Granikos Technology Blog

Das Exchange Blog Cumulative Update für April 2017 (CU0417) fasst interessante Themen rund um Exchange Server und Office 365 (Exchange Online), Azure und Skype for Business (aka Lync) des Monats April 2017 zusammen.

Exchange Server

• Outlook for Mac in Coexistence Environment
  https://ingogegenwarth.wordpress.com/2017/04/05/ol-mac-coex/
• Using the Office365/Exchange 2016 REST API to access Mailbox data using PowerShell part 3
  http://gsexdev.blogspot.com/2017/04/using-office365exchange-2016-rest-api.htmlhttp://gsexdev.blogspot.com/2017/04/using-office365exchange-2016-rest-api.html
• List the users that have Automapping enabled for a given mailbox
  https://blogs.technet.microsoft.com/exovoice/2017/04/25/list-the-users-that-have-automapping-enabled-for-a-given-mailbox/

Office 365 & Exchange Online

• [STICKY] Office 365-Trust Center
  http://bit.ly/Office365TrustCenter
• [STICKY] Office 365 URLs and IP address ranges
  http://bit.ly/Office365URLsIPaddresses
• Office 365 Support and Recovery Assistant (aka SaRA)
  http://diagnostics.office.com/
• AAD Connect Version 1.1.484.0 Released
  http://www.expta.com/2017/04/aad-connect-version-114840-released.html
• Using Azure B2B to invite external users to SharePoint Online
  http://artokai.net/2016/SPOnlineAndAzureB2B/
• New step-by-step deployment for Office 365 federated authentication in Azure
  https://blogs.technet.microsoft.com/solutions_advisory_board/2017/04/25/new-step-by-step-deployment-for-office-365-federated-authentication-in-azure/
• Recover deleted items from a group mailbox in Office 365
  https://blogs.technet.microsoft.com/exovoice/2017/04/26/recover-deleted-items-from-a-group-mailbox-in-office-365/
• Connect to Office 365 services with multifactor authentication (MFA) and PowerShell
  https://blogs.technet.microsoft.com/solutions_advisory_board/2017/04/27/connect-to-office-365-services-with-multifactor-authentication-mfa-and-powershell

Skype for Business, Lync Server & Communication

• Lync 2013 / SfB 2015 Client Update – April 2017
  https://greiginsydney.com/lync-2013-sfb-2015-client-update-april-2017/
• Skype Online – How To Create and Apply Dial Plans
  http://blogs.perficient.com/microsoft/2017/04/skype-online-how-to-create-and-apply-dial-plans/

Microsoft Azure

• [STICKY] Microsoft Azure Trust Center
  http://azure.microsoft.com/en-us/support/trust-center
• Azure Architecture Center
  https://docs.microsoft.com/en-us/azure/architecture/
• Hybrid and Networking Cloud Architecture posters updated for the SharePoint Server 2016 in Azure scenario
  https://blogs.technet.microsoft.com/solutions_advisory_board/2017/04/03/hybrid-and-networking-cloud-architecture-posters-updated-for-the-sharepoint-server-2016-in-azure-scenario/

Cloud Themen & Cloud Sicherheit

• [STICKY] Microsoft Security TechCenter
  http://technet.microsoft.com/de-DE/security/dd252948
• Microsoft releases biannual transparency reports
  https://blogs.microsoft.com/on-the-issues/2017/04/13/microsoft-releases-biannual-transparency-reports
• Consistency is the cure for Hybrid Cloud complexity
  https://blogs.technet.microsoft.com/hybridcloud/2017/04/12/consistency-is-the-cure-for-hybrid-cloud-complexity/
• New federated authentication for Office 365 Test Lab Guide
  https://blogs.technet.microsoft.com/solutions_advisory_board/2017/04/17/new-federated-authentication-for-office-365-test-lab-guide/
• Earning your trust with contractual commitments to the General Data Protection Regulation
  https://blogs.microsoft.com/on-the-issues/2017/04/17/earning-trust-contractual-commitments-general-data-protection-regulation
• Why Hybrid Cloud Monitoring Is Essential for Your Entire Network
  https://www.paessler.com/blog/why-hybrid-cloud-monitoring-is-essential-for-your-entire-network
• Integrated management and security across your hybrid cloud
  https://blogs.technet.microsoft.com/hybridcloud/2017/04/19/integrated-management-and-security-across-your-hybrid-cloud/

