matrix

Posted on Updated on

Microsoft has a good matrix and comparison chart of the security product features built-in with Windows 10 Professional and Enterprise.  Along with that matrix is a downloadable full comparison chart. What I really like about that full chart is that it compares Pro vs. Enterprise as a security function and capability, not just as a product name.  Recently, I was asked if I could map the capability to the product name.  As best as I could, below is the table that I created which marries those two by mapping the functionality to the product.  Minus the licensing portion (Pro vs. Enterprise E3 vs. Enterprise E5) that is.


Product feature(s)

Attack Surface Reduction controls
Integrity enforcement of operating system boot up process System Guard
Integrity enforcement of sensitive operating system components System Guard
Advanced vulnerability and zero-day exploit mitigations Exploit Guard + WDAV
Reputation based network protection for Microsoft Edge, Internet Explorer and Chrome SmartScreen
Host based firewall Firewall
Ransomware mitigations Exploit Guard + WDAV (with controlled folder access)
Hardware based isolation for Microsoft Edge Application Guard
Application control powered by the Intelligent Security Graph Application Control
Device Control (e.g.: USB) Exploit Guard (hypervisor code integrity), MDATP (additional security)
Network protection for web-based threats Exploit Guard
Enterprise management of hardware-based isolation for Microsoft Edge Application Guard enterprise controls defined for internal/external sites
Host intrusion prevention rules Exploit Guard (HIPS)
Customizable allow/deny lists (e.g.: IP/URL, Files, Certificates) Exploit Gard (network protection) using MDATP
Device-based conditional access MDATP integration with Intune device management
Centrally manageable tamper protection of operating system MDATP
Next Generation Protection
Pre-execution emulation executables and scripts WDAV
Runtime behavior monitoring WDAV
In memory anomaly and behavior monitoring WDAV + Exploit Guard
Machine learning and AI based protection from viruses and malware threats WDAV
Cloud protection for fastest responses to new/unknown webbased threats WDAV (block at first sight)
Protection from fileless based attacks WDAV + Exploit Guard
Advanced machine learning and AI based protection for apex level viruses and malware threats WDAV + MDATP
Advanced cloud protection that includes deep inspection and detonation MDATP
Emergency outbreak protection from the Intelligent Security Graph WDAV + MDATP
Monitoring, analytics and reporting for Next Generation Protection capabilities WDAV + MDATP
Endpoint Detection and Response
Behavioral-based detection for advanced and targeted attacks (post-breach) MDATP
Centralized security operations management with Windows Defender Security Center MDATP
Rich investigation tools MDATP
Forensic collection MDATP
Response actions MDATP
Advanced detonation service with deep file analysis MDATP
Upload of Indicators of Compromise (IOC) for custom alerts MDATP
Flexible hunting queries over historical data MDATP
Custom alerts via powerful advanced hunting queries MDATP
Discover and report SaaS app usage to MCAS MDATP
Machine risk level to trigger conditional access MDATP
Monitoring, analytics and reporting MDATP
Automatic Investigation and Remediation
Automated alert investigations using Artificial Intelligence MDATP
Automated remediation of advanced threats MDATP
Monitoring, analytics and reporting MDATP
Security Score
Assess and improve your organization security posture using Microsoft Secure Score for Windows MDATP
Threat Analytics shows your organizations exposure to threats MDATP
Security Management
Monitoring, analytics and reporting MDATP
Rich Power BI dashboards and reports MDATP
Enterprise-grade Extensibility and Compliance
Integrated endpoint protection for 3rd party platforms (macOS,Linux, iOS, Android) MDATP (Note that Microsoft now has a client for macOS)
Open Graph APIs to integrate with your solutions MDATP
Integration with Microsoft Advanced Threat Protection (ATP) products MDATP
ISO 27001 compliance MDATP
Geolocation and sovereignty of sample data MDATP
Sample data retention policy MDATP
Multi Factor and password-less Authentication
Industry standards based multifactor authentication Windows Hello for Business
Support for biometrics (Facial and Fingerprints) Windows Hello for Business
Support for Microsoft Authenticator Windows Hello for Business
Support for Microsoft compatible security key Windows Hello for Business
Supports for Active Directory and Azure Active Directory Windows Hello for Business
Credential Protection
Hardware isolation of single sign-in tokens Credential Guard
Centralized management, analytics, reporting, and operations Credential Guard + MDATP
Full Volume Encryption
Automatic encryption on capable devices Win10
Advanced encryption configuration options BitLocker
Removable storage protection BitLocker to Go
Direct Access & Always On VPN device Tunnel Win10
Centralized configuration mgmt, analytics, reporting, and security operations MBAM (standalone, SCCM, Intune, MEM) + MDATP
Data Loss Prevention
Personal and business data separation Windows Information Protection
Application access control Windows Information Protection
Copy and paste protection Windows Information Protection
Removable storage protection Windows Information Protection
Integration with Microsoft Information Protection Windows Information Protection

Getting Help and Support for the Microsoft Store for Business

Posted on

Are you looking to get some help and support with the Microsoft Store for Business?  One route that you can go through is directly in the business store portal (  Just as seen in the image below.


