SuperTekBoy

Practical Help for Exchange & Office 365

Exchange Online Updates (October 2021)

By Leave a Comment

3 Shares
Share
Tweet
Share
Reddit
Print

Deprecation of the classic Exchange Admin Center

The new Exchange Admin Center has been available for quite some time and was designated reaching general availability back in April. With feature parity met, and in many cases exceeded, it is no doubt that the Exchange team is now planning the deprecation of the classic Exchange Admin Center.

Starting this month features will be redirected away from the classic admin center with the planned removal of the classic EAC by September 2022. Check out Microsoft’s timeline in the image below.

Deprecation of the classic Exchange Admin Center

To use the new Exchange Admin Center point your browser to https://admin.exchange.microsoft.com or from the classic Exchange Admin Center select the toggle to Try the new Exchange Admin Center in the top-right of the screen.

New Exchange Admin Center

New end date for Basic Authentication

Since 2018 Microsoft has announced the blocking of basic authentication. However, due to the pandemic, that date has shifted a few times. Back in February, it was announced that the deprecation of basic auth had been put on hold until further notice. In September Microsoft announced new deadlines for the deprecation of basic authentication for all Exchange protocols. This date is October 1st, 2022. After this date, any application connecting to Exchange Online will be required to leverage modern authentication (OAuth 2.0). The only exception to this is SMTP Auth which can continue to use basic authentication.

Note: Prior to October 1st, 2022, Microsoft will continue to disable basic auth on protocols in tenants where basic auth is not detected.

For devices and applications that integrate with Exchange Web Services, such as voicemail, ticketing systems, or line of business applications, these will be required to support modern authentication. One option is to leverage certificate-based authentication leveraging an Azure app. However, it is better to switch the EWS integration over to Microsoft Graph as Microsoft plans to deprecate EWS integration starting September 30th, 2022. Microsoft is positioning Microsoft Graph to be the sole entry point for all app integrations rather than having separate entry points for each Office 365 workload. This reduces the attack footprint of the Office 365 service. I would also recommend looking into Application Access Policies. These policies limit what mailboxes an app can access. Be sure to check your vendor’s documentation for guidance on connecting these apps to Office 365 with modern authentication.

For PowerShell, I recommend using the Microsoft Exchange Online PowerShell Module. This module supports both modern auth and is a requirement if your admin account has multi-factor authentication enabled (which I hope it does!). I recommend checking out this article for more information on how to use this module. Also, you may want to look into the Azure Cloud Shell. Check out the tutorial; Using Exchange Cmdlets in Azure Cloud Shell.

For POP and IMAP, Microsoft added OAuth support. However, this still requires your POP or IMAP application to support OAuth. For integrated apps that use POP or IMAP, like helpdesk ticketing systems, I would recommend looking for other methods of integration rather than using POP or IMAP. Using our helpdesk ticketing system example, look to see if the app can integrate with EWS or the Graph instead. For clients, see if you can switch those users over to a new client that supports a direct Exchange connection. My recommendation is to get rid of POP and IMAP entirely and globally shut down those legacy protocols.

The most significant impact of this announcement will be on ActiveSync. Countless native mail apps use ActiveSync to access their Office 365 mail. I highly recommend migrating your user base to Outlook mobile (for iOS and Android). Outlook Mobile supports both modern authentication and multi-factor authentication. It is worth noting that some native mail apps, such as those included in iOS 11+, have modern authentication support. However, pushing users to Outlook Mobile versus upgrading their phones is the path of least resistance. Not to mention your helpdesk or IT department will only need to support one mail client and have greater control protecting corporate data via mobile application management policies from Intune.

To track which devices and applications are signing in with legacy authentication, you can use the Azure AD Sign-ins dashboard. Microsoft covers this process in this article.

[Read more…] about Exchange Online Updates (October 2021)
Print Friendly, PDF & Email

Exchange September Cumulative Updates and the new Emergency Mitigation Service

By Leave a Comment

5 Shares
Share
Tweet
Share
Reddit
Print
Exchange 2016 CU22 Emergency Mitigation Service

Last month Microsoft released cumulative updates for Exchange 2016 and Exchange 2019. Once you get the September cumulative updates, be sure to grab the security updates released in October.