Allgemein

• PowerShell Basics: Detecting if a String Ends with a Certain Character
  https://blogs.technet.microsoft.com/canitpro/2017/04/26/powershell-basics-detecting-if-a-string-ends-with-a-certain-character/
• SNMP Deep Dive - How SMI contributesto SNMP
  https://www.paessler.com/blog/snmp-deep-dive-how-smi-contributes-to-snmp

Replay

• März 2017: How to Self-Elevate a PowerShell Script
  http://www.expta.com/2017/03/how-to-self-elevate-powershell-script.html

Podcast Empfehlungen

• Exchange Exposed
  http://bit.ly/ExchangeExposedPodcast

Tools

• Mailscape 365 - Exchange Online Monitoring und Reporting
  http://www.granikos.eu/de/mailscape365
• Mailscape - Exchange Monitoring und Reporting
  http://www.granikos.eu/de/mailscape
• Uniscope - Lync Monitoring und Reporting
  http://www.granikos.eu/de/uniscope
• Compass - Active Directory Monitoring und Reporting
  http://www.granikos.eu/de/compass
• ForeSite - SharePoint Monitoring und Reporting
  http://www.granikos.eu/de/foresite
• ISESteroids - PowerTheShell
  http://www.powertheshell.com/isesteroids/

Gerne unterstützen wir Sie bei der Planung und Durchführung Ihrer Exchange Server Implementierung oder Migration.

Sie denken über einen vollständigen Wechsel zu Office 365 oder eine Hybrid-Konfiguration mit Office 365 nach? Wir beraten Sie umfassend und ausführlich über die Möglichkeiten der Office 365 Plattform.

Sie möchten mehr über Exchange Server 2016 erfahren? Gerne erläutern wir Ihnen die technischen Änderungen und Chancen für Ihr Unternehmen in einem persönlichen Workshop.

Weitere Informationen zu unseren Dienstleistungen finden Sie auf unserer Website (https://www.granikos.eu) oder Sie kontaktieren direkt unser Vertriebsteam: info@granikos.eu

Microsoft bietet mit dem Microsoft Azure Trust Center eine zentrale Anlaufstelle, um sich über Compliance Zertifizierungen, authorisierte Dienstleister oder zum Thema Sicherheit in Azure zu informieren.

Im Bereich Resources stehen zahlreiche Best Practices und weitere Anleitungen zur Verfügung, um die Sicherheit eigener Azure Applikationen zu verbessern.

In dieser Woche hat Microsoft eine aktualisierte Liste der Dienstleister veröffentlicht, die mit Kundendaten in Azure arbeiten dürfen. Neben der Information, um welche Dienstleister es sich handelt, wird zusätzlich aufgezeigt, welche Funktionen/Rollen die einzelnen Dienstleister wahrnehmen.

Links

• Azure Trust Center
• Azure Compliance Zertifizierungen
• Azure Trust Center - Resources
• Externe Dienstleister in Azure

Haben Sie Fragen rund um Azure oder planen Sie bereits konkret den Einsatz von Azure Diensten in Ihrem Unternehmen? Sprechen Sie uns an: info@granikos.eu  

Das Blog Cumulative Update für April 2019 (CU0419) fasst interessante Themen rund um Cloud Sicherheit, Exchange Server, Office 365, Azure und Microsoft Teams des Monats April 2019 zusammen.

