maybe my method would just be redundant. After some slight convincing I figured my method does have its merits. One of them being that it uses the secure application model, and thus its easy to apply to all partner tenants for a CSP, the other benefit is that this could run headless as a completely automated solution.

Managed DNS services. This has caused us to look for a different solution. Of course, I immediately thought of Azure, with an Azure DNS hosted zone.

kind of strange of relying on a third party closed service to generate and send passwords to clients. You're not 100% in control and often it misses some form of functionality like a password generator or somesuch.

infrastructure has been the development of Teams. Teams is amazing tool on it's own but there is a risk regarding governance and training, but also explosive growth of teams and the way these are implemented. Especially because Teams makes self-services super easy.

inside networks managed by a Windows DHCP server. The process is pr etty straight forward - Add a vendor class, add the option, and set it to the correct IP address. Unfortunately, that of course means a lot of clicking in the DHCP console on each Windows Server he manages....

deploy the Secure Defaults centrally, so I figured I would try to help with this.

PowerShell Module. If you're not familiar yet I've blogged about the module and warranty reporting before here. Most of the module has been left the same so you can reference that blog for more information.

course just one part of the new beta Secure Score module. The next one is actually the more fun part; applying the correct security settings to a tenant.

blog really. The great thing is that all of the stuff I normally blog about is pretty easy to integrate into CIPP

had to jump through many hoops and had an issue with running changes headless because the PowerShell modules didn't support it. Recently I've been in contact with the SharePoint team and we now have a functional API for most of the important admin settings.

in Office365. He found that when he went to the new Settings Pane for Modern Authentication he could change settings specifically to block older clients.

I also see that a lot of MSPs are still struggling with deploying a default autopilot configuration and are kind of avoiding it with the worries that you make a total mess of things.

Temporary Access Password and TAP is actually pretty cool, especially for MSPs deploying loads of devices. The TAP is a generated password th at has a maximum amount of uses...

NTFSSecurity module. We?;ll also have a generic non-ITGlue version you can use with whatever documentation system you use.

either completely public cloud using AAD or they have hosted servers in our private cloud. For these clients I've made the following script to document their Active Directory server settings. I always I want to be in complete control of my clients environment. That means having up to date documentation at the ready.

won't bother; there's lots a smart scripts flying about that can be used to find the webshells, etc. Instead I'm focussing on M365 admin actions.

document which mobile devices exist in a O365 tenant and put them into IT-Glue as configurations. I figured I'd help him real quick and blog about it.

paperless environment each day. Unfortunately we're not at that future just yet, so we have to document print servers and their settings.

access tools that are installed on a computer, and list the possible access URLs; that way he could easily document which access methods are open and audit them once in a while to see if he...

lot more questions about documenting Secure Score with the Secure Application model.

Sign-in allows you to sign in using your M365 credentials and multifactor authentication token, or using a Azure AD Temporary Access Pass. Web-Sign in is pretty cool as users get presented with a modern authentication pop-up dialog when signing in, the same one they are used to seeing when logging into the Office suite applications.

faster and better method of managing Exchange Online via PowerShell - It just has some downsides right now for most Microsoft Partners.

one of the most common occurrences happens to be that users somehow don't get their tokens setup completely, and need to retrieve these again.

in a lot of the communities I frequent but a worry popped up by someone recently; how am I sure that the Azure Application Proxy is always completely functional at my clients? You can monitor the service of course, but that does not mean that the entire connection to Azure is functional.

production. A friend of mine is using my PSexec monitoring script. He just has a couple of issue with that; he's running an application that actively uses psexec to create some elevation. That's quite...

handy for us as Microsoft partners because it makes it a little bit easier to retrieve these issues programmatically, and be aware of them before the client gives us a call at times.

for a while. He told me that he loved having the ability to measure the users experience but he had some clients with in-house applications that would write errors to the system log constantly, or he had other clients with crashing services that could not be prevented.

actually released it on the blog so I figured it's a good way to get back into blogging.

pain points in our current stack is the monitoring of anti-virus, we often felt like there is not enough transparency and data returned via our RMM system. Either the system does not return the current state of alerts or forces us to use separate portals.

clients don't notice downtime when a failover or load balancing action occurs. It makes everything smooth and fluent for clients and users of our systems. The only problem with this is that sometimes a failover occurs and you don't notice. Great for users, not so great for administrators; if a server crashes in the woods, did it really crash at all? To make sure we always get notified about these situations we use the following script via our RMM system.

