Azure 3 | Thibault Chatiron

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 222, 223 and 224

Updated severity levels for Defender for Cloud Apps anomaly detectionsThe severity levels for Defender for Cloud Apps built-in anomaly detection alerts are being changed to better reflect the risk level in the event of true positive alerts. The new severity levels can be seen in the policies page: https://portal.cloudappsecurity.com/#/policy

Sensitivity labels now apply to modified documents

If you’ve configured users for a default sensitivity label policy for Office documents, the label you chose will automatically be applied to Word, Excel, and PowerPoint documents you create or modify. Previously, this only applied to new documents only. Note: This update applies to Word, Excel, and PowerPoint on the Web, and Word and PowerPoint on …

Retirement announcement for AIP Audit Logs pipeline forwarding audit logs to Azure Log Analytics workspaces

Microsoft will no longer be onboarding new Log Analytics workspaces to store Azure Information Protection (AIP) audit logs. Note: Customers who have previously configured Log Analytics to store AIP audit logs will continue to receive forwarded audit logs into their workspaces until the data pipeline is fully retired. When this will happen: Microsoft will stop …

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 221

Egnyte app connector available in public previewA new app connector for Egnyte is available in public preview. You can now connect Microsoft Defender for Cloud Apps to Atlassian to monitor and protect users and activities. For more information, see Connect Egnyte to Microsoft Defender for Cloud Apps (Preview).

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 220

New Cloud discovery log collectorThe Cloud Discovery log collector has been updated to Ubuntu 20.04. To install it, see Configure automatic log upload for continuous reports.

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 218 and 219

Atlassian app connector available in public previewA new app connector for Atlassian is available in public preview. You can now connect Microsoft Defender for Cloud Apps to Atlassian to monitor and protect users and activities. For more information, see Connect Atlassian to Microsoft Defender for Cloud Apps (Preview).

Continuous Access Evaluation in Azure AD [General Availability]

CAE introduces real-time enforcement of account lifecycle events and policies, including: Account revocation Account disablement/deletion Password change User location change User risk increase On receiving such events, app sessions are immediately interrupted and users are redirected back to Azure AD to reauthenticate or reevaluate policy. With CAE, Microsoft has introduced a new concept of Zero …

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 216 and 217

Non-Microsoft activities in advanced huntingNon-Microsoft apps activities are now included the CloudAppEvent table in Microsoft 365 Defender advanced hunting. For more information, see the Microsoft 365 Defender Tech Community blog post. NetDocuments API connector is now in general availabilityThe NetDocuments API connector is in general availability, giving you more visibility into, and control over, how your NetDocument app is …

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 214 and 215

NetDocuments app connector available in public previewA new app connector for NetDocuments is available in public preview. You can now connect Microsoft Defender for Cloud Apps to NetDocuments to monitor and protect users and activities. For more information, see Connect NetDocuments to Microsoft Defender for Cloud Apps. Reset user investigation priority scoreThe user investigation priority score …

Microsoft Cloud App Security – Release 212 and 213

Impossible travel, activity from infrequent countries, activity from anonymous IP addresses, and activity from suspicious IP addresses alerts will not apply on failed logins.After a thorough security review, Microsoft decided to separate failed login handling from the alerts mentioned above. From now on, they’ll only be triggered by successful login cases and not by unsuccessful …

Microsoft Cloud App Security – Release 209, 210 and 211

Slack API connector is now in general availabilitySlack API connector is in general availability, giving you more visibility in to, and control over, how your app is used in your organization. For more information, see How Cloud App Security helps protect your Slack Enterprise. New warn experience for monitored apps with Microsoft Defender for Endpoint is …

Microsoft Cloud App Security – Release 206, 207 and 208

New Cloud Discovery Open Systems log parserCloud App Security’s Cloud Discovery analyzes a wide range of traffic logs to rank and score apps. Now Cloud Discovery includes a built-in log parser to support the Open Systems format. For a list of supported log parsers, see Supported firewalls and proxies. New warn experience for monitored apps with …

Azure Sentinel – IdentityInfo table [Public Preview]

Prerequisite Enable UEBA – Use entity behavior analytics to detect advanced threats If already have UEBA enabled, you will notice that a new table called ‘IdentityInfo’ is now available under ‘Azure Sentinel UEBA’ group in your Log Analytics. The Identity info table contains a snapshot of the user’s profile: metadata information, groups membership, Azure AD …

Azure Sentinel – Watchlist [General Availability]

The 12th July, Microsoft has announced the General Availability (GA) of Azure Sentinel Watchlist to all regions! Azure Sentinel watchlists enable the collection of data from external data sources for correlation with the events in your Azure Sentinel environment. Watchlists are stored in your Azure Sentinel workspace as name-value pairs and are cached for optimal …

