Welcome back everyone we've already discussed what identity
protection is and how to roll it out in your organization. Today
will talk about using identity protection on an on going basis
for monitoring and management purposes. One important piece of
this is a security overview. Rajat can you share how IT admins use
this new security overview? Sure Sarah the security overview
gives organisations insight into their security posture for
example, new risky users detected timeline shows the trend in new
users moving to one of the specified risk levels within
your organization. Similarly, new risky signings detected
timeline shows the trend
in the successful sign-ins within the specified risk type and levels within
your organization. IT admins can even get the latest count of
risky users unprotected risky sign ins in the last one week
and legacy authentication count in the last week from the tiles
on the right. Finally, IT admins can check their Identity Secure
Score here. a click on any of the areas of the security overview
will take you right into that section for deeper insights. So
Sarah Let's assume I've gone through the security overview
and want to dig deep. Can you show us how one can learn more
about risky users and risky sing ins using identity protection?
Absolutely identity protection provides two Important reports that you should monitor
daily. The risky sign-ins andthe risky users reports.
Using these reports you can gain deeper insights into
risk in your environment with the ability to filter and sort
the risky sign ins and risky users. You can better understand
potential intrusion in your organization. Let's take a look
at these reports, so I'm going to open the risky users report
and I want take a look.
At our most recent high risk users. So I'm going to filter by risk level
here as high.
So I see this user and I want to know more about what made them
risky. So I'm go ahead and click on that user and in this drawer I
can see basic information about this user such as their office
location and department. When I click on recent risky sign ins. I
see that they have a number of logins from locations that are
not near their office that our
flag is risky. But not all detections are linked to a
specific sign in when I click on risk events, not link to sign in
I see that they also have leaked credentials. The risk
history and risk changes tabs. Give me even deeper insight into
brought this user to their risky state. At this point, I can
quickly remediate their risk by clicking on reset password or if
I want to immediately closed all of their risk I can click on it dismiss user
risk. It is important to note that dismissing a users risk
restores them to non risky state and dismisses all their past
risky sign-in events. You can't revert this action. Now let's
move over to this risky sign ins report so I want to take a look
at all these users that
are of medium or above risk. So I see this user down here that
has medium risk and I'm going to open to learn why so similar to
the risky uses report. I have the basic info tab where I can
learn information about this sign in such as time, IP address,
location, client and resource. I can learn more about the device
used. The MFA situation and whether or not any conditional
access policies were applied during this sign in and finally
in the risk info tab, I can know why this sign in was
considered risky. It shows me all the detections that came
in as positive on this sign in. Here, I can see that I was in
anonymous IP address I can expand that to learn more.
But before, you dive into an investigation of a specific user
or specific sign in you can narrow down the reported data to
a level that meets your needs. You can select which columns are
displayed by clicking on the columns button. This allows you
to see only the pertinent fields more quickly find the
information you need. Better yet, and then click download to
get a CSV of all the data that is displayed here well. Wow, there's a lot of risk
insight in these two reports for IT admins. What if I have
some feedback on risk assessment done by Microsoft
could show us how it admins can share that with an Identity
protection. Absolutely, providing the highest
quality detection is at the heart of identity
protection. So we provide built-in mechanisms to allow
you to give feedback on a risk assessment.
There, a few ways, IT admin can improve their risk
assessment. The first being confirming assign is compromised
and the second confirming assigning is safe. Confirming a
sign in a safe tells Azure AD. The sign in was in fact,
intended and done by that actual user when you click on confirm
safe. We will close the underlying risk and optimize
our machine learning that detects risk events. On the other hand, if you could
confirm that assign it was in fact, not performed by the
actual user. You can click on confirm compromised. When you
do this we will immediately increase the users risk to
high and provide that feedback to machine learning models.
This way those users will be automatically remediated the
next time they login because of your user risk
policy. So, we’ve covered how to utilize these risk reports and provide feedback if needed. Rajat, can you show how IT admins can be notified about the risk in their organization? Sure. As an IT admin, you want certain individuals or distribution groups to be alerted whenever users become risky. You can configure that in Identity protection. Lets go here. You go to security options of
Identity protection click on alerts and over here, you can
choose the risk threshold upon which you want to be alerted
for example. I want to be alerted whenever my users move
to medium risk in above over here, you can choose the
recipients of this alert.
These are IT admins so I'm going to select one of the IT
admins who is not part of this list and add them once I add
the IT Admin I can hit save or I can even add known it
admins or distribution groups in this list. So I'm going to
add secops@wingtiptoysonline.com as one of the distributions groups I want to be alerted. Hit save and you're done. Every time a user moves to medium risk or above in my organization I will be notified and all these recipients as well. In addition to the user at risk detected alert I can even enable an
Identity Protection weekly digest by clicking here. It's a very simple process. All you
need to do is toggle this to on, select the recipients. Just
like you did earlier and had save. Every Tuesday morning. You
will get a summary of all risk detected in your organization
in your mailbox with the subject Azure AD Identity Protection
Weekly Digest. It is that simple. We hope this video helps you gain value from
and identity protection and better protect users in your
environment. We'd love to hear your feedback on identity
protection. Once you've had a chance to check it out. Share
your feedback at aka.ms/identityprotectionfeedback
As we shared today we are constantly making
improvements to identity protection. To stay up to date
with the latest and greatest changes, check out our documentation by
visiting aka.ms/identityprotectiondocs