Hello, and welcome to another episode of the
Everyday Defender podcast. I'm your host, Chris
Goosen. It's episode nine, and I'm joined as
always by my friend from the Netherlands, Kos.
How are you, sir? Hey, Chris. How are you doing?
Howdy. We're approaching the end of the season,
I think already, right? Yeah, well, we're getting
there. And, you know, it's my most exciting time
of the month is when I get to, when I know that
I'm... going to be recording with you in the
afternoon and you know we're going through the
the prep and all that type of stuff it's a super
exciting time so um you know really really excited
to be back again and uh and talking to you today
Also, I should say congratulations. MVP renewals
have just happened a few weeks ago and congrats
for your renewal and continuing to be here. I
think it's obviously very well deserved given
all the great work you do in the community and
elsewhere. Thanks Chris, appreciate it. And to
you as well, you finally got into the Dutch category,
right? Finally got into the Dutch category, security
MVP. Yes, I'm very, very happy about that. It's
been a lot of hard work over the last few years
to get there. Unfortunately, the Dutch benefit
hasn't kicked in just yet. But I hope any day
now I'll wake up and be fluent. People shouldn't
expect you handing out stroopwafels at MVP Summit
next year. No, but I will consume stroopwafels
as many as possible. I'll help you out on that.
I'll get you covered. Before we get too sidetracked.
That's right. I always have tin tams at Summit.
Before we get carried away. today's episode.
Let's see what we've got. So I'm going to continue
talking a little bit about EntraSuite and some
components of EntraSuite, specifically the global
secure access component. There's a lot to unpack
there. And so I'm excited to kind of dig into
that one a little deeper. And then, Kost, what
have you got for us? Yeah, I was working on a
project recently for a customer where I got my
hands on Defender for External Attack Service
Management, so EASM. And I know people at Microsoft
call it MDEASM, like Microsoft Defender for External
Attack Service Management. It's quite a mouthful.
It's a mouthful. Say that 10 times fast, right?
But it was really interesting. I knew about the
product from a more theoretical standpoint. It
was great to get my hands on. And, well, obviously,
that's why I thought it was a nice topic for
today's episode, because I have some tips, some
practical tips for the people who are listening.
And I think... people should really look into
it. Yeah, awesome. Well, I can't wait to hear
all about that. It's something I'm not super
familiar with, so we'll get there. But if we
continue our sort of IntraSuite journey from
last episode, sort of two of the components or
two of the things that we talked about as part
of IntraSuite was what we know as Microsoft Intra
Private Access. and another component, which
is Microsoft Intra Internet Access. And together,
those things are often referred to as GSA or
Global Secure Access, which is really the sort
of Microsoft Zero Trust Network Access stuff,
right? So, you know, I love these products. I
think these things are there's a lot of potential
here. And I wanted to kind of dig into them just
a little bit more to get folks sort of across
sort of the nuances of it, right? There are some
things, some little nuances here. And again,
it's going to be one of those things where If
you're a large, complex organization, chances
are you're probably going to look at something
like Zscaler for your internet access stuff anyway,
and this isn't going to be for you. But I do
think that there's a lot of potential here for
some of the smaller orgs who are dipping their
toe in the water there and wanting to start securing
some of those internet access scenarios. hybrid
work from home type fleets where you've got a
lot of assets that are all over the place i think
this is a really good solution for you know securing
inbound and outbound right so um on the one hand
we're replacing vpns um you know for that traditional
connectivity back on prem and then on the other
hand we're protecting our sort of internet access
on on connections and networks that we don't
own, right? So if you think about grandma's house
where you've just got grandma's Wi -Fi and you're
using your corporate asset connecting into M365
or any other SaaS application, being able to
apply protection to that connection and also
maybe filter and block things that you don't
want your folks using your corporate assets to
access, right? Think about gambling and stuff
like that. So, Chris, before you continue, I'm
a big noob on this topic. I hear the term SSE,
Secure Service Edge, coming along quite a few
times as well. Is that the old name for the product?
Yeah, that is interesting. It is often referred
to as SSE. And I actually think that when they
first launched private access and internet access,
they referred to it as SSE. I think SSE is the
capability. The Secure Service Edge is their
capability. And GSA is really the product sort
of category or name of the product. That's at
least how I understand it. That's a good question,
though, because I think there's a lot of terminology
floating around everywhere and different customers.
