(techno music)
- Coming up, we take a look at the new
Privilege Access Management capabilities in Office 365
that allows you to control admin privileges
within your tenant to prevent rogue admin activity
or unauthorized admin access.
This idea is based on the principle of zero standing access
requiring a highly supervised process
for admin access privileges.
Access requests need to be approved
by an authorized set of approvals.
Access is then time-bound for a limited duration,
often referred to as just-in-time access.
And all the activities are logged for auditing purposes.
With admins often the target for phishing attacks,
the good news is that this process
is now being brought to your tenant.
Let's take a closer look at how this works.
I'll start by highlighting the risks
associated with standing privileges.
As an admin, you have the keys to the kingdom,
so if an admin goes rogue or the credentials are compromised
they could do collateral damage.
I'm going to set a journal rule typically used
for compliance reasons or legal hold.
A journal rule is a powerful command that will start copying
every sent or received email to the shadow mailbox.
In this case, each email will go to rougeactor@outlook.com
but this could literally be any email address.
Imagine, if your tenant admin went rogue
and set a journal rule against to
your CEO's mailbox maliciously,
by the time the activity's detected,
the damage is already done.
Let's take a look at how we can limit standing privileges
for such high risk tasks within Office 365.
Here, I'm in the Admin Center.
You can manage privilege admin access
from the Office 365 Admin Center,
under Settings and Security and Privacy.
Let's turn on the feature
and set the default approval group.
All the privilege access management request
will by default come to this group for approval.
And you can set the duration of access in hours.
I'll just stick to the four hours default.
Now that we have enabled privilege
to access management in Office 365,
let's create an access policy
to prevent journal rules without approval.
I'll click on Privileged Access
and I'm going to configure a new policy.
First, I need to select the policy type.
This can be either a Rule or a Task.
Since we are preventing unapproved journal rules,
I'll select Tasks.
I'll select the Policy Scope to be Exchange
and then the task to be Journal rule.
Next, I can choose between Auto or Manual approval.
Auto-approval is great for certain high-volume task
like password reset.
But I'm going to choose Manual approval
for high risk tasks like setting a journal rule.
I'm going to keep the default approval group
that I created earlier,
but I can choose a different approval group
if I wanted to.
Aligning your task with Privileged Access Management
in Office 365, enables you to get a rich auditing report
both in the case of auto-approval
as well as manual approval.
Now, let's go back to the Access Policies page.
Here is the policy for the journal rule
that we just created.
Similarly, you can add policies
for other high risk tasks and rules here too.
Now that the policy's added, let's switch the power shell
and run the same journal rule that I ran earlier.
You can see that the cmdlet fails with an error,
asking me to raise an elevation request to get access.
I can now request access using
the new elevated access request cmdlet.
You can see, this request has scoped a new journal rule
with a limited duration of four hours.
This will also generate an email notification
to the approver that clearly calls out
the relevant details for the access request.
Now, back in the Admin Center, as the approval,
I can see the pending request.
I can view the details and choose to approve or deny.
Let's go ahead and approve this request.
Once approved, as the admin requestor,
I'll receive an email letting me know
that I can go ahead and set the journal rule.
Now that I have access, I'm able to set
the journal rule and only that.
And after four hours, this privilege will expire.
Lastly, the activities are logged and auditable
so I can review all privilege access request
and approvals that were performed within my tenant.
I can get all this information in the Office 365 audit log,
and use this information to respond to auditor request.
So, that was a brief overview
of the new Privileged Access Management capabilities
in Office 365, which provides just-in-time
and just enough access at a more granular task level.
We are bringing our learnings and best practices
from how we run our data center at Microsoft
to your organization,
by giving you a privilege access workflow
that's auditable and that can provide
an additional layer of security.
We hope you go the extra steps
of enabling Privilege Access Management capabilities
in your Office 365 done in today.
To learn more, please go to the link below
and thanks for watching.
(techno music)