Exchange Server

• Outlook License Requirements for Exchange Features
• Installing Exchange Server 2019 on Windows Server 2019 Core - Notes From The Field
• Pro und Contra von "Floating"-Postfachdatenbanken
• Exchange Deployment: LDAP Policies Considerations
• Introduction to Public Folder Hierarchy Sync

Microsoft 365 | OneDrive | Exchange Online | and more

• Office 365 Network Performance Tool
• Office 365 Support and Recovery Assistant (aka SaRA)
• [STICKY] Office 365 URLs and IP address ranges
• [STICKY] Office 365-Trust Center
• New to Microsoft 365 in April - new tools to streamline compliance and make collaboration inclusive and engaging
• Read Only And Document Download Restrictions in SharePoint Online
• The new Mail.ReadBasic permission for the Microsoft Graph API and how to put it to use
• The 100 migration batches limit and how to not run into it
• Introducing the new migration experience from Google G Suite
• Save Time! Have All Your Meetings End Early
• Too Many Folders To Successfully Migrate To Exchange Online
• OneDrive | Update for GPO team site libraries to sync automatically
• Secure your mobile email with Microsoft EMS and Microsoft Outlook for iOS and Android
• Office 365 PowerShell Module Installs
• Exchange Online - Modern Authentication and Conditional Access Updates

Microsoft Teams

• Surface Hub update history
• Instructor-led training for Microsoft Teams
• Teams Direct Routing with an AudioCodes SBC
• Skype for Business Server 2015 Cumulative Update Gives Additional Teams Migration Options
• What is a/are Microsoft Teams Rooms?
• Take actions right from messages in Microsoft Teams
• Episode #33 – Interview w/ Laurie Pottmeyer Sr. Program Manager journey to Microsoft Teams
• More Microsoft Teams Training modules for IT Pros

Skype for Business Server | Communications

• Download: Skype for Business Network Assessment Tool
• Lync / Skype for Business Call Detail Report
• Lync 2013 / SfB 2015 Client Update – April 2019

Microsoft Azure

• Virtual Machines Licensing FAQ
• Azure Architecture Center
• [STICKY] Microsoft Azure Trust Center
• Deploy to Azure using GitHub Actions

Cloud | Cloud Sicherheit

• [STICKY] Microsoft Security TechCenter
• Increasing transparency and customer control over data
• Implement Azure AD two-factor authentication for users
• Detecting LDAP based Kerberoasting with Azure ATP
• Discover and manage shadow IT with Microsoft 365
• Azure Active Directory Password Protection - now generally available
• Step 8. Protect your documents and email: top 10 actions to secure your environment
• Secure access to your enterprise with Microsoft 365 Enterprise E5

Docs | Knowledge Base | TechNet

• Getting started with the Cloud Adoption Framework
• Manage resource accounts in Microsoft Teams
• Microsoft Teams IT architecture and telephony solutions posters

Allgemein

• Microsoft Products Reaching End of Support for 2019
• Microsoft Edge on iOS and Android now supports conditional access and single sign-on
• Going Down the Right %PATH% with PowerShell
• LDAP Reconnaissance - the foundation of Active Directory attacks
• Connecting Ubiquiti Unifi USG to Azure via VPN
• The language of InfoSec
• Blog Cumulative Update März 2019

Replay

• März 2017: Cross-Forest Free Busy with Shared Namespace

Podcast Empfehlungen

• Exchange Exposed

Tools

• ADFS Rapid Restore Tool
• Active Directory Migration Tool version 3.2
• Microsoft Azure, Cloud and Enterprise Symbol / Icon Set - Visio stencil, PowerPoint, PNG, SVG
• ISESteroids - PowerTheShell
• Mailscape 365 - Exchange Online Monitoring und Reporting
• Mailscape - Exchange Monitoring und Reporting
• Uniscope - Lync Monitoring und Reporting
• Compass - Active Directory Monitoring und Reporting
• ForeSite - SharePoint Monitoring und Reporting

Gerne unterstützen wir Sie bei der Planung und Durchführung Ihrer Exchange Server Implementierung oder Migration.

