A lot of organisations that use Microsoft Office 365 apply various protection methods to stop malware, spam, and viruses, but they are still vulnerable to sophisticated on-premises threats and attacks. These organisations need a defence system that is easy to use and cost-effective.

Organisations link their personal networks to Microsoft 365 so that their users, devices, and applications can have benefits. However, these private networks can be compromised, that may lead to dire consequences. And there are examples showing that on-premises compromise can spread to the Cloud.

Now, because Microsoft 365 acts as the vital system for many companies, it is essential to protect it from compromised on-premises infrastructure- but how?

You can configure your systems to protect your Microsoft 365 cloud environment from on-premises compromise and for that take care of the threat vectors

Primary Threat Vectors

Microsoft 365 cloud environment is packed with extensive monitoring and security infrastructure.

While linking on-premises infrastructure to Microsoft 365, many companies trust on-premises components for necessary authentication. But, if the on-premises environment is not protected well, attackers may easily compromise Microsoft 365 environment.

And the two primary threat vectors that can grant an attacker access to your cloud are-

• Federation Trust Relationships

They are used to authenticate to Microsoft 365 through your on-premises Identity Infrastructure. Stop federation trust relationships for authentication to Microsoft 365.

• Account synchronisation

This can be used to alter privileged users or groups granted administrative privileges in Microsoft 365. Ensure that synchronised objects hold no privileges beyond a user in Microsoft 365.

Make sure these objects have no direct assignment in trusted cloud groups/roles.

Protecting Microsoft 365 from on-premises compromise

Address these threat vectors by-

1.     You are entirely isolating your Microsoft 365 administrator accounts.

They should be-

• Mastered in Azure AD
• Accessed only by employing Azure Managed Workstations
• Protected by Azure AD access
• Validated with multi-factor authentication

2.      Managing Devices from Microsoft 365

You can employ Azure AD Join and cloud-based solutions to stop dependencies on your on-premises device management infrastructure that can hamper security controls.

3.      Privileged Cloud Roles Restrictions

Accounts retrieving on-premises apps that need particular authentication require an account in the organisation’s on-premises identity infrastructure.

Ensure that these accounts, including service accounts, are not included in privileged cloud roles or groups and protect the integrity of your cloud environment.

4.      Use Azure AD cloud authentication

Always use strong authentication to stop dependencies on on-premises credentials.

Checking the Environment

Now that you have enabled your environment to defend Microsoft 365 from an on-premises compromise check the environment proactively.

• Proactively monitor access to your business-critical applications & resources
• All Azure AD risk events should be monitored for doubtful activity
• Define the network named locations to stay away from noisy detections on location-based signals
• Use analytics alerts to get insights on irregularity detection
• Any access using emergency access accounts must be monitored and alerts activated for investigations
• This monitoring must include, credential management, your sign-ins, updates on group memberships and application assignments

The post Protecting Microsoft 365 from On-Premises threats and attacks appeared first on Server Consultancy Ltd.