Windows 10 News You Can Use – August 2019

Posted on

Win10NewsLogo Windows 10 news you can use, August 2019 edition
Insights into Windows 10 deployment & management, security & compliance, and productivity & accessibility.
Also see other news related to Windows 10.


Deployment & Management
  1. Evolving Windows 10 servicing and quality: the next steps. As part of our commitment to transparency, we are providing an overview of how we plan to further optimize the delivery of our next feature update. The next feature update for Windows 10 (known in the Windows Insider Program as 19H2) will be a scoped set of features for select performance improvements, enterprise features and quality enhancements.
  2. The next feature update for Windows 10 (internal code name: 19H2) will have a new update option that will be available to devices running Windows 10, version 1903. 19H2 will be a scoped release with a smaller set of enhancements focused primarily on select performance improvements, enterprise features, and quality enhancements. For commercial customers, read the article to understand the impacts.
  3. Windows Autopilot for existing devices now supports Hybrid Azure AD Join.
  4. Improving the Office app experience in virtual environments, including Windows 10 VDI and Windows Virtual Desktop.
  5. Use Desktop Analytics and machine learning to get current and stay current, now available in public preview. With Desktop Analytics, it’s easier to deploy with confidence and keep your PCs up to date with the latest Windows 10 capabilities your employees need.
  6. The blog for Windows Analytics has been retired. Visit the new Tech Community site for Desktop Analytics!
  7. Guide to try out Windows Autopilot white glove pre-provisioning with Windows 10, version 1903.
  8. MSIX Packaging Tool update – the July 2019 release includes popular customer asks, such as (1) support for apps that require restarts, (2) signing certification information as a global setting, and (3) setting the minimum version for converted apps to 1709 when you turn off enforce store versioning requirements.
  9. Getting started with FSLogix profile containers on Azure Files in Windows Virtual Desktop.
  10. Tactical considerations for creating Windows 10 deployment rings.
  11. Microsoft Intune is excited to announce the general availability of administrative templates support for Windows 10 device configuration profiles. This feature received wide adoption during the public preview because it helps Windows administrators use the settings they are familiar with in group policy editor when they transition to cloud-attached management.
  12. The Microsoft Mechanics team has published a series of video tutorials to show you how to prepare, deploy, and optimize Windows Virtual Desktop.
  13. Administrative Templates (.admx) for Windows 10 May 2019 Update (1903) now available.
  14. MSIX Labs and Training Videos – Now Available! The MSIX Training Labs contain a series of hands-on exercises geared at enabling people to become more familiar with different aspects of MSIX. From the MSIX packaging tool, to adding a package support framework, or just becoming familiar with some of the command line tools, the labs are a great place to get started for folks looking to learn more about MSIX.
  15. Upgrading Windows 10 devices with installation media different than the original OS install language. In this post, we will look at a scenario where a hypothetical multilingual organization wants to deploy Windows 10 to devices across multiple geographies in multiple languages. We’ll then outline the options that can be used to work around device install language issues and successfully deploy a Windows 10 feature update.
  16. Improvements for enterprises signing MSIX packages (Insider Preview). MSIX requires packages to be signed in order to be deployed. This helps us to offer integrity on the package being deployed and to ensure the contents being deployed are what was packaged from the developer or IT Pro.  While this is great, some customers found it problematic acquiring certificates within their enterprise.  In an upcoming Windows release will improve the tooling to enable signing of MSIX packages from your Azure Active Directory tenant.
Security & Compliance
  1. Microsoft Defender ATP alert categories are now aligned with MITRE ATT&CK framework tactics.
  2. Delivering major enhancements in Windows Defender Application Control with the Windows 10 v1903.
  3. Dismantling a fileless campaign: Microsoft Defender ATP next-gen protection exposes Astaroth attack.
  4. Microsoft Intune is excited to announce general availability of Windows MDM Security Baselines. A new version of security baselines is also being released at the same time, identified as MDM Security Baseline for Spring 2019 Update (19H1). This is a new template that includes several new settings and some other updates.
  5. Upgrading Windows 10 devices with installation media different than the original OS install language. In this post, we will look at a scenario where a hypothetical multilingual organization wants to deploy Windows 10 to devices across multiple geographies in multiple languages. We’ll then outline the options that you can use to work around device install language issues and successfully deploy a Windows 10 feature update.
  6. Microsoft Defender ATP (MDATP) supports network connection monitoring from different levels of the operating system network stack. A challenging case is when the network uses a forward proxy as a gateway to the internet. The proxy acts as if it was the target endpoint. In these cases, simple network connection monitors will audit the connections with the proxy which is correct but has lower investigation value. MDATP supports advanced HTTP level sensor. By enabling this sensor, MDATP will expose a new type of events that surfaces the real target domain names.
  7. Comprehensive protection for your credentials with Credential Guard and HVCI. The goal of Windows Defender Credential Guard is to make it incredibly difficult for malware to move laterally in an enterprise network and gain higher privileges. The theory is simple: prevent malware from stealing passwords, hopping boxes, and elevating privileges. An attacker is dead in the water if they can’t get credentials in the first place.