That's right. That's right. So a couple of things,
I guess, from a requirements perspective for
GSA. We talked about... Licensing, licensing
is always a thing, right? And so there's some
nuances here. So number one, you're going to
need an EntraID P1 to begin with, right? And
then once you have the P1, you could either get
just the private or the internet access license
as an add -on, or you can get the EntraSuite
license, which includes all those other things
that we talked about in the last episode as well.
Depending on which way you want to go, I think
there's a lot of value in getting the intra -suite
licensing, but you're going to need the licensing.
Now, there is one component that doesn't require
licensing, and we'll get to that in just a second.
But that's the first thing to know. Secondly,
you're going to need the GSA client installed
on your clients for this, right? One of the things
that I found when I was sort of tinkering and
messing around with this a little bit more deeply
was that obviously the GSA client works just
great if you're using Windows or a Mac or if
you have iOS and Android, but there's no Linux
support. So don't think you're going to get,
you know, you're going to be running your Debian
or your Ubuntu Linux and installing the GSA client.
That doesn't exist just at the moment. So I'm
not sure what the plans are for that. And I think,
you know, Kosa and I were talking earlier about
this. For most organizations, probably not a
big deal. I think it's only the really hardcore
geeky folks that are probably going to miss this,
but something to be aware of, I guess, as well.
But the good thing, at least with private access,
you can at least access into your Linux servers
over the secure server, right? Well, if you have
a device... inside your network that has the
private connector installed, then yes, you can
access those services. But that private connector,
and this is the second thing, the private connector
that you have to install will also only run on
Windows. So essentially, it's an outbound only.
So if you think about segmenting your applications.
and your services you instead of punching holes
in your firewall for everything that you want
to access you have these connectors that you
install that talk outbound to to the the sse
once those connections are then made the gsa
client handles all the routing smarts and and
the policies that you set up uh to be able to
access those applications so you can make that
work but you can't you're not going to be able
to install the the private network connector
on a Linux machine or something that isn't Windows
Server. So that's the other thing to be very
much aware of there. Another thing to think about
is that your devices that you're going to use
for this, they need to be known in some way,
right? So they need to be either intra joined
or hybrid joined or sort of in tune managed or
something like that. And that's for conditional
policy, conditional access policy enforcement.
So this kind of limits, you know, those pure
BYOD environments where you have these unknown
clients. And we're going to talk a little bit
later about something called Entra App Proxy,
which, you know, is something is very similar.
And if you've been around long enough, you probably
have used or heard of Entra App Proxy. And that's
where sort of App Proxy. This builds on AppProxy,
but there are still some really good scenarios
where AppProxy is probably the better tool. And
I do want to dig into that a little bit as we
talk through this. So when we talk about GSA,
we have this sort of concept of... forwarding
profiles or traffic forwarding profiles and we're
three profiles right um and this is a really
nice sort of interesting thing to to to kind
of be aware of so um the first one is your microsoft
traffic profile and the microsoft traffic profile
is is um available to you even if you don't have
licenses for um private or internet access. You
don't need a specific or an additional license
for it. So as long as you have either business
premium or you have E3 or E5, the Microsoft traffic
profile is actually included in those. And really
what that does is it intercepts the traffic that
is specifically for Microsoft services, right?
And I really like this because I think there's
some benefit here. So for one, one of the things
you can be doing is you can be applying those
conditional access policies to... folks that
are actually accessing your, those Microsoft
services from your, your, your corporate devices.
But more importantly, what you can do is you
can, you can combine this with something called
UTR, which is universal tenant restrictions to
actually start locking down the types of tenants
or the, the tenants that your, your clients can
connect to. And if you think about one of the
gaps in, it has always been, you know, from an,
from an X fold perspective is if someone were
to, were to, uh sort of compromise a device in
your fleet on your network right and your firewall
allows access to startup microsoft .com or startupoffice
.com or one of those things well an easy way
for them to exploit data is to just go to another
tenant right log into a different tenant it's
still microsoft's environment which your firewall
which doesn't really you know isn't really inspecting
the stuff is is allowing well when you when you
combine this with um utr you can now start locking
down what tenants or tenant your clients are
actually allowed to connect to. So I think there's
some real power there, especially if you have
some really sort of lockdown environments where
you maybe have, I don't know, a dev tenant and
a production tenant, and you only want those
two tenants to be accessed from your devices,
no other tenants. So some really powerful stuff,
and that's the Microsoft Traffic Profile. It's
part of the product, and there's no additional
licensing, so you can play with this. and the
GSA client sort of now without additional licensing.