Sie denken über einen vollständigen Wechsel zu Office 365 oder eine Hybrid-Konfiguration mit Office 365 nach? Wir beraten Sie umfassend und neutral über die Möglichkeiten der Office 365 Plattform und Microsoft 365.

Sie möchten mehr über Exchange Server 2019 erfahren? Gerne erläutern wir Ihnen die technischen Änderungen und Chancen für Ihr Unternehmen in einem individuellen Workshop.
Sie möchten mehr über Exchange Server 2019 lernen? Werfen Sie einen Blick in das Buch "Microsoft Exchange Server 2019: Das Handbuch für Administratoren".

Weitere Informationen zu unseren Dienstleistungen finden Sie auf unserer Website (https://www.granikos.eu) oder Sie kontaktieren direkt unser Vertriebsteam: info@granikos.eu

Am 16. April 2020 trifft sich die Microsoft Teams Meetup Gruppe Berlin zu ihrem siebten Treffen.

Bei unseren Meetup-Treffen sprechen wir über Microsoft Teams als universelle Plattform zur Zusammenarbeit als Teil einer Modern Workplace-Strategie. Hierzu gehören das Teilen und gemeinsame Arbeiten an Dokumenten, Audio- und Video-Kommunikation, Telefonie und die Erweiterbarkeit durch Applikation, Bots und weitere Schnittstellen.

Agenda

• Erfahrungsaustausch zum Remote Arbeiten in Zeiten von COVID-19 (Mit welchen Tools, Tipps & Tricks, Pro & Contra)
• Automatisierte und standardisierte Team-Erstellung mit Power-Automate und Microsoft Graph - Christian Olschewski (geplant)
• Neuerungen und Weiterentwicklungen von Microsoft Teams
• Planungen zum Teams Meetup

Termin

• 16. April 2020
• 18:00 Uhr
• Online-Meeting in Microsoft Teams
   
• Registrierung via Meetup

Links

• Mitglied der Microsoft Teams Meetup Gruppe Berlin werden

Viel Spaß mit Microsoft Teams!

What is agile?

Today we start with our  short series about agile Project Management with this first article.

Agile Project Management - The "evil dark method" which opposes the good old Waterfall Model!

Nowadays almost everyone (at least in IT environments) talks about agile project management methods.
Some already checked them out, but often enough there are some counter positions to these methods which are related to some unclear things within the methodology.

This small series will try to describe in detail what agile project management is and what are the success factors.

First of all: agile project management is a methodology and a mindset! It is NOT a strictly designed process, which will solve problems magically.
Key points of "agile" are:

• Individuals and interactions over processes and tools

• Working software over comprehensive documentation

• End User collaboration over contract negotiation

• Responding to change over following a plan

Agile Project management works iterative, the product AND the process will be reviewed and optimized after each iteration

The highly collaborative structure focuses on teamwork and end user transparency as in showing actual project progress or problems which slowed down the progress

At the end of each iteration there will be a product increment which can be used by the customer, this creates actual value and ROI even before the end of the project

• Individuals and interactions over processes and tools

  • Changing requirements & environment
  • Misunderstanding of requirements
  • Scope creep
  • Change of resources
  • Lack of communication between End User and IT

    
Agile Project management can be used in nearly all custom development projects.

However there are certain scenarios where agile might not be the to-go option:

    
If your project has 100% fixed requirements, which will surely not change during the project (by the way...just because they are written down, it does not mean they are fixed!)…

If you roll out "commercial off-the-shelf" software, which is already packaged and automatically distributed (think about MS Office for example)...
If your project deals with upgrading or patching a system…
 
… then agile might not be the right approach.
 
If you are thinking about doing your own agile project it is highly recommended to involve an already agile-experienced colleague as an "Agile-Coach".
He can help you to set up the process and working mode and help to get a clear understanding what agile is about.
 
