Today I am going to show you Office 365 Advanced Security Management.
It's a new capability we've added to the service
which gives you enhanced visibility and control into your Office 365 tenant.
It works by taking a baseline of the user activity within your tenant
to start to learn what's normal and what's anomalous behavior.
The first thing you need to do is activated it.
To turn on Advanced Security Management
go to the Office 365 portal, and launch the Security Compliance Center.
You can either do this from the app launcher or from right here on the home screen.
Once you're in the Security Compliance Center
under Alerts, you'll find Managed Advanced Alerts.
Where you can read all about the feature on the page.
Now to activate it, you simply click the box to turn on Advanced Security Management.
And, click on Go to Advanced Security Management.
Once activated, you will end up in the Advanced Security Management Portal.
This is a place that you'll see all of the policies
that any of the alerts that the policy has triggered.
Now this tenant is populated.
But, when you do this for the first time
you'll only see one predefined policy,
the general anomaly detection to get you started.
Now you'll notice in the top bar,
there are more open alerts then we have open alerts associated with policies.
And, that's because we have a number of built-in alerts.
For example, new location.
When someone from your organization logs onto a location for the first time.
Or, a new admin user.
Every time a new admin gets created, you get alerted.
Now, the alerts were rated as high, medium or low
to help you understand the severity of them.
The System learns over time how to determine good activity from bad activity.
But, you'll want to add additional policies and specific things that you want to alert on.
To give you an idea of the details offered behind a given alert
let's have a look at an anomaly alert.
This gives me a risk score that helps me assess the severity of the issue.
And that's based on more than 70 different risk factors.
We can see here that this is an administrative user
that is logged onto an anonymous proxy
that's performed a mail forwarding action.
Now before I investigate further,
I might want to suspend that user to make sure that nothing else bad happens.
And then, I can investigate further.
For example, I might want to see what else happened at that IP address
by looking at the activity log.
And from there, I can also look at all the user activity that this user has performed.
So, how do you get the system to alert you on the things that you most care about?
There are two types of policies.
An Activity policy, or an Anomaly Detection Policy.
Let's start with the Anomaly Detection Policy.
Where you can influence the risk factors that we look at and determine what action can be taken.
You can for example, set up an alert just to attract the anomolous activity
that happens outside your network.
And as an administrator, you get to define what the network ranges are that are internal.
You can define how often you want to be alerted.
And, you can also set the threshold for what severity you want to be alerted at.
And finally, you can define how you want to be alerted.
By email or by a text message.
That was an anomoly policy.
Let's look at the second type of policy you can create, an Activity Policy.
This allows you to be alert about specific activities you are interested in.
Now, you can use the built in template's to give you some recommendations
about some of the most common activities we found are useful for admins to be alerted on.
In this case, we'll use the mass download by a single user.
Now this template automatically fills in all of the required activities.
But, you can also add additional filters to fine tune the alert.
In this case, we're not only looking for one activity
we're looking for a repeated number of activities.
In this case, 30 download activities within 5 minutes by the same user.
You can choose how you want to be notified.
But more importantly, you can choose to suspend the user
automatically as soon as this alert is fired.
And, another way you can create these activities policies
is that while you're searching the activity log,
in this case I'm searching for the activity around a particular IP address.
I can create a new policy to alert me
to anything that happens directly from that IP address.
I just have to fill out the name and description, and I've got a new activity policy.
So that was a quick overview of the new Office 365 Advanced Security Management
Now coming soon, beyond just the ability to monitor and customize alerts
we're working on other areas of visibility.
Such as the ability to see what applications have access to your Office 365 data.
And more importantly, you'll be able to revoke their access
if you think they pose a risk to your environment.
If you have Office 365 Enterprise E5,
you can turn on Advance Security Management now and try it.
Or, you can sign up for E5 trial at the link below.
Thanks for watching.
Microsoft Mechanics
www.microsoft.com/mechanics