The next profile to talk about is, I guess, is
the private access profile. And private access,
as you would expect, is really as a way to provide
access to apps and systems and things that you
own within your data center. So think about traditionally
you have a VPN client installed on your machines.
Once the user fires up the VPN, they land on
a subnet that typically then allows them to access
whatever that subnet is open to. It could be
one app. It could be 10 apps that are all on
that subnet. And that's how folks work. And folks
still work like that today. I mean, this is not
that uncommon. It's a pretty common scenario.
So what private access does, it allows you to
actually grant access to applications like that
without the use of a VPN. but doing it on a per
app basis as well, right? So you can register
these apps individually within your tenant and
you can provide and apply conditional access
to these applications specifically as a workflow
to your tenant. So really, really powerful stuff.
The great thing about it is it supports sort
of all TCP and UDP protocols. So you can do IDP
across this. You can do SSH across this. You
can do SSH across this if you're not SSH into
a Linux server. That is a scenario that I myself
have tried. Obviously, you cannot install the
client onto the Linux server, so it doesn't work
so well. But I'm sure there are ways to get around
it. And it'll probably follow soon in the future,
right? I would imagine. Now, the thing is that
the private network connector, it's been around
for a long time because it's actually part of...
what used to be called Azure App Proxy was now
called Entry App Proxy, right? So it's the same
concept as you installing the client on a Windows
server, it's connecting out and making, it's
been around. I mean, I think that thing supports
anything from server 2012 onwards, right? So
it's been around for a little while. They've
never done anything to make it sort of, you know,
Linux compatible. You know, who knows? I mean,
I'm sure you don't need to have, you could probably
SSH to, if you had a Windows server with that
running, you could probably have a Linux server
that has, that's on the same subnet that, you
know, you connect to. I'm sure there will be
ways to make that work. So, but like I said,
you know, be aware of that, right? Yeah, good
to know. So we talk about, we talk about AppProxy
a fair bit. And really, private access is that
sort of evolution of what Entry App Proxy is
and was. But App Proxy isn't dead because there
are things and there are scenarios where you
may actually still want to use App Proxy instead
of private access, right? So App Proxy works
really well with web apps and HTTP, HTTPS applications,
especially when you're wanting to do some sort
of authentication. on on the connection so uh
imagine you have a web server or a web application
of some sort the web app itself doesn't have
any authentication but you want to publish that
to the internet well absolute app proxy is really
good for this because you can actually then handle
all the authentication through entra um if a
user had you know if the user is assigned to
the app and they have an intro login you can
then multi -factor them you can do all that cool
stuff and enter before passing the connection
through to to the app so for those web scenarios
especially where you have unknown devices byod
devices that are not known to you at all app
proxy still works really really well right yeah
i don't see it used being used that often to
my surprise yeah that's true that's true and
you know and again it's been around for a long
time i mean i you know um when i was i've been
digging through my lab recently with stuff and
and you know i still had an app proxy connector
group from uh from 2016 where i had published
adfs in that way right back back when adfs was
still a thing remember that so well it is still
a thing spoiler alert a lot of customers but
yeah they're using it probably not in the correct
way so i think the takeaway here is is that and
i've put a table in the in the show notes here
for anyone who wants to kind of see a quick reference
of this is like when should you use our proxy
when should you use private access i think the
takeaway really is is that um you know private
access is good when you're using something that
isn't http or https right or if you want that
vpn replacement um and you're going to handle
all your authentication stuff via the the global
secure client then that's where you want to use
private access but if you've got those unknown
scenarios maybe you've got some b2b scenarios
or legacy web app stuff um Entra App Proxy still
works and is alive and well for you. And it's
configured in a very similar way. So there shouldn't
be too much drama for you there. Chris, how does
licensing work for Entra App Proxy? I'm not familiar
with that, to be honest. Oh, that's a good question,
actually. I don't think it, well, it doesn't
require the additional licenses that you need
for private access. So it doesn't require the
Intra Suite stuff. I believe it's included just
with P1 or P2 licenses. So I think if you have
a P1. which is the same as the Microsoft traffic
profile. So just enter IDP1, which is included
with E3 and E5s, right? So there's a lot of good
value there and that would do it for you. So
the last of the traffic profiles, and this one's
pretty simple, right, is internet access. So
think about, you know, we were talking about
private access, which is granting access to applications
that you own in your data center. Well, internet
access is kind of the other way around. It's
granting access to applications that maybe you
used to learn it, maybe it's a SaaS application,
but that application is actually in the cloud,
so you're connecting outbound. Now, historically...