  8. Yet another step in building a world without passwords. Now announcing that you can go passwordless with the Public Preview of FIDO2 security keys support in Azure Active Directory. It means that you can now try out passwordless capabilities that allow you to roll out, at scale, FIDO2 security keys that will authenticate a user on a Windows 10 Azure AD joined device.
  9. Oftentimes, organizations require better control over their raw data. To answer this need, Microsoft Defender Advanced Threat Protection (MDATP) allows you to stream Advanced hunting events to Azure Event Hubs or to an Azure storage account. In this blog, I am going to demonstrate how to stream your Advanced hunting events to Azure storage account and set an Azure blob storage lifecycle rule to move old data to low-cost storage.
  10. Microsoft Defender ATP (MDATP) Evaluation lab is now available in public preview! The evaluation lab allows you to create up to three machines with a click of a button. Each machine is provisioned for you by Microsoft Defender ATP and is available for all your testing needs for three days. They’ll come with the latest and greatest Windows 10 installed, they’ll be onboarded to your environment, and configured with all the Microsoft security baseline settings in place in audit mode.
  11. Most machine learning models are trained on a mix of malicious and clean features. Attackers routinely try to throw these models off balance by stuffing clean features into malware. Monotonic models are resistant against adversarial attacks because they are trained differently: they only look for malicious features. The magic is this: Attackers can’t evade a monotonic model by adding clean features. To evade a monotonic model, an attacker would have to remove malicious features. One of the latest innovations in our protection technology is the addition of a class of hardened malware detection machine learning models called monotonic models to Microsoft Defender ATP‘s Antivirus.
  12. Protect your device from malware with Windows Sandbox. Have you ever downloaded a program from a website or opened an email attachment thinking it was from someone you know, only to find out it was infected with a virus? Such actions can wreak serious havoc. Windows Sandbox allows you to run a program or open a file while keeping it apart from your device—almost as if it were on a totally separate computer.
  13. Modern security teams need to proactively, efficiently, and effectively hunt for threats across multiple attack vectors. To address this need, we’re giving a glimpse of new capabilities coming soon to threat hunting technology currently available in Microsoft Defender Advanced Threat Protection (MDATP).
  14. How Windows Defender Antivirus integrates hardware-based system integrity for informed, extensive endpoint protection. Recently, the Microsoft Defender ATP (MDATP) research team found a malicious system driver enabling a token swap attack that could lead to privilege escalation. In this blog, we’ll share our analysis of the said attack and discuss how Windows Defender Antivirus uses its unique visibility into system behaviors to detect dangerous kernel threats.
  15. Microsoft Defender ATP (MDATP) includes a sandbox in each customer tenant, to detonate files in a safe environment and provides a rich and readable report of what the file can do – gain persistence, communicate to IP addresses, change the registry, etc… but in some case you want to run such analyses in your own sandbox or do reverse engineering work, with MDATP you can now download and inspect any file found on your network.
Productivity & Accessibility
  1. Video (0:58) – It’s easy to forget what we were working on, especially when it was days or weeks ago. Timeline for Windows 10 PCs helps you jump back into something you were doing – like working on a document or browsing a website.
  2. Sync your settings in Windows 10 allows some of the common personalization preferences to be synced to the cloud and applied to any PC you sign in to with your Microsoft account. By letting Windows 10 sync your settings, you can have a more consistent experience no matter which device you happen to be using.
  3. Windows 10 Tip: Your Phone app gives you more to do with messages and photos.
  4. Video (1:52) – Microsoft is moving past old ideas of sound design and designing sound with all senses in mind. Recognizing the way sound moves us, emotionally and physically, we are taking a different path to designing for sound holistically.
  5. Thanks to the Windows 10 May 2019 Update, you’ll be able to take full advantage of the newest version of the Sticky Notes app. With this most recent version, you can sync and backup notes across your phone, laptop and desktop — all your devices.
  6. Video (2:17) – Windows 101: Four simple ways to switch between Windows apps.
  7. Video (0:43) – Introduction to Dictation in Windows 10.Use dictation to convert spoken words into text anywhere on your PC. Dictation uses speech recognition, which is built into Windows 10, so there’s nothing you need to download or install to use it.
  8. Video (2:04) – Making the mouse pointers easier to see. These new settings aren’t just for users with low vision, learn the different ways you can use these settings.
  9. Windows 10 Tip: The release of Emoji version 12.0 aims to better represent people with disabilities. You’ll now see mechanical limbs, sign language and hearing aids; as well as manual and motorized wheelchairs and two different versions of service animals.
  10. Capture and share videos with Game bar. Did you know that you could do more than just gaming? Videos are everywhere. We watch them for instruction and entertainment. With Windows 10, it has become super easy to take screenshots of your screen using the Snip & Sketch tool. But what if you want to record live video action? Game bar can do that too.
In other news related to Windows 10…

