{"id":176,"date":"2022-02-02T10:03:00","date_gmt":"2022-02-01T21:03:00","guid":{"rendered":"https:\/\/www.howdoiuseacomputer.com\/?p=176"},"modified":"2022-02-08T10:14:54","modified_gmt":"2022-02-07T21:14:54","slug":"do-not-disable-security-defaults","status":"publish","type":"post","link":"https:\/\/www.howdoiuseacomputer.com\/index.php\/2022\/02\/02\/do-not-disable-security-defaults\/","title":{"rendered":"Please do NOT disable Security Defaults!"},"content":{"rendered":"\n<p><strong>If you aren&#8217;t licensed for and using Conditional Access policies<\/strong>, please do not disable the security defaults feature just because something isn&#8217;t working (e.g. scan to email).  Microsoft introduced the defaults for a very good reason &#8211; they realised that tenants without Azure AD Premium P1 licensing and correctly configured CA policies were wide open to Phishing and Password Spray attacks, via connections to Exchange Online using basic authentication protocols such as POP, IMAP and SMTP.<\/p>\n\n\n\n<p><strong>Connections using basic authentication do not support <em>and therefore bypass<\/em> MFA<\/strong>.  If you disable this setting you are effectively turning off many security features. <\/p>\n\n\n\n<p>Let&#8217;s find a solution to these problems and leave our tenant protected &#8216;by default&#8217;.   <\/p>\n\n\n\n<p><strong>Here&#8217;s how to allow certain things <\/strong>(e.g. Teams meeting room devices and printers) while leaving our tenant secure:<\/p>\n\n\n\n<p>1. <strong>Add any external IPs<\/strong> of company locations to Trusted IPs under MFA settings. In most cases you would do this for all company owned office locations.\u00a0<\/p>\n\n\n\n<p class=\"has-small-font-size\"><a href=\"https:\/\/account.activedirectory.windowsazure.com\/UserManagement\/MfaSettings.aspx\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/account.activedirectory.windowsazure.com\/UserManagement\/MfaSettings.aspx<\/a><br><\/p>\n\n\n\n<p>2. <strong>Set Password Reset Registration to No<\/strong> so that new users are not prompted to register.<\/p>\n\n\n\n<p class=\"has-small-font-size\"><a href=\"https:\/\/portal.azure.com\/#blade\/Microsoft_AAD_IAM\/PasswordResetMenuBlade\/Registration\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/portal.azure.com\/#blade\/Microsoft_AAD_IAM\/PasswordResetMenuBlade\/Registration<\/a><br><\/p>\n\n\n\n<p class=\"has-normal-font-size\">3. <strong>If you need to send SMTP<\/strong> email through Exchange Online (e.g. from a printer), create an account with exchange license to use for sending.<\/p>\n\n\n\n<p class=\"has-small-font-size\"><a href=\"https:\/\/portal.azure.com\/#blade\/Microsoft_AAD_IAM\/ActiveDirectoryMenuBlade\/Overview\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/portal.azure.com\/#blade\/Microsoft_AAD_IAM\/ActiveDirectoryMenuBlade\/Overview<\/a><br><\/p>\n\n\n\n<p>4. Load <strong>Cloud Shell <\/strong>from top of the Azure Portal. Connect to Exchange:<\/p>\n\n\n\n<p class=\"has-text-color has-small-font-size\" style=\"color:#3e84ac\"><strong>Connect-EXOPSSession<br><\/strong><\/p>\n\n\n\n<p>5. Create