you would have some sort of proxy server on your
web proxy on your premises or in your office.
Your connections go through that and get proxied
outbound. Well, with the work from home scenarios
these days, that doesn't really happen all that
much anymore. And we've obviously mentioned scenarios
like Zscaler, which kind of handles this type
of thing really, really well. But that's really
what this is. It's sort of that... uh web web
secure web gateway if you will for for accessing
public services and public sas uh um you know
applications uh again being able to enforce conditional
access um on those connections so making sure
that if someone's going to access your m365 environment
you want to make sure that they're using um you
know maybe an intune enrolled device or a known
device or that type of conditional access and
granular uh control on on those outbounds but
you can also do things like web content filtering
right and and i'll say this is really really
basic stuff but you know maybe your your your
environment you you just want to filter really
basic stuff you want to filter facebook and you
know chat gpt and whatever else you don't want
your users to be using um you can do that quite
easily with this that's what it's made for right
so you can do sort of filtering by by category
or by by fgdn on this the categories i think
are pretty limited um but it will give you a
basic level of of web content filtering if that's
what you're looking for um and you know that's
a it's a good way to to protect your uh your
assets if if someone has one of your devices
and they're using a an internet cafe or you know
their home connection or something at least you
can provide some control right um so really that's
kind of one of the the the the needs here is
is to be able to enforce that really good control
on the outbound connections, bit of filtering.
And then there's some additional benefits as
far as being able to tell the true source of
the IP address from a logging perspective. So
you're not looking in the logs and seeing only
a single proxy server IP address on your connections.
You can actually tell where the connections are
coming from that using the source IP restoration
stuff. So again, this is probably not going to
be a solution for every single customer. um but
i i'm a strong believer that there are a lot
of customers that will actually see some really
good benefit from this and even if you know remember
we talk about this all the time that um Yeah,
in our sort of security world, things have to
be iterative, right? You've got to constantly
kind of mature your offerings. And even if this
isn't your final long -term solution, this may
be a really good stepping stone solution for
you to just get into the habit of like, how do
we monitor and restrict our outbound access?
Well, here's a good place to start before you
start looking into other. bigger tools for the
job. So definitely worth checking out. There
is a trial available as well. So as with a lot
of things in sort of the M365 ecosystem, if you
just want to just kick the tires on this, you
can sign up for a 25 user trial. I think it's
for like one month. And interestingly, what I've
noticed with the trial workflow, especially on
this one is you actually get the option of once
the trial ends, actually subscribing. or just
letting it die which is great i i had not seen
that before in in the microsoft billing engine
which you know as we know can be quite complex
so um yeah very very cool stuff i i i definitely
think uh it's worth with taking a look at Yeah,
a lot of development is going into this product.
Probably a lot of additional features will be
added to it in the future. Do you know, Chris,
because last time I looked at that, at the internet
access part, I was actually looking for a way
to redirect internet traffic for a group of people
over a very fixed outbound IP address. Do you
know if that is possible by now? It wasn't back
then, but... So instead of doing it by individual
users, you want to direct it or do it by... Yeah,
for example, if a service requires me coming
in from a set IP address, for example, some companies
and I work for an MSSP and we have a lot of companies
still wanting to limit our access into their
environment coming from a set IP address, for
example. You can do that with a VPN client, VPN
box. So I was kind of hoping that private access
would be able to provide me this somewhere in
the future. I don't know that it, I mean, you
could probably do it using what they call remote
networks. So if you set up a remote network,
you could probably do it that way. It will cut,
you know, everything that flows through that
network path comes from a known IP. But no, that's
not a scenario that I've come across. So that's
interesting. Lastly, I think just a quick worth
mentioning, and I have put it in the notes as
well is, and I literally learned about this like
two days ago. There's a preview currently of
something called private access for domain controllers.