While Exchange 2013 did not have a cumulative update, it did receive a security update, which can be applied to Exchange 2013 Cumulative Update 23.

A security update was not released for Exchange 2010. The latest update for Exchange 2010 is still Rollup 32 (March 2nd, 2021). Keep in mind that Exchange 2010 was out of support as of October 13th, 2020.

If you need guidance on migrating from a specific CU to the latest, check out Microsoft’s Exchange Update Wizard for step-by-step instructions.

The updates are as follows:

Exchange Logo Mini

Exchange 2019 Cumulative Update 11 | KB5005334 | October Security Update

Exchange 2013 Cumulative Update 9

Exchange 2016 Cumulative Update 22 | KB5005333 | October Security Update

Exchange 2013 Cumulative Update 9

Exchange 2013 October Security Update | KB5007011

The new Microsoft Exchange Emergency Mitigation Service

As a response to the HAFNIUM exploits the Exchange team developed a new Exchange Emergency Mitigation service to be included with Exchange Server. Emergency Mitigation is a new Windows service that is deployed by the Exchange Server setup utility.

Microsoft Exchange Emergency Mitigation Service

It is effectively a built-in version of the previously released standalone Emergency Online Mitigation Tool (EOMT) that administrators could run on-demand. The standalone tool was a way for administrators to apply interim remediation until they could apply the needed patches.

In much the same way the Emergency Mitigation Service checks the Office Config Service (OCS) for new mitigation XMLs every hour. It then applies the interim remediation specified in the XML file. The mitigation service can apply the following three actions.

  • Block malicious patterns in HTTP requests via the IIS URL rewrite service
  • Disable vulnerable Exchange services
  • Disable vulnerable App Pools in IIS

Should you accidentally undo any mitigations, restart the Emergency Mitigation Service on the Exchange Server. Within 10 minutes the service will check OCS for the latest XML and reapply any mitigations.

At the time of writing, only a test XML file exists at the Office Config Service for heartbeat purposes. That said, your Exchange Server now requires an outbound connection to https://officeclient.microsoft.com to access these mitigation XML files. To verify Exchange can reach the Office Config Service, you can leverage the Test-MitigationServiceConnectivity.ps1 script located in the Exchange scripts folder.

Once you apply a cumulative or security update that addresses the vulnerability, you will need to manually undo any actions taken by the Emergency Mitigation Service.

[Read more…] about Exchange September Cumulative Updates and the new Emergency Mitigation Service
Print Friendly, PDF & Email

On the Line with Cohesity #44: Updates on M365 and more!

By Leave a Comment

2 Shares
Share
Tweet
Share
Reddit
Print

On September 14th, I had the great pleasure of being a guest on On the Line with Cohesity podcast. I joined host Theresa Miller to discuss several M365 topics; including:

[Read more…] about On the Line with Cohesity #44: Updates on M365 and more!
Print Friendly, PDF & Email

How to enroll in the Microsoft Teams public preview program

By Leave a Comment

0 Shares
Share
Tweet
Share
Reddit
Print

Microsoft Teams is a constant influx of new features and development. For example, in June alone, Microsoft released a few dozen new features, including chat bubbles, new spotlighting options, a meeting attendance dashboard, Dynamics integration, and more (not to mention all the new Teams devices).

One of the benefits of being in the Microsoft Teams Public Preview is seeing and testing new features before they are generally available. As a result, this is an excellent option for early adopters in a company who want to experience the new features and changes before the general population. Additionally, early access is beneficial for those in roles of corporate training and communication.

To opt into the Teams Public Preview is straightforward. First, click the three dots (…) next to your profile picture in the Teams client. Then, from the menu, select About > Public Preview.

Microsoft Teams Public Preview Program

You will then receive a disclaimer stating that your experience in the public preview is provided “as is,” “with all faults,” and excluded from any warranty or service level agreements (SLAs). Essentially, there is no guarantee you will be free from issues, and Microsoft cannot be held to any warranty or SLA to resolve those issues.

To accept these terms, click Switch to public preview. If you do not wish to accept, click Cancel. If you cancel, you will not be allowed to join the public preview.

Note: This action will restart the Microsoft Teams client. Switching to the public preview will end any calls or meetings.