Windows 10 news you can use, July 2019

Posted on


Win10NewsLogo Windows 10 news you can use, July 2019 edition. Insights into Windows 10 deployment & management, security & compliance, and productivity & accessibility.


Deployment & Management
  1. Microsoft is often asked to help customers choose between Windows 10 Enterprise or Windows 10 Pro. Specifically to clarify the differences between the two editions, and the impact those differences might have to your organization. With that in mind, we decided to take a closer look at these conversations—and the key considerations when it comes to deciding between Windows 10 Enterprise and Windows 10 Pro for your organization—by talking with Nick and Shawn, two technical specialists focusing in Windows deployments.
  2. Webinar (59:52) – experts at Microsoft Core Services Engineering and Operations answered questions about their modern desktop and device management. They discussed the processes and tools used to support a wide range of scenarios as well as the use of Intune, SCCM, WUfB, Azure AD, and transition to modern management.
  3. Video (10:19) – A lot has evolved since the Windows Virtual Desktop (WVD) preview kicked off in March 2019. In this episode we review the progress the team has made to create a much easier Azure portal experience to setup and manage your WVD Host Pools.
  4. Video (1:05) – Will the new chromium-based Microsoft Edge still be connected to Windows updates? Chris Heilmann talks about how Microsoft Edge updates will be delivered going forward.–One-Dev-Question
Security & Compliance
  1. Video (58:40) – In today’s world, device health is a pillar of security. Unmanaged devices are a powerful entry point for malicious parties, and it is vital that only healthy devices can access critical apps and data. Learn about device health, device security at Microsoft, and key investment areas Microsoft are pursuing.
  2. Microsoft’s vision for Windows is one of a passwordless platform—a world where users don’t have to deal with the pains of a password. With the release of Windows 10, version 1903, we’re bringing Windows 10 closer to delivering our passwordless user and security promises, with new features that we’re excited for you to try.
  3. New documentation for building secure, privileged access workstations! Secured isolated workstations are critically important for the security of sensitive roles like administrators, developers, and operators of critical services. Build a secure client workstation with these detailed step by step instructions, including how to set up starting security controls.
  4. When hardening your deployment of Windows 10, how should you prioritize the hardware you buy, policies you enforce, controls you configure, and behavior your staff exhibit? To help you prioritize your endpoint hardening work, Microsoft is introducing a new taxonomy for security configurations for Windows 10.
  5. Beginning with Configuration Manager 1905 TP, you can install and manage the MBAM
  6. Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection. Much like how MDATP integrates multiple capabilities to address the complex security challenges in modern enterprises, Windows Defender AV next-generation protection engines provide industry-best detection and blocking capabilities.
  7. The evolution of Microsoft Threat Protection, June update. Game-changing capabilities for endpoint security with Microsoft Defender ATP (MDATP): protections for macOS, live response (new incident response action for SecOps teams), and how to try out the live response feature.
Productivity & Accessibility
  1. Join us as we interview Windows enthusiasts around the world to hear how they’re putting Windows to work.
  2. Microsoft Edge Experiment: Battery Life | Windows 10 May 2019 Update.
  3. Video (0:18) on how to quickly share files with another PC during meetings.
  4. Video (3:43) on how wireless projection works in Windows 10.
  5. At Microsoft, we’re on a journey to empower every person on the planet, including people with disabilities, to achieve more. What’s new in the Windows 10 May 2019 Update for accessibility.
  6. New Windows 10 users – those who have new devices, new user accounts and clean installs – will see the new, greatly simplified, Start layout by default when they start up.
  7. Video (4:06) – Remember the small things with Microsoft Sticky Notes. This app makes it easy to unclutter your desktop and sync your notes securely across your devices, so you can access them on any device.
  8. Control the action with your eyes on Windows 10 PCs through four new games.
  9. Windows 10 Tip: light theme with the Windows 10 May 2019 Update.
  10. Video (2:53) – Volume conversions using the Calculator app.
  11. Easier navigation with Windows 10 tablet mode. Using Tablet mode in Windows 10 can make it easier to browse the web and it can also free up room on your screen. But it isn’t just for touchscreen devices. This article will go over how to enter/exit Tablet mode followed by an overview of the information needed to navigate it.
  12. Check out the most recent and greatest Edge features. From being able to mute tabs, to clutter-free printing, to various grammar tools.
In other news related to Windows 10…

Windows 10 News You Can Use – June 2019

Posted on

Win10NewsLogo Windows 10 news you can use, June 2019 edition

Providing insights into Windows 10 deployment & management, security & compliance, and productivity. Also see other news related to Windows 10.