And it's, like I said, it's in preview. And essentially
what it is, it's again, it builds on private
access and allows you now to layer in applications
that use. sort of legacy Kerberos environments,
right? So if you think about things that today
would still need to use a domain controller for
authentication, well, you don't want to be putting
your domain controllers on the internet and you
certainly don't want to be opening those things
up. This is now a way where you can install a
private access sensor on the domain controllers
and then using SPN configurations, you can actually
now enforce things like multi -factor auth and
all sorts of conditional access on those legacy
um kerberos applications this looks really promising
i've i've not messed with it yet because it's
it's pretty new um but like i said you know this
was kind of announced very very recently and
is currently in preview so you know if you've
if you're in your environment have uh still have
some legacy you know kerberos type applications
this might be something that you want to look
at as well um so check that out uh coast over
to you to talk about um The very, very big mouthful,
Defender for External Attack Service Management.
Yes, let's call it MDEASM, but that's still a
mouthful as an acronym, right? So I'll try not
to fumble over my words in the next couple of
10, 15 minutes too much. Yeah, so Defender for
External Attack Service Management is a tool
designed to help organizations discover, monitor
and secure everything that's internet facing.
And the most important part of this is even the
ones they didn't know existed. So you have to
think of this as some kind of automated reconnaissance
tool. You just fill in your domain names, your
IP blocks, your ASNs, who is information, that
kind of stuff. And Microsoft will automatically
crawl across all of those assets and try to find
other linked assets to it. It has built an entire
inventory. It will also do a lot of port scanning
stuff and finding out what kind of services are
behind those IP addresses. If maybe there are
some certificate issues, maybe some potential
exploits available on certain services. And it
will all give you those insights for your entire
publicly facing tech service, so to speak. And
I think companies grow larger. They acquire other
companies. They move to the cloud, spin up new
environments. Their attack servers become so
much harder to track what they all have running
over there and what they actually have. And I
think that's why this is really key to get back
the visibility of all the stuff you're actually
handing out to the public Internet. So again,
I used a large online retailer in the Netherlands
on board this. So they have a lot of public facing
assets because they have web shops and all kinds
of other internet services running. So I was
kind of amazed to see how much... EASM was able
to discover purely by just entering initially
their primary domain name. So what it will do,
it will also pull in who is information. For
example, if your email address is the contact
name for that domain, it will also look up for
who is information on that same email address
to find other domains you might have registered,
which might have. It might be related to that
one. So you just initially create what they call
a discovery group. And within a discovery group,
you can, well, like I said earlier, add domains,
IP blocks, ASNs, who is information, a lot of
stuff. Not everything is required. You can just
start with a domain name, for example. Periodically,
a default is a week, I believe. It will scan
and try to find new assets. I was already confronted
with a lot of assets not being owned by this
company. So this company had a certain domain
name, but that same domain name with a .br for
Brazil was apparently a new site in Brazil. And
Microsoft thought it was related because it had
the same domain name, right? But then with a
different... extension at the end of it so you
really have to regularly check what kind of assets
Microsoft is discovering because you pay per
asset so even if you fill in a single domain
name if Microsoft will discover 100 domains and
20 IP addresses you pay for the 120 assets discovered
and you pay 10 cents per asset per day And this
might not sound like much company like this retailer
ended up with, I believe, 3000 something assets.
Then it quickly adds up, of course. And that's
also why you need to keep an eye on it after
you set it up to make sure that everything that
is discovered incorrectly or not related, you
have to exclude yourself in the device group.
And Microsoft will also discover assets with
a state they call requires investigation. And
until you acknowledge that this is indeed your
assets, they will not do any scanning on it or
incorporating it into the dashboard. So you really
have to go in and say, okay, this is mine or
this is not mine. So there's a little bit of
work initially to get it started, but it's not
too bad, I believe, especially with everything
that's discovered automatically. It is a bit
weird. Microsoft is nowadays putting all the
Defender stuff in the security portal, right?