Access Management tool that will be living in your Azure environment, mostly designed for MSPs. If you want to see how AzPam looks or contribute, check out the Github page about it here. I should be pretty close to releasing an alpha version soon!

supported, due to COVID we had some extra time to prepare our clients for this change as its been postponed to July of 2021. We've helped all of our clients move to modern authentication last year but I understood there is still a bit of a struggle for other MSPs to achieve this.

and ports being in use. The use case is that users have a Autocad type application installed that launches a server on a specific port; the users also run a remote control application that at times steals the port.

little more difficult . Microsoft allows per-user MFA, Security Defaults, and Conditional Access all to be used concurrently. I've created this monitoring script that returns which users seem to fall out of any Multi-factor authentication scope, and also reports what type of authentication is currently active on the tenant. Using the normal PowerShell methods you can only find if a user has per-user MFA enabled, if a user uses Conditional Access or Security Defaults it shows the per-user MFA state as disabled, which is a little annoying.

?? This time we're tackling three issues in one; We're going to monitor traffic usage to see if a connection isn't saturated. We're also going to check if the NIC speed is correct and we're going to check if the connection is metered and if it is alert on it.

of alerting policies. The first getting alerts for M365 or Azure P1/P2 users via the Graph API, these alerts are pretty cool as you can see if users are connecting from tor nodes/VPN nodes, or from stuff like malware linked IPs. Monitoring these alerts actively via your RMM helps you in making sure that users are as safe as they can be.

client had some leavers in the company and not notify us as the administrators, or that the client had some very inactive users that don't really need to be licensed or could be converted to a shared mailbox for example.

user, and if the OST size is nearing it's maximum size, as a bonus I'm also giving you the option of alerting on active PST files. The offline mode is just a handy gizmo to notify users that they might've misclicked - It still happens to our users from time to time.

Storage Spaces is becoming more relevant each day, with S2D and larger deployments. Storage Spaces is Microsoft's successor to the classical Windows Software RAID options.

needed an easy way to manage virtual desktops over many regions. This deployment actually got me thinking about how monitoring the WVD environment should be done.

used for. I've tried to describe as much as possible on the github page and the previous blog about it. But one I wanted to talk about real quick is the ability to create Toast notifications.

small analysis on stuff like disk space can make a huge difference in how you respond to incidents but I rarely see this integrated into RMM systems - Often there are some reports on which you could extrapolate this data manually but that means you'll only do it on demand and it will require your time.

demonstrated during the conference. The presenters showed a method of checking if your O365 domain was being Typosquated. The tool can be found here. The presenters made a Python tool, and I figured to create an alternative in PowerShell.

tenants, but I've transformed this into a module to allow a easy synchronization between your RMM system and M365. There's some prework that'll need to be performed for each supported RMM system. Check out the Github page for the latest and greatest information as the blog can be outdated.

of work was sunk into this effort. Somewhere last year I made a post about a better partner portal. This was super well received and I got a lot of amazing feedback on it.

online, and found it hard to find all the sites in one place. We pointed them to https://YOURDOMAIN.sharepoint.com/_layouts/15/sharepoint.aspx which gives a nice overview of sites and teams.

because it becomes fairly simple to give users a nice OOBE. It also makes setup for devices a lot less of a hassle, the only issue that was spoken about during the webinar is that there is still a lot of manual clicking. This is why I took it upon myself to create some automation scripts for AutoPilot.

images, the logos, or even help with localization. To check out all the options I suggest grabbing the documentation by Microsoft here. Remember that you need a P1 subscription or higher for branded portals.

this script we're trying to get all the files that could suffer from the Log4J issue in CVE-2021-44228.

or the backup software does not work, they still have an image based backup for those huge emergencies.

the application executing this script only has SYSTEM access. This is especially useful when performing tasks from RMM(Remote Monitoring and Management) systems that do not have the abilty to execute monitoring components in user-space.

specialists get small digestible bites about new technologies, complex scripts, and solutions you could be implementing in your MSP today. I'm fairly anti-tool culture where MSPs get a different tool for each minor inconvenience and focus just on that tool, so I'll be focussed on modern technologies in the Microsoft stack, but also will cover other external tools if they make a big enough difference.

a shared printer via Universal Print