Here are some doubts which are quite common regarding agile methods:
 

A project manager or End User might say:

• "Agile is chaos! The outcome and the goal of the project is not clear!"
  • The working mode is actually very structured and strict. There is a vision for each iteration and the project itself. This vision is the basis for the outcome of the iteration or project.
• "I am unsure about what do i get when?"
  • After each iteration there will be a product increment which can potentially be used by the customer. It contains the most important functions, as they are implemented according to the prioritization.
• "I am already doing agile projects all the time!"
  • Today's requirements to IT basically can't be served by following the waterfall model. This might be the reason you are already agile in a way. It still might be useful to include more agile working methods, to actually work agile and not "pseudo-agile".

The QM-People might say:

• "Where is the documentation?"
  • Each project creates their own "Definition of Done", which has to be completed for each requirement. This also includes necessary documentation of what was actually done. Furthermore the current project management process is in rework. After the rework it will also include agile projects and therefore also give requirements for documentation.

The developer might say:

• "There are too many meetings!"
  • If you don't think that the meetings benefit to your project - just don't do them. Agile is based on customizing and optimizing the process. If you realize later on that the meetings were actually useful - just do them again. It is YOUR agile way of working, not a "set-in-stone" process.
• "I can't commit my workload for the next two weeks!"
  • If you can't commit your workload for just two weeks, then how can you commit on a project which has a duration of multiple months?
  • If you are not able to commit on your work, this might also show the organization in which areas there are resources missing.

The team lead might say:

• "This won't fit to my area"
  • Discuss the approach with your customers or try it out if possible. If the customer and developer satisfaction is lower than usually, or the efficiency of the project was lower - stick to what works best for you.
  • By trying out we mean that you try the approach in a smaller project, to see if it makes sense for you. It is highly recommended to include an "Agile-Coach" who helps you to set up the project and to integrate agile methods into your work.

This was the first part of our small Series about Agile Project Management. Look out for the next part which we are going to publish soon called "Agile Project Management – What is SCRUM"

The whole Series contains 4 pieces:

Agile Project Management – Basics (Part1)
Agile Project Management – What is SCRUM (Part2)
Agile Project Management – Agile Project Management in real Life (Part3)
Agile Project Management – Agile on the next Level – Program Management (Part4)

If you have any comments on our Articles, your Feedback is highly welcome.

Different technologies are used to verify the validity of email senders. Each technology by itself represents only one component of a holistic solution. It is currently recommended to implement all three technologies.

The technologies are:

• SPF - Sender Policy Framework
  The SPF resource record of a DNS zone defines which servers (hostnames or IP addresses) are allowed to send emails on behalf of the domain. Each sender domain must have it's own SPF resource record.
   
• DKIM - Domain Keys Identified Mail
  DKIM pursues the same objective as SPF. With DKIM parts of an email, messages are encrypted using a private key. The public key is published as a DNS resource record. In most cases, the key pair is generated by the mail servers, as these encrypt the message anyway.
   
• DMARC - Domain-based Message Authentication, Reporting & Conformance
  DMARC is placed on top of SPF and DKIM. DMARC executes a so-called alignment for SPF and DKIM. An alignment defines a policy that describes how strict a receiving server (MTA) should validate and assess the sender address with SPF and DKIM. Stefan Cink of Net at Work has published a detailed post (DE) on this.

The following figure illustrates the protocol relations.

The use of SPF, DKIM, and DMARC are no substitute for email message encryption itself or transport encryption. These technologies are used to identify and asses valid senders and to protect against spam messages.

Keep in mind that SPF, DKIM, and DMARC are offerings for other emails servers. As a sending party, you do not control if and how SPF, DKIM, and DMARC are evaluated by the receiving server. But if evaluated, the configuration must be correct to avoid messages being rejected by receiving email servers.

The following sections focus on the DNS configuration for SPF, DKIM, and DMARC. This post is not intended to rate the technologies, but to describe the implementation.

SPF

Each domain is used for sending emails requires an SPF resource record (RR) in its DNS zone. An SPF record is always of the type TXT and does not use any hostname (or resource record name, if you will). An SPF RR is always valid for the entire DNS zone.