What’s new in Windows 10, version 1903, and how to get it.

Calling all IT professionals! Join Microsoft on Tuesday, June 4th for a chance to get your questions about Windows 10 deployment, security, update management, device management, and productivity—and the latest Windows 10 feature update (1903)—answered by the experts behind the Windows 10 features and solutions built for IT.

Deployment & Management
  1. Deployment rings: The hidden [strategic] gem of Windows as a service. In speaking with customers who have successfully changed their internal IT culture by moving from project to process, we’ve learned that one of the keys to a successful, more self-service, peer-support-driven model is to create deployment rings for Windows 10 feature updates, and the adoption and use of data driven insights and analysis, in conjunction with the deployment rings.
  2. Webcast Thursday 6/6/19: All you need to know about Windows Virtual Desktop.
  3. Ask Microsoft Anything event 6/12/19: Windows Virtual Desktop.
  4. All the news from Build 2019 on Microsoft Edge: A first look at new productivity concepts, privacy tools, and Internet Explorer mode for seamless enterprise compatibility.
  5. Video (0:50) introducing the future of Microsoft Edge.
  6. Microsoft Mechanics video (17:51) stay ahead of Windows and Office deployments and updates with SCCM. See what’s new, get an explanation on your desktop deployment options, and hear about proven guidance for automating the process to move forward from older versions of Windows and Office. Microsoft 365 Director Jeremy Chapman runs it all down – from app delivery updates, to networking enhancements, deeper tool integration and better user experiences.
  7. Video (30:40) in this really demo heave episode of The Endpoint Zone with Brad Anderson we look at when to use ConfigMgr and/or Intune and why co-management is a unique thing, that only Intune and ConfigMgr can do to manage Windows 10. Plus, why you would use them over other UEM solutions.
  8. Video (6:42) a Microsoft Mechanics look at the new Windows Autopilot capability called white glove in Windows 10 1903. Also, the latest Windows 10 Autopilot features that we’ve delivered in Windows 10 1809 and beyond.
  9. Increasing transparency: the Windows health dashboard. As part of our commitment to increasing transparency, the new Windows release health dashboard is now live, offering timely information on the current rollout status and known issues (open and resolved) across both feature and monthly updates. The new dashboard provides a single page for each currently supported version of Windows so you can quickly search for issues by keyword, including any safeguard holds on updates, see the current status of each issue, and find important announcements. Watch this video (3:43) introducing the new Windows release health dashboard.
  10. Starting with Windows 10, version 1903, devices utilizing the Update Compliance analytics service can now determine which of their managed devices are not receiving a feature update due to a hardware or software compatibility issue identified by Microsoft.
Security & Compliance
  1. Microsoft is excited to announce enhancements to BitLocker management capabilities in both Microsoft Intune and System Center Configuration Manager (SCCM), coming in the second half of 2019. Whether your management infrastructure is on-premises or in the cloud, robust BitLocker management is required for today’s enterprises to secure modern endpoints.
  2. With the release of Windows 10, version 1903, Windows Hello is a FIDO2 Certified authenticator. FIDO2 enables developers to leverage standards-based protocols and devices to provide users easy authentication to online services—in both mobile and desktop environments.
  3. Detecting credential theft through memory access modelling with Microsoft Defender ATP. MDATP, Microsoft’s unified endpoint protection platform, uses multiple approaches to detect credential dumping. In this post, we’ll discuss one of them: a statistical approach that models memory access to the Local Security Authority Subsystem Service (lsass.exe) process.
  4. Announcing the all new Attack Surface Analyzer 2.0! It can help you identify potential security risks introduced by changes to an operating system’s security configuration by identifying changes in key area.
  5. Windows 10 attack surface reduction (ASR) rules help prevent malware from infecting computers with malicious code. Some of these rules aim to reduce your attack surface while you’re using Office applications. We’re extending a few of these ASR rules to include Office 365 desktop apps from the Microsoft Store.
  6. Conducting a thorough forensic investigation of compromised machines is integral to incident response. However, it can be a challenging task because it requires the device to be in the corporate network and for additional software to be deployed, or for SecOps to have physical access to the device. That changes today, with the public preview of live response capabilities in Microsoft Defender ATP. Live response gives SecOps instantaneous access to a compromised machine regardless of location using a remote shell and gather any required forensic information.
  7. In “Step 9. Protect your OS” of the Top 10 actions to secure your environment blog series, we provide resources to help you configure Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) to defend your Windows, macOS, Linux, iOS, and Android devices from advanced threats.
  8. Windows Defender Application Guard, the hardware-based isolation technology on Windows 10 that allows Microsoft Edge to isolate browser-based attacks, is now available as a browser extension for Google Chrome and Mozilla Firefox.
  9. Announcing an update to Microsoft Defender ATP: unified indicators of compromise (IoCs) experience. We’ve unified several different IoC lists and made the lists more accessible for interactive (portal) and automated (API) use. In addition, we aligned all detection and enforcement means to honor the unified list. The new schema supports several actions such as allow, alert-only, and alert and block. It also supports RBAC for fine-grained control over user access.
  1. Although the default settings for power use will probably work fine for most people, knowing how to conserve your battery can come in handy. Read on to learn how to find your power icon, learn tips and tricks for saving your battery life, troubleshoot common scenarios, and stay in control of your power options.
  2. Windows 10 Tip: Microsoft Edge toolbar for PDF actions.
  3. Whether you’ve got your arms full of books or want to find an important document without scrolling through Search, Ease of Access dictation allows you to do it all hands-free.
  4. For IT Pros: After upgrading to Win10 Insider build #18272 or later, Windows Console (E.g. launch Cmd, PowerShell, WSL, etc.) supports zoom in-and-out features. Hit and hold CTRL while scrolling your mouse wheel / trackpad.  You’ll also notice that Console now honors your Light/Dark Theme settings: If you are using the Dark Theme, your Console’s scrollbar is also dark-themed!
  5. Windows 101: Turning on airplane mode in Windows 10.
In other news related to Windows 10…