Even Sentinel is now there. And Microsoft even
recently did an announcement that they will stop
Sentinel from being an Azure resource one year
from now. So they're now really forcing everything
in the security portal. But Defender for external
attack service management is still a... azure
resource so i think this is maybe uh the last
one or something i don't know So you have to
deploy it through the Azure portal, but once
the instance is set up, you can connect it to
your Defender XDR by going into the security
portal. I've put it in the show notes where you
should go exactly because it's a little bit hidden,
to be honest. But there you can select the instance
you've deployed in Azure and then the insights
and recommendations will show up there as well.
But the initial setup and configuration is still
done all in Azure. Well, I was also happy to
see that there is log analytics integration by
default, which obviously makes it very useful
to connect into Sentinel. Microsoft does not
have any content available for Sentinel. I was
kind of surprised to see that. So they don't
have any content up package or any detections
or whatnot. So actually, I had to create a couple
of my own. I shared these in the show notes as
well. So I think it's very useful to trigger
a security incident in Sentinel, for example,
if EASM discovers an asset with a high critical
vulnerability, for example, you want to know
about that. And then you can imagine that people
are not looking in the dashboards every day constantly.
So you want to pop up an incident. You can do
that. Unfortunately, I discovered that the new
assets discovered which require investigation
could not be triggered in Sentinel and this is
due to the fact that the state The state property
of an asset is for some reason not synced to
Log Analytics right now. So I'm already in touch
with the engineering team behind the product
and I filed a feature request. I'm hoping that
they will add that in the future. Your external
attack service is not changing that frequently,
I can imagine. But it is something to keep in
mind. It's an interesting concept, though, because
you... if you do an external pen test of your
environment like one of the things i guess that
most pen testers are going to use is they're
going to start looking at certificate revocation
lists and certificate logs and all these types
of things to find where you've maybe generated
services over the years right because like especially
those like crt logs those things don't go away
and you can see you know any certificate that
was ever generated for a domain um and there
may be a service there uh so it's i'm sure there's
for many organizations doing this, there's going
to be that sort of shock, initial shock of like,
oh, I forgot about that. Or we didn't realize
that this was still there. We thought this was
gone a long time ago, right? Because no one ever
cleans up everything perfectly all the time.
No, that's true. And initially I was kind of
surprised that when I set it up in my lab environment,
I was able to add any domain I wanted. And I
was like, shouldn't I prove that this domain
is mine? And then I was like, no, of course not.
This is all public information, right? And an
attacker can also scan those domains and look
for open ports and whatnot. It's fine. You can
add everything you want. Except if you use this,
you're going to be paying 10 cents for every
one you scan. Which I guess is probably a little
bit of a deterrent for someone versus the Python
script that they downloaded off GitHub that's
doing the same thing for them, right? Yeah, that's
true. And also for people listening, when you
deploy your first EASM instance, it automatically
activates a 30 -day trial. So you can add your
environment, see what comes up. you don't think
it's useful, you just remove the instance and
you're not charged anything. To keep a track
on costs, I also created the detection in Sentinel
for this customer to alert when new assets were
found and the total amount increased more than
10 % because you can imagine the discovery will
rerun weekly and it might eventually discover
assets who are yours or maybe not and then like
the example with the brazilian website if it
if it suddenly discovers a completely new domain
with a lot of assets you will pay for them at
the end of the month and you want to know up
front right so that's why i created the detection
to periodically on a weekly basis compare the
amount of assets with last week and if there's
a more than 10 increase you get a security incident
in sentinel and then you know that you have to
look for something perhaps to either clean up
or just accept fact that you had more assets
now but at least now you know there's nothing
like this in the product but you can build solutions
like this through log analytics oh that's very
nice i'm sure that's going to be very helpful
um for folks but yeah that's this sounds really
cool this sounds like something i want to mess
around with pretty quick pretty soon i like the
idea Yeah, and it's really cool when you see
all the domains and IP addresses pop up. You
can, for example, this customer also had a VPN
endpoint with a VPN specific name, DNS name,
of course. And when you click on it, you can
see what kind of services they're running. They're
running a Cisco service. So Microsoft is already
warning me about potential exploits with outdated
firmware versions. They were not able to check
that over the open port. But since they know
it was Cisco Firepower, for example, I believe
then they know, okay, there are known vulnerabilities.