Microsoft Teams Public Preview Program SLA and Warranty
[Read more…] about How to enroll in the Microsoft Teams public preview program
Print Friendly, PDF & Email

Workaround: Replying to a message with an invalid S/MIME digital signature fails

By Leave a Comment

0 Shares
Share
Tweet
Share
Reddit
Print

If you received a message with an invalid or untrusted S/MIME digital signature, you might have problems replying to that message with Outlook on the Web (OWA).

The inability to reply is not necessarily a bad thing as it might indicate an impersonation attempt. Impersonation is where a bad actor pretends to be someone you know, often for financial gain. A common example of impersonation is a bad actor pretending to be a CEO asking their company accountant to wire money to the bad actor’s bank account.

So, if you see a failed digital signature, it is a good time to pause and determine if the sender really is who they say they are through other verified mechanisms (e.g., call them on a trusted phone number). Then validate if they are aware of the digital signature issue to see if they are already working to resolve it.

If using a product like Office 365, you can also check if the message has failed any impersonation checks. For example, are safety tips in OWA warning that you don’t typically receive mail from this sender with that email address.

The screenshot below provides an example of a message received in OWA where the S/MIME digital signature is not considered valid or trusted. Clicking the click here link gives us some additional insight into the error. We can see OWA does not trust this certificate because it has a broken certificate chain, more than likely caused by a missing or expired intermediary cert.

The digital signature on this message isn't valid or trusted OWA

When attempting to reply to this message in OWA, you may receive the following error.

This message can't be sent right now. Please try again later.
This message can't be sent right now. Please try again later.
[Read more…] about Workaround: Replying to a message with an invalid S/MIME digital signature fails
Print Friendly, PDF & Email

Former Calendar Delegate still receives meeting notifications

By 2 Comments

10 Shares
Share
Tweet
Share
Reddit
Print

Calendar delegation allows a user to manage someone else’s calendar on their behalf. For example, an assistant could be granted delegator rights to their manager’s calendar. Through delegation, the assistant has the right to add, edit, or delete items from their manager’s calendar. A delegate can also be granted the ability to view items marked as private. Aside from calendar permissions, the delegate can receive meeting invites on behalf of the delegator and respond to those invites (accept, decline, tentative, propose new time).

When an assistant no longer needs to access their manager’s calendar, they can be removed as a delegate. Either the manager can do this via the Outlook client or an Exchange administrator by using PowerShell. When their delegation rights have been removed, all access to the calendar is revoked. In addition, meeting invites are no longer sent to the delegate to accept or decline.

It is possible that even when the delegate permissions have been revoked, the assistant could still unexpectantly receive items sent to their manager. In this article, we look at a couple of possible areas that could be forwarding these items to the former delegate.

Let’s get started!

Verify the user is no longer a delegate

The first item to confirm is whether the delegate rights have been properly removed. To do this, connect to Exchange PowerShell and run the following command.

 C:\> Get-MailboxFolderPermission -Identity river.song@xyz.com:\Calendar

FolderName            User                  AccessRights
----------            ----                  ------------
Calendar              Default               {AvailabilityOnly}
Calendar              Rory Williams         {Editor}

In the example above, we are checking the calendar permissions for the user River Song. We use the Get-MailboxFolderPermission command for this purpose. The Identity parameter is a combination of the delegator’s email address and the folder in question. In this case, the calendar folder. You can also use this command against any other folder in the mailbox. In our example, we want to see if River Song’s former assistant, Amy Pond, still has any rights to River’s calendar.

The example output returns two entries. The first is for a user named Rory Williams. We see Rory Williams has editor rights to River’s calendar. We also see a user named Default. Default is the default permission users receive if they have not been granted explicit permissions. In the example above, Rory Williams would receive editor rights to River’s calendar, whereas all other users will only see River’s free/busy information (availability only). Amy Pond is not identified in this output, so she should only receive free/busy information. In this example, Amy is not a delegate.

If the output had returned Amy Pond as a user, we could remove those rights using the Remove-MailboxFolderPermission. For example, to remove all of Amy’s permissions from River’s calendar folder, we would issue the following command.

 C:\> Remove-MailboxFolderPermission -Identity river.song@xyz.com:\Calendar 
-User amy.pond@xyz.com
[Read more…] about Former Calendar Delegate still receives meeting notifications
Print Friendly, PDF & Email