Windows 10 News You Can Use – May 2019

Posted on Updated on

Win10NewsLogo Windows 10 news you can use, May 2019 edition

Providing insights into Windows 10 deployment & management, security & compliance, and productivity. Also see other news related to Windows 10.

The next generation of Microsoft Edge! In December, we announced our intention to adopt the Chromium open source project in the development of Microsoft Edge on the desktop. Our goal is to work with the larger Chromium open source community to create better web compatibility for our customers and less fragmentation of the web for all web developers. Today we’re embarking on the next step in this journey – our first Canary and Developer builds are ready for download on Windows 10 PCs. Canary builds are preview builds that will be updated daily, while Developer builds are preview builds that will be updated weekly. Beta builds will come online in the future. Support for Mac and all supported versions of Windows will also come over time.

Deployment & Management
  1. Introducing the Microsoft Edge Insider Channels. The new Microsoft Edge builds are available through preview channels that we call “Microsoft Edge Insider Channels.” We are starting by launching the first two Microsoft Edge Insider Channels, Canary and Dev, which you can download and try at the Microsoft Edge Insider site. These channels are available starting today on all supported versions of Windows 10, with more platforms coming soon.
  2. Windows defines two main policies, Quick removal and Better performance, that control how the system interacts with external storage devices such as USB thumb drives or Thunderbolt-enabled external drives. Beginning in Windows 10 version 1809, the default policy is Quick removal. In earlier versions of Windows, the default policy was Better performance.
  3. The benefits of Windows 10 Dynamic Update. Dynamic Update can help organizations and end users alike ensure that their Windows 10 devices have the latest feature update content (as part of an in-place upgrade)—and preserve precious features on demand (FODs) and language packs (LPs) that may have been previously installed. Further, Dynamic Update also eliminates the need to install a separate quality update as part of the in-place upgrade process. From an IT perspective, using Dynamic Update reduces the need to apply separate updates to recently installed systems and makes it easier to get your devices up to date with the latest available quality update in one step.
  4. Configuring Windows 10 defaults via Windows Autopilot using an MSI.
  5. Configuring even more Windows 10 defaults via Windows Autopilot using an MSI.
  6. Microsoft Helps video (1:30) on how to create a report of Mobile Device Manager (MDM) logs to diagnose enrollment or device management issues in Windows 10 devices managed by Intune.
  7. Microsoft Helps video (10:27) on tips to manage and deploy updates for Surface and Window 10, including allowing firmware and security updates while holding off on feature updates as your organization evaluates each new release of Windows 10. This video walks through 5 management practices: an Overview of Defer Feature Updates, Windows feature update cycle, Office and Windows Configuration Manager update cycle, security updates, and Update compatibility with apps and hardware.
  8. Microsoft Helps video (6:11) on how Windows Autopilot can transform how you deploy Surface and Windows 10 devices in your organization. Windows Autopilot set ups and pre-configures new devices, getting them ready to use. You can also use Windows Autopilot to reset, repurpose and recover devices. We’ll cover how it works as well as the user experience once they receive the device. Content includes: traditional vs. modern deployment, how Autopilot works, and setting up a device.
Security & Compliance
  1. Microsoft Defender ATP built-in threat summary and health reports. The threat protection reporting dashboard provides alert information over time, as well as aggregated threat protection views. Knowing the trends and summaries in your organization can help identify where focused improvements can be made.
  2. Third-party kernel drivers are becoming a more appealing target for attackers and an important area of research for security analysts. A vulnerability in a signed third-party driver could have a serious impact: it can be abused by attackers to escalate privileges or, more commonly, bypass driver signature enforcement—without the complexity of using a more expensive zero-day kernel exploit in the OS itself. We discovered such a driver while investigating an alert raised by Microsoft Defender Advanced Threat Protection’s kernel sensors. In this blog post, we’d like to share our journey from investigating one Microsoft Defender ATP alert to discovering a vulnerability, cooperating with the vendor, and protecting customers.
