Episode 193 – Organize All The Things With Project Moca

In Episode 193, Ben and Scott talk about how to protect your organization with Exchange Online transport rules and prevent the forwarding of messages from other applications like Power Automate. They also talk about Project Moca and how it can be used to organize your personal information through Outlook on the web. Transcript Email Download New Tab - Welcome to episode 193 of the "Microsoft Cloud IT Pro Podcast," recorded live, August 31st, 2020. This is a show about Microsoft 365 in Azure, from the perspective of IT pros and end users. Where we discuss a recent topic or news and how it relates to you. In this episode, Ben and Scott spend some time talking about email exfiltration and security, new features coming for Windows security, that relate to advanced threat protection, Microsoft 365 business. And then we would be remiss if we didn't talk about Moca, Project Moca that is. A new feature coming to Outlook on the web. So let's dive in. - The bites and the bits they make a difference. - They do make a difference. So should we talk about news today? We have a whole bunch of topics we've talked about that we've had, and haven't talked about, all of that. - Yeah, let's do it. - All right, take your pick. You had a few that you had on our list that we haven't talked about. So I'll let you kick it off this week. - Yeah, let's talk about email exfiltration controls for Office 365 connectors. - Perfect, I like that, anything that prevents email from going out if it shouldn't, it's a good thing right, email security? - Yes. - So what are these exfiltration filters that have been rolled out? - So you can do things now, well, they've added extra headers to messages from certain services. So you have things now, like there's an XMS mail application header. And that header might be set to a string value such as Microsoft Power Automate. So you could take something like that and create a transport rule in exchange online, which says all emails that come from Power Automate, now go through this filter chain. So maybe they can be sent to external people. So that's kind of cool and you can extend that and take it forward a little bit. There's also an XMS Mail operation type header, which will have values like forward, reply, send, things like that. So you can potentially like take either or one of those rules and either say, we're going to have rules that execute against a particular application. Like your business needs to keep sensitive information internal, and you never want a Flow in Power Automate to send an email to the outside world no matter what your users say, well, you can do that. Or you can also do things like look for purely forwarded messages going through your system and not even allow things like that. Or combine those two together. If Power Automate is logging into my mailbox and forwarding messages, stop it. Like just kill it at the edge with the transport rule. Which is kind of fun. - So with this, yeah, so this transport rule and the new headers could I now do something like if somebody clicks reply to all on a message that has 250 participants, tell them to stop doing that? - I don't think you can stop the whole thing. There's no great thing for that-- - It's not gonna stop. - buttons that vendors make and put in your mail client but really you just have to teach people better behaviors. - Yes, no amount of technology can fix certain behaviors of people. - No. - That is really nice because there's a lot, as people are using Flow and PowerApps and all of this more, I mean, even I've built stuff for my clients where it is automatically sending out information, it's logging information. Microsoft is putting those technologies in the hand of end users and they might not always realize what they're doing when they create certain Flows. So being able to put some rules in there that looks at the source of these emails, whether it be PowerApps Flow, or I don't know how many it's extended out to, or if it will start extending out to other areas. Definitely a good thing to have for email security. - Yeah, it's interesting. 'Cause it takes this SAS world where, for better or worse, we all feel like we're in less control and it puts some of that control back in, kind of that governance plane or that administrative plane for the product. I don't know that, like so yes it solves the problem of email exfiltration. It doesn't solve the problem of you having to go to your user community and continue to educate them and let them understand the rules that drive the business. Like this is not a feature that goes into Power Automate and says you can never create a Flow with a forwarding rule that goes outside your organization. Like that type of governance doesn't exist there. So now, you might go and implement something like this, but then from a user adoption plane, they could still be going out and creating all these types of things. So I would maybe want to extend that with some reporting and take a look and so if you do set up rules like this, like where are we blocking it? Who was the person or the process that sent it? So that we can go educate them and kind of have a talk and see like hey, are we meeting the needs of the business? Or, did we potentially make things worse? - Yeah, definitely. And it does, that ties in. So I actually had an experience. It wasn't with PowerApps or Flow, but this past, I think it was this past week, where I had a client come to me and say, "Hey, I just had a user set up a mail forwarding rule. "What's going on, can you look it up?" Come to find out, said user of said client clicked on some type of malicious malware that automatically went into her Outlook on the web. So this wasn't even like a Outlook on-prem rule. It was Outlook on the web. So I don't know if it was the whole, I'm signed in, in one tab, I opened it in another tab and created this Outlook on the web rule but I was able to go in through all the audit logs to create an Outlook on the web rule to automatically forward email with certain information in it to some external email address. Fortunately, we had actually set up a mail Flow rule that said, do not allow people to set up rules that forward mail externally. And it prevented this whole fiasco where certain confidential information could have been forwarded. So the nice thing is the rule worked, it caught it all. It didn't allow this rule to be forwarded. And as a result, no mail got forwarded out. But also with all of the unified audit logs, the mail tracing all of the security features available in Office 365, we could also go through and show exactly what had happened. Walk through the, get a good idea of what happened as well as verify that they indeed were protected. - Yeah, so the other thing that I've done in the past there is you, probably want to implement process, like again on top of your transport rules to do things like, just run a PowerShell script that audits everyone in your exchange org. And if they have a forwarding address set on their mailbox, let's bubble that back up and report it. 'Cause you might be killing those things, like you said, on the edge with the transport rule, but that hasn't solved the underlying problem that somebody clicked a malicious link and a grease monkey script came in and did all this stuff and set up emails to forward out. So, you've got two things. Like yeah, was there a rule there? Or was there an all up forwarder placed on the mailbox as well? And what does that look like? So that can manifest itself in a couple different ways. Like I always like just have a script that runs on a cadence and enumerates all the mailboxes and anybody who has a forwarder set to an external domain or something that's external to your organization, you wanna know about that. You don't always need to know about, the manager who picked up somebody's mailbox for the next 30 days and has a forwarding rule in place there. - Right, although in theory, should that be a fowarding rule or should that just be delegated access to the user's mailbox? - Oh, well . That all depends on how people know, how much people know about how to use email. - It is true, so another one that Microsoft actually recently announced in the middle of all of this, so while, I was dealing with this with a client, I also noticed a new message in my message center, linked to a Microsoft 365 roadmap item, where Microsoft is also adding a outbound spam policy rule to block external forwarding for select people in their organization. So this allows you to kind of, with your scenario is, if a certain user does need a forward mail externally or has an external mail forwarding rule on because there probably are some cases where that's necessary, you will now be able to use your anti-spam rules up on anti-spam policies in Office 365 advanced threat protection in their spam policies to block it at that level on a per user basis. So even more interesting announcements and features coming around blocking that mail forwarding data exfiltration. - Yeah, I mentioned this stuff kits, the Math changes a little bit with everybody being at home and any time any device kind of policies and having, you have to shut more of this stuff down at the edge this way. So it's good to see that come out as a native control and not requiring a third party or anything like that. - Right, 'cause there's, going back to the whole work from home. There's probably a lot of companies that have certain proxy filters set up, different edge devices set up for people when they're in the organization. That protect against this stuff and all of a sudden people are at home maybe may or may not be working on a company on device, may or may not be going through your company's network. And, let's be honest when people are at home,...