an EOL <strong>Authentication Policy<\/strong>:<\/p>\n\n\n\n<p class=\"has-text-color has-small-font-size\" style=\"color:#3e84ac\"><strong>New-AuthenticationPolicy -Name &#8220;Allow Basic Auth SMTP&#8221; -AllowBasicAuthSmtp<\/strong><\/p>\n\n\n\n<p><br>6. <strong>Assign the policy<\/strong> to the user:<\/p>\n\n\n\n<p class=\"has-text-color has-small-font-size\" style=\"color:#3e84ac\"><strong>Get-User user@domain.com | Set-User -AuthenticationPolicy &#8220;Allow Basic Auth SMTP&#8221;<\/strong><\/p>\n\n\n\n<p><br>7. Optionally, force the policy to apply within 30 minutes:<\/p>\n\n\n\n<p class=\"has-text-color has-small-font-size\" style=\"color:#3e84ac\"><strong>Set-User user@domain.com -STSRefreshTokensValidFrom $([System.DateTime]::UtcNow) <\/strong><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>Now your users and devices will be able to connect <\/strong>without MFA requirement from trusted offices, and you can set up Scan to Email functions to use the account you created.  <\/p>\n\n\n\n<p>Righto &#8211; time have a cup of tea and reward yourself for not chopping off a leg to fix an itch! &#x1f923;&#x1f923;<\/p>\n<div class=\"pvc_clear\"><\/div><p id=\"pvc_stats_176\" class=\"pvc_stats all  \" data-element-id=\"176\" style=\"\"><i class=\"pvc-stats-icon small\" aria-hidden=\"true\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" version=\"1.0\" viewBox=\"0 0 502 315\" preserveAspectRatio=\"xMidYMid meet\"><g transform=\"translate(0,332) scale(0.1,-0.1)\" fill=\"\" stroke=\"none\"><path d=\"M2394 3279 l-29 -30 -3 -207 c-2 -182 0 -211 15 -242 39 -76 157 -76 196 0 15 31 17 60 15 243 l-3 209 -33 29 c-26 23 -41 29 -80 29 -41 0 -53 -5 -78 -31z\"\/><path d=\"M3085 3251 c-45 -19 -58 -50 -96 -229 -47 -217 -49 -260 -13 -295 52 -53 146 -42 177 20 16 31 87 366 87 410 0 70 -86 122 -155 94z\"\/><path d=\"M1751 3234 c-13 -9 -29 -31 -37 -50 -12 -29 -10 -49 21 -204 19 -94 39 -189 45 -210 14 -50 54 -80 110 -80 34 0 48 6 76 34 21 21 34 44 34 59 0 14 -18 113 -40 219 -37 178 -43 195 -70 221 -36 32 -101 37 -139 11z\"\/><path d=\"M1163 3073 c-36 -7 -73 -59 -73 -102 0 -56 133 -378 171 -413 34 -32 83 -37 129 -13 70 36 67 87 -16 290 -86 209 -89 214 -129 231 -35 14 -42 15 -82 7z\"\/><path d=\"M3689 3066 c-15 -9 -33 -30 -42 -48 -48 -103 -147 -355 -147 -375 0 -98 131 -148 192 -74 13 15 57 108 97 206 80 196 84 226 37 273 -30 30 -99 39 -137 18z\"\/><path d=\"M583 2784 c-38 -19 -67 -74 -58 -113 9 -42 211 -354 242 -373 16 -10 45 -18 66 -18 51 0 107 52 107 100 0 39 -1 41 -124 234 -80 126 -108 162 -133 173 -41 17 -61 16 -100 -3z\"\/><path d=\"M4250 2784 c-14 -9 -74 -91 -133 -183 -95 -150 -107 -173 -107 -213 0 -55 33 -94 87 -104 67 -13 90 8 211 198 130 202 137 225 78 284 -27 27 -42 34 -72 34 -22 0 -50 -8 -64 -16z\"\/><path d=\"M2275 2693 c-553 -48 -1095 -270 -1585 -649 -135 -104 -459 -423 -483 -476 -23 -49 -22 -139 2 -186 73 -142 361 -457 571 -626 285 -228 642 -407 990 -497 242 -63 336 -73 660 -74 310 0 370 5 595 52 535 111 1045 392 1455 803 122 121 250 273 275 326 19 41 19 137 0 174 -41 79 -309 363 -465 492 -447 370 -946 591 -1479 653 -113 14 -422 18 -536 8z m395 -428 c171 -34 330 -124 456 -258 112 -119 167 -219 211 -378 27 -96 24 -300 -5 -401 -72 -255 -236 -447 -474 -557 -132 -62 -201 -76 -368 -76 -167 0 -236 14 -368 76 -213 98 -373 271 -451 485 -162 444 86 934 547 1084 153 49 292 57 452 25z m909 -232 c222 -123 408 -262 593 -441 76 -74 138 -139 138 -144 0 -16 -233 -242 -330 -319 -155 -123 -309 -223 -461 -299 l-81 -41 32 46 c18 26 49 83 70 128 143 306 141 649 -6 957 -25 52 -61 116 -79 142 l-34 47 45 -20 c26 -10 76 -36 113 -56z m-2057 25 c-40 -58 -105 -190 -130 -263 -110 -324 -59 -707 132 -981 25 -35 42 -64 37 -64 -19 0 -241 119 -326 174 -188 122 -406 314 -532 468 l-58 71 108 103 c185 178 428 349 672 473 66 33 121 60 123 61 2 0 -10 -19 -26 -42z\"\/><path d=\"M2375 1950 c-198 -44 -350 -190 -395 -379 -18 -76 -8 -221 19 -290 114 -284 457 -406 731 -260 98 52 188 154 231 260 27 69 37 214 19 290 -38 163 -166 304 -326 360 -67 23 -215 33 -279 19z\"\/><\/g><\/svg><\/i> <img loading=\"lazy\" decoding=\"async\" width=\"16\" height=\"16\" alt=\"Loading\" src=\"https:\/\/www.howdoiuseacomputer.com\/wp-content\/plugins\/page-views-count\/ajax-loader-2x.gif\" border=0 \/><\/p><div class=\"pvc_clear\"><\/div>","protected":false},"excerpt":{"rendered":"<p>If you aren&#8217;t licensed for and using Conditional Access policies, please do not disable the security defaults feature just because something isn&#8217;t working (e.g. scan to email). Microsoft introduced the defaults for a very good reason &#8211; they realised that tenants without Azure AD Premium P1 licensing and correctly configured CA policies were wide open [&hellip;]<\/p>\n<div class=\"pvc_clear\"><\/div>\n<p id=\"pvc_stats_176\" class=\"pvc_stats all  \" data-element-id=\"176\" style=\"\"><i class=\"pvc-stats-icon small\" aria-hidden=\"true\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" version=\"1.0\" viewBox=\"0 0 502 315\" preserveAspectRatio=\"xMidYMid meet\"><g transform=\"translate(0,332) scale(0.1,-0.1)\" fill=\"\" stroke=\"none\"><path d=\"M2394 3279 l-29 -30 -3 -207 c-2 -182 0 -211 15 -242 39 -76 157 -76 196 0 15 31 17 60 15 243 l-3 209 -33 29 c-26 23 -41 29 -80 29 -41 0 -53 -5 -78 -31z\"\/><path d=\"M3085 3251 c-45 -19 -58 -50 -96 -229 -47 -217 -49 -260 -13 -295 52 -53 146 -42 177 20 16 31 87 366 87 410 0 70 -86 122 -155 94z\"\/><path d=\"M1751 3234 c-13 -9 -29 -31 -37 -50 -12 -29 -10 -49 21 -204 19 -94 39 -189 45 -210 14 -50 54 -80 110 -80 34 0 48 6 76 34 21 21 34 44 34 59 0 14 -18 113 -40 219 -37 178 -43 195 -70 221 -36 32 -101 37 -139 11z\"\/><path d=\"M1163 3073 c-36 -7 -73 -59 -73 -102 0 -56 133 -378 171 -413 34 -32 83 -37 129 -13 70 36 67 87 -16 290 -86 209 -89 214 -129 231 -35 14 -42 15 -82 7z\"\/><path d=\"M3689 3066 c-15 -9 -33 -30 -42 -48 -48 -103 -147 -355 -147 -375 0 -98 131 -148 192 -74 13 15 57 108 97 206 80 196 84 226 37 273 -30 30 -99 39 -137 18z\"\/><path d=\"M583 2784 c-38 -19 -67 -74 -58 -113 9 -42 211 -354 242 -373 16 -10 45 -18 66 -18 51 0 107 52 107 100 0 39 -1 41 -124 234 -80 126 -108 162 -133 173 -41 17 -61 16 -100 -3z\"\/><path d=\"M4250 2784 c-14 -9 -74 -91 -133 -183 -95 -150 -107 -173 -107 -213 0 -55 33 -94 87 -104 67 -13 90 8 211 198 130 202 137 225 78 284 -27 27 -42 34 -72 34 -22 0 -50 -8 -64 -16z\"\/><path d=\"M2275 2693 c-553 -48 -1095 -270 -1585 -649 -135 -104 -459 -423 -483 -476 -23 -49 -22 -139 2 -186 73 -142 361 -457 571 -626 285 -228 642 -407 990 -497 242 -63 336 -73 660 -74 310 0 370 5 595 52 535 111 1045 392 1455 803 122 121 250 273 275 326 19 41 19 137 0 174 -41 79 -309 363 -465 492 -447 370 -946 591 -1479 653 -113 14 -422 18 -536 8z m395 -428 c171 -34 330 -124 456 -258 112 -119 167 -219 211 -378 27 -96 24 -300 -5 -401 -72 -255 -236 -447 -474 -557 -132 -62 -201 -76 -368 -76 -167 0 -236 14 -368 76 -213 98 -373 271 -451 485 -162 444 86 934 547 1084 153 49 292 57 452 25z m909 -232 c222 -123 408 -262 593 -441 76 -74 138 -139 138 -144 0 -16 -233 -242 -330 -319 -155 -123 -309 -223 -461 -299 l-81 -41 32 46 c18 26 49 83 70 128 143 306 141 649 -6 957 -25 52 -61 116 -79 142 l-34 47 45 -20 c26 -10 76 -36 113 -56z m-2057 25 c-40 -58 -105 -190 -130 -263 -110 -324 -59 -707 132 -981 25 -35 42 -64 37 -64 -19 0 -241 119 -326 174 -188 122 -406 314 -532 468 l-58 71 108 103 c185 178 428 349 672 473 66 33 121 60 123 61 2 0 -10 -19 -26 -42z\"\/><path d=\"M2375 1950 c-198 -44 -350 -190 -395 -379 -18 -76 -8 -221 19 -290 114 -284 457 -406 731 -260 98 52 188 154 231 260 27 69 37 214 19 290 -38 163 -166 304 -326 360 -67 23 -215 33 -279 19z\"\/><\/g><\/svg><\/i> <img loading=\"lazy\" decoding=\"async\" width=\"16\" height=\"16\" alt=\"Loading\" src=\"https:\/\/www.howdoiuseacomputer.com\/wp-content\/plugins\/page-views-count\/ajax-loader-2x.gif\" border=0 \/><\/p>\n<div class=\"pvc_clear\"><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[9],"tags":[13,22,16,67,69,39,68],"class_list":["post-176","post","type-post","status-publish","format-standard","hentry","category-ramblings","tag-13","tag-azure-ad","tag-microsoft","tag-office","tag-scan-to-email","tag-security","tag-security-defaults"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.howdoiuseacomputer.com\/index.php\/wp-json\/wp\/v2\/posts\/176"}],"collection":[{"href":"https:\/\/www.howdoiuseacomputer.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.howdoiuseacomputer.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.howdoiuseacomputer.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.howdoiuseacomputer.com\/index.php\/wp-json\/wp\/v2\/comments?post=176"}],"version-history":[{"count":6,"href":"https:\/\/www.howdoiuseacomputer.com\/index.php\/wp-json\/wp\/v2\/posts\/176\/revisions"}],"predecessor-version":[{"id":333,"href":"https:\/\/www.howdoiuseacomputer.com\/index.php\/wp-json\/wp\/v2\/posts\/176\/revisions\/333"}],"wp:attachment":[{"href":"https:\/\/www.howdoiuseacomputer.com\/index.php\/wp-json\/wp\/v2\/media?parent=176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.howdoiuseacomputer.com\/index.php\/wp-json\/wp\/v2\/categories?post=176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.howdoiuseacomputer.com\/index.php\/wp-json\/wp\/v2\/tags?post=176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}