  3. Microsoft Threat Experts is the managed threat hunting service in Microsoft Defender Advanced Threat Protection (ATP). It provides security operations centers (SOCs) with expert-level oversight and analysis to help ensure that critical threats in their unique environments are identified, investigated, and resolved. Get more details about the service here: Announcing Microsoft Threat Experts. Today, we are announcing the general availability of Microsoft Threat Experts targeted attack notification capability. Targeted attack notification, one of Microsoft Threat Experts’ two components, provides proactive hunting, prioritization, and alerts that are tailored to organizations. These alerts include as much information as can be quickly delivered to bring attention to critical threats, including timeline, scope of breach, and methods, to further empower SOCs to identify and respond to threats quickly and accurately.
  4. Introducing the security configuration framework: A prioritized guide to hardening Windows 10.
  5. Preview! Windows Defender Application Guard as browser extensions in Google Chrome and Mozilla Firefox. To extend our container technology to other browsers and provide customers with a comprehensive solution to isolate potential browser-based attacks, we have designed and developed Windows Defender Application Guard extensions for Google Chrome and Mozilla Firefox.
  6. MDATP Threat & Vulnerability Management now publicly available! This is a new Microsoft Defender ATP component that helps effectively identify, assess, and remediate endpoint weaknesses and provides both security administrators and security operations teams with unique value, including: real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities, invaluable machine vulnerability context during incident investigations, built-in remediation processes through Microsoft Intune and SCCM.
  7. At the RSA conference, we announced the general availability for Microsoft Defender ATP’s integration with Microsoft Cloud App Security – delivering a native integration to discover the cloud apps used in your organization. This is the first step towards enabling a seamless, zero deployment, native cloud app security solution that works any time any-where.
  8. Announcing the general availability of Microsoft Defender ATP APIs – a rich and complete set of APIs geared to fulfill the needs of security operations teams, enabling interoperability with enterprise security applications and automation. These capabilities enable customers to integrate and orchestrate defenses across their solution stack and management systems to orchestrate Microsoft Defender ATP; enabling security teams to effectively respond to modern threats.
  9. In an ideal world, all your critical devices would be seen by, reported on, and protected by Microsoft Defender ATP, however we’re aware that there are legitimate scenarios where devices simply can’t be connected to the Internet or a management service. As such, we have released a whitepaper with all the info you need to understand how security is impacted by the unique challenges of being disconnected. It talks about the types of disconnected devices, and — most importantly — provides guidance on the various features and protection technologies you can use from Microsoft to protect these disconnected devices.
  1. Windows 10 Tip: Dark theme in File Explorer.
  2. Windows 10 Tip: Snip & Sketch. Since it’s available in the Microsoft Store, Snip & Sketch can update faster and more frequently. It’s already had four app updates with new features since it was introduced in the October 2018 Update.
  3. Windows 10 Tip: What’s new in Skype (consumer) for Windows 10 PCs.
  4. Windows 10 makes wireless projection
  5. Stay organized with Sticky Notes in Windows 10.
  6. Customize Microsoft Edge for better browsing.
  7. Video (4:05) Windows 10 wireless projection makes it easy to present your work, share memories, and watch your favorite movies on a big screen without stepping out the door.
  8. Video (2:48) Windows 101: Windows Calculator for easy length conversions.
  9. Windows 10 Tip: See your top sites in the Jump List.
In other news related to Windows 10…

Windows 10 News You Can Use – April 2019

Posted on

Win10NewsLogo Windows 10 news you can use, April 2019 edition

Providing insights into Windows 10 deployment & management, security & compliance, and productivity.

Helping IT reduce costs, increase security, and boost employee productivity, by Jared Spataro, Corporate Vice President for Microsoft 365.