Please check that you have your firmware up to
this version. Really useful stuff. Really informational
stuff. Yeah, that's awesome. At Cisco, I think
I've had a couple of pretty nasty ones over the
last month or so. So yeah, that's a particular
instance too. Very nice. That's awesome. And
this customer had their head of firmwares in
check. So they were able to acknowledge the alert
coming in and close it down and make sure that
acknowledges that. that they saw that and they
are up to date already. But at least now you
know, right? And like you said, a lot of stuff
you don't know still existed and was probably
outdated and vulnerable for attacks. So I think
especially when you're running publicly facing
assets, you really should look into this. Yeah,
no, 100%. Very cool. It's very, very, very nice.
Thank you for that one. Yeah. I think before
we wrap up, just to talk about our community
project for this month. This is an interesting
one. And it's interesting because the person
who's come up with this, and I'm probably going
to butcher the name here, but I'm going to give
it my best shot anyway. Mikael Carlson. created
this tool called Intune Management. Don't repeat
yourself, Chris. You're making it worse. You
just stick to the initial pronunciation. Sorry
for interrupting you, man. And he created this
PowerShell tool called Intune Management, which
is essentially like a user interface onto Intune.
Now, the reason this is interesting is because
I don't know Mikhail, and he's from Sydney, or
at least he lives in Sydney as well. And I don't
know him, and he doesn't... you know appear to
be an mvp or anything like that it's just a cool
tool that he created um randomly that that i
came across and i really like the look of this
it looks very very cool um And one of the reasons
I think where I see the real benefit to this
is it allows you to sort of copy and import,
export, delete policies and profile information
within Intune and Azure. And it's got a ton of
sort of options as far as your app protection
policies or your app configuration policies and
compliance policies, conditional access, all
that stuff that you configure either in Azure
or in Intune. um it gives you an interface to
to to obviously view and edit those things but
also then if you wanted to clone or back up those
policies which firstly i think is really cool
to be able to have that like a backup of your
policies in a way that you can very easily import
them right i think that in itself is is of great
benefit um but i could also see this working
really well for folks like myself who are consultants
who you know you probably have a base of of policies
that maybe you build that you know is mostly
the same for every customer right like you know
most customers have apple and ios ios and android
devices and they have some um uh sort of compliance
policies or configuration policies for that and
if you had a baseline set of policies um that
you could then build and export and then re -import
those into a different environment that's really
powerful instead of having to either orchestrate
them or recreate them from scratch so i you know
the tool works great i i ran it up on a on a
it only works on windows um i'll say that um
because it i think it well it says wpf but i'm
sure there's a little bit of windows forms and
stuff in there as well um so the goo the gui
anyway uh will only run on windows but um Yeah,
I had a play with it earlier this morning. And,
you know, it's very cool. It's very sort of functional,
I think. And it's been around for a while. I
think the first commits on GitHub were like four
years ago. So he's been working on this for a
while. And then there were some updates recently
just a couple months ago. So, yeah. Great, great
work, Mikhail. If you're interested in checking
this out, there's a link to the GitHub repo in
the show notes. And yeah, if you work in Intune
a lot or you work with devices and autopilot,
stuff like that, this might make your life easier.
So go check it out. Thanks for hearing, Chris.
Good find. Yeah, awesome. Well, I think with
that, it's... Probably time to wrap up and say
goodbye. Coast, I'm sure you've got a day job
to get to today. Yes. It's 9 o 'clock in the
morning now. Time to start my day. Absolutely.
Yes. I'm going to kick back here now. I think
it's time for me to go watch some Tour de France
highlights. What are you going to watch? The
Tour de France highlights from the stage. Well,
it would be stage 15, I guess, highlights. Because
of the time zone, I get to, like, I watch the
highlights in my afternoon. so so the stay i
mean the stage runs overnight right i think they
start around eight o 'clock uh pm sydney time
but i you know i'm not gonna stay up and watch
the as much as i love the tour de france i can't
stay up and watch a six hour stage so i uh you
know i watch the highlights the next afternoon
before the next stage kicks off it's okay okay
okay enjoy the cycling highlights and see you
next time Absolutely. We'll see you again. Thanks,
everyone, for listening. Please feel free to
like and subscribe or reach out to us on the
socials as well. We have a LinkedIn page now
also. So if you want to reach out to us with
some, you know, if you have feedback or if there's
something specifically that you want us to cover
on the show, please reach out to us and we'll
do our best to accommodate that. But until then,
we'll see you for episode 10 and we will be back
in a month. Until then, take care and see you.
Bye -bye.