Example

mcsmemail.de.          3600     IN      TXT     "v=spf1 mx a:mail.mcsmemail.de ?all"

The following screenshot illustrates adding a new SPF TXT record in a common DNS management interface (DE) of an internet provider. The hostname textbox remains empty.

Example explained:

v=spf1
SPF Version

mx
MX server records defined within the DNS zone are valid senders

a:mail.mcsmemail.de
The additional DNS hostname defined as A resource record is a valid sender as well

?all
Neutral validation of non listed servers that send emails for this domain

SPF records can be created by using one of the various online resources.

• SPFWizard.NET
• CloudFloorDNS

DKIM

DKIM resource records are configured as TXT resource records as well. In contrast to an SPF record, a hostname is mandatory. In this case its called selector.

A DKIM TXT record is always created as a record in the subdomain _domainkey.

Example

nsp._domainkey.mcsmemail.eu. 3600 IN     TXT     "v=DKIM1\; k=rsa\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQChZM8yjegaKfd0ssKyezTW/7xbDSNc0uPd50xa5/ecerv1v3mHKM+T7mClzRmIEx+Ji6AisVeo2uvjTYPemHFMBlQpuS/4zc2QxWHqp62FSQ7lASBOzDfUrIwayPVqwSPD6NrnfVSWoUNrFGGSVeU5uLASecBzTfxPukqTHgYKhQIDAQAB"

The following screenshot illustrates adding a new DKIM TXT record in a common DNS management interface (DE) of an internet provider. The hostname textbox contains the selector nsp followed by the subdomain _domainkey.

Example explained:

v=DKIM1
DKIM version

k=rsa
Public key encryption method

p=MIGfMA....
The DKIM public key

DMARC

DMARC is configured as a TXT resource record as well. The DMARC resource record uses the fixed hostname _dmarc.

Example

_dmarc.mcsmemail.de.     3600    IN      TXT     "v=DMARC1\; p=none\; rua=mailto:DMARCRUA@mcsmemail.de\; ruf=mailto:DMARCRUF@mcsmemail.de\; fo=1\; adkim=s\; aspf=s\; rf=afrf\"

The following screenshot illustrates adding a new DMARC TXT record in a common DNS management interface (DE) of an internet provider. The hostname textbox contains always the value _dmarc.

Example explained:

v=DMARC1
DMARC version

p=none
No DMARC policy defined (You should always start with None, before switching to Quarantine or Reject)

rua=mailto:DMARCRUA@mcscmemail.de
Email address for status reports

ruf=mailto:DMARCRUF@mcscmemail.de
Email address for error reports

fo=1
Error report type

adkim=s
DKIM alignment, s = strict

aspf=s
SPF alignment, s = strict

rf=afrf
Error report message format, afrf = Abuse Report Format following RFC 5965

The DMARC policy (p) should be raised step-by-step. The results for each policy type are:

• none - No action, affected messages are part of the daily message report
• quarantine - Affected messages are marked as spam
• reject - An affected message is rejected on the SMTP layer

Recommended reading on this topic: Google Support Post.

DMARC DNS zone entries can easily be checked by using the Net at Works PowerShell tool. The PowerShell script can only be used with NoSpamProxy11+. But there are some online tools available as well.

Links

• NoSpamProxy Blog (DE): Auswertung von DMARC, DKIM und SPF Prüfungen per PowerShell
• MXToolbox
  • SPF Lookup
  • DKIM Lookup
  • DMARC Lookup
• More on SPF
  The website OpenSPF.org is not available anymore. If you want to know more about SPF, read more at MailBird. 
• More on DKIM
• More on DMARC
• Prevent outgoing spam with DMARC
• DNS management interface screenshots are courtesy of HKN

Do you need assistance with your Exchange Server setup? You have questions about your Exchange Server infrastructure and going hybrid with Office 365?

Contact us at office365@granikos.eu or visit our website http://www.granikos.eu.