Azure Sentinel – Update Watchlist UI Enhancements

The new watchlist UI encompasses the following functionality: Add new watchlist items or update existing watchlist items. Select and update multiple watchlist items at once via an Excel-like grid. Add/remove columns from the watchlist update UI view for better usability. How to update watchlist From the Azure portal, navigate to Azure Sentinel > Configuration > Watchlist  Select a Watchlist, then select Edit Watchlist …

AIP – DLP On-Prem [Public Preview]

The DLP on-premises scanner crawls on-premises data-at-rest in file shares and SharePoint document libraries and folders for sensitive items that, if leaked, would pose a risk to your organization or pose a risk of compliance policy violation This gives you the visibility and control you need to ensure that sensitive items are used and protected properly, and to …

AIP – Track and Revoke [General Availability]

Document tracking provides information for administrators about when a protected document was accessed. If necessary, both admins and users can revoke document access for protected tracked documents. This feature is available for AIP UL client version 2.9.111.0 or later

MIP – DLP Alerts [General Availability]

Microsoft announces the General Availability of the Microsoft Data Loss Prevention Alerts Dashboard. This latest addition in the Microsoft’s data loss prevention solution provides customers with the ability to holistically investigate DLP policy violations across: Exchange SharePoint Online OneDrive Teams Devices Cloud apps On-premises file shares Learn more about the feature at: Learn about the data loss prevention Alerts …

MIP – Dynamic Markings with Variables within native labeling across all platforms [General Availability]

Configure sensitivity labels for content markings by using variables in the text string for your header, footer, or watermark Read more about the feature at Manage sensitivity labels in Office apps – Microsoft 365 Compliance | Microsoft Docs

MIP – AIP Audit Logs in Activity Explorer [Public Preview]

Azure Information Protection client audit logs are now available in Activity Explorer for existing AIP Analytics customers and this functionality is in public preview. Read more about Activity Explorer audit events at: https://docs.microsoft.com/en-us/microsoft-365/compliance/data-classification-activity-explorer?view=o365-worldwide This preview requires registration via: https://aka.ms/Register-AIPActivityExplorerPublicPreview

Cookie	Duration	Description
__gads	1 year 24 days	The __gads cookie, set by Google, is stored under DoubleClick domain and tracks the number of times users see an advert, measures the success of the campaign and calculates its revenue. This cookie can only be read from the domain they are set on and will not track any data while browsing through other sites.
_ga	2 years	The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors.
_gid	1 day	Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously.
CONSENT	2 years	YouTube sets this cookie via embedded youtube-videos and registers anonymous statistical data.

Cookie	Duration	Description
ANONCHK	10 minutes	The ANONCHK cookie, set by Bing, is used to store a user's session ID and also verify the clicks from ads on the Bing search engine. The cookie helps in reporting and personalization as well.
IDE	1 year 24 days	Google DoubleClick IDE cookies are used to store information about how the user uses the website to present them with relevant ads and according to the user profile.
MUID	1 year 24 days	Bing sets this cookie to recognize unique web browsers visiting Microsoft sites. This cookie is used for advertising, site analytics, and other operations.
test_cookie	15 minutes	The test_cookie is set by doubleclick.net and is used to determine if the user's browser supports cookies.

Cookie	Duration	Description
_clck	1 year	No description
_clsk	1 day	No description
ApplicationGatewayAffinityCORS	session	No description available.
CLID	1 year	No description
GoogleAdServingTest	session	No description
LiSESSIONID	session	No description available.
LithiumUserInfo	past	No description
LithiumUserSecure	past	No description
LithiumVisitor	1 year	No description available.
original_req_url	past	No description
SM	session	No description available.
SRM_B	1 year 24 days	No description available.

Category: Azure

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 222, 223 and 224

Sensitivity labels now apply to modified documents

Retirement announcement for AIP Audit Logs pipeline forwarding audit logs to Azure Log Analytics workspaces

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 221

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 220

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 218 and 219

Continuous Access Evaluation in Azure AD [General Availability]

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 216 and 217

Microsoft Defender for Cloud Apps (formerly MCAS) – Release 214 and 215

Microsoft Cloud App Security – Release 212 and 213

Microsoft Cloud App Security – Release 209, 210 and 211

Microsoft Cloud App Security – Release 206, 207 and 208

Azure Sentinel – IdentityInfo table [Public Preview]

Azure Sentinel – Watchlist [General Availability]

Azure Sentinel – Update Watchlist UI Enhancements

AIP – DLP On-Prem [Public Preview]

AIP – Track and Revoke [General Availability]

MIP – DLP Alerts [General Availability]

MIP – Dynamic Markings with Variables within native labeling across all platforms [General Availability]

MIP – AIP Audit Logs in Activity Explorer [Public Preview]

Thibault CHÂTIRON

Follow Blog via Email

Recent Posts

Categories

Archives