Deployment & Management
  1. Windows 10, version 1809 designated for broad deployment.
  2. Minimize the impact of Windows 7 and Office 2010 End of Support on your business – a Microsoft webinar (recorded 3/21/19) will explore how businesses of all sizes can achieve more by shifting to a modern desktop.
  3. Installing and using DTrace, a dynamic tracing framework that allows an admin or developer to get a real-time look into a system either in user or kernel mode. Using these dynamically inserted trace points, you can filter on conditions or errors, write code to analyze lock patterns, detect deadlocks, etc.
  4. Announcing the public preview of Microsoft Windows Virtual Desktop. Now, all customers can access this service—the only service that delivers simplified management, a multi-session Windows 10 experience, optimizations for Office 365 ProPlus, and support for Windows Server Remote Desktop Services (RDS) desktops and apps. With Windows Virtual Desktop, you can deploy and scale your Windows desktops and apps on Azure in minutes and enjoy built-in security.
  5. On this [Microsoft Mechanics] show (12:43), we’ll take a closer look at Windows Virtual Desktop, now in public preview. See how you can give your users the only Windows 10 multi-session experience virtualized in the cloud and available on any device. Scott Manchester demonstrates how WVD delivers the best Office experience with multi-session virtual scenarios that virtualize persistent storage in a multi-session environment. Keep watching for a sneak peak of the next generation admin experience for WVD in the Azure portal.
  6. With the public preview for Windows Virtual Desktop now available, we wanted to provide a quick overview of the steps required to get your environment up and running.
  7. In this [Microsoft Mechanics] show (16:17), CVP Brad Anderson demonstrates cold-booting his personal, highly-managed and secured Windows 10 device in under 20 seconds. We’ll also show new options to get to managed remote Windows sessions and apps across devices using the new Windows Virtual Desktop. And we show new streamlined management experiences for Microsoft 365 administrators as well as what you can do to set baseline protections and device configurations quickly using built-in Security Baselines in Microsoft Intune.
  8. What’s new to manage and secure your devices with Configuration Manager and Microsoft Intune.


Security & Compliance
  1. On November 29, 2018, MITRE published the results of their evaluation of several endpoint detection and response (EDR) solutions, testing them against a chain of attack techniques commonly associated with the APT3 activity group. MITRE avoided direct vendor comparisons, but this has not prevented participating vendors from claiming victory and leveraging the results in aggressive marketing campaigns. The evaluation highlighted Windows Defender Advanced Threat Protection’s (Windows Defender ATP) distinct, superior capabilities when compared with other participating vendors.
  2. Microsoft Intune security tasks extend Microsoft Defender ATP’s Threat & Vulnerability Management. Effectively identifying, assessing, and remediating endpoint weaknesses is pivotal in running a healthy security program and reducing organizational risk. Today, we are happy to introduce Microsoft Intune security tasks, a new one-click remediation capability in Microsoft 365 that bridges security stakeholders—security administrators, security operations, and IT administrators—by allowing them to collaborate and seamlessly remediate threats. This capability will extend the newly announced Microsoft Defender Threat & Vulnerability Management (TVM), a new component of Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP, previously Windows Defender ATP) that uses a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
  3. Introducing a risk-based approach to threat and vulnerability management. Threat & Vulnerability Management, a new, built-in capability that uses a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. This capability is coming to Microsoft Defender Advanced Threat Protection (ATP), our industry-leading unified endpoint security platform with an updated name that reflects the newly announced expanded coverage.
  4. Announcing Microsoft Defender ATP for Mac. Today, we’re announcing our advances in cross-platform next-generation protection and endpoint detection and response coverage with a new Microsoft solution for Mac. Core components of our unified endpoint security platform, including the new Threat & Vulnerability Management also announced today, will now be available for Mac devices.
  5. Tamper protection in Microsoft Defender ATP is a new setting available which provides additional protections against changes to key security features, including limiting changes that are not made directly through the app. Enabling this feature prevents others (including malicious apps) from changing important protection features such as (a) Real-time protection, (b) Cloud-delivered protection, (c) IOAV, (d) Behavior monitoring. The feature also prevents the deletion of security intelligence updates and the disabling of the entire antimalware solution.
  1. Windows 10 Tip: Look up definitions for words in web pages, books and PDFs.
  2. Announcing the Open Sourcing of Windows Calculator. This includes the source code, build system, unit tests, and product roadmap. Our goal is to build an even better user experience in partnership with the community. We are encouraging your fresh perspectives and increased participation to help define the future of Calculator.
  3. Find my device is a feature introduced in the 2015 Windows 10 update, allows you to locate your Windows device if it goes missing. The best part about Find my device is that it’s completely safe to use, and automatically included in Windows 10.
  4. Windows 10 Tip for Microsoft Edge: Increase text spacing, choose themes and colors, and how to use the learning tools.
  5. Manage and use virtual desktops like a pro in Windows 10.
  6. Make Windows easier to see: bigger text and mouse pointer.
  7. Windows 10 Tip: Improve focus as you read web articles.
  8. Windows 101: Three ways to personalize your PC background.
  9. Whiteboard in Teams meetings integration, ink grab and ink beautification are here!
  10. Cloud clipboard: Copy & paste across your Windows 10 devices.
In other news related to Windows 10…