# Prof-IT > Securing Your Digital Future. ## Posts - [How to send an encrypted email message](https://prof-it.services/how-to-send-an-encrypted-email-message/): To send a message with encryption, compose a new message, select the Options ribbon, and then select Encrypt. You can choose Encrypt or Do Not Forward. Read an encrypted email message using Outlook.com or Microsoft 365 If you’re using Outlook.com or Microsoft 365 with new Outlook, Outlook for Mac, Outlook.com, or the Outlook mobile app, you can read and reply to encrypted messages the same way you do with unencrypted messages. If you’re using a third-party email app, you’ll receive an email message with instructions for how to read the encrypted message. You can gain access using your Microsoft account or your Microsoft 365 account. Read an ... Read more - [Why You Should Only Use Intune Compliant Devices in Your Organization](https://prof-it.services/why-you-should-only-use-intune-compliant-devices-in-your-organization/): In today’s threat landscape, cybercriminals are getting smarter, and phishing attacks are more sophisticated than ever. Attackers use tools like Evilginx to bypass traditional security measures by stealing session tokens, or they simply export cookies from browsers on a compromised device, and they can impersonate users without ever needing their passwords or MFA codes. Possibly resulting in data dumps or invoice fraud. But what if there was a way to render these attacks completely useless? This is where Entra ID & Conditional Access with Intune Compliance Enforcement come in—providing an ironclad security posture that ensures your workforce operates within a ... Read more - [SOAR: Block Log Analytics IP Entities on Azure Frontdoor / WAF #3](https://prof-it.services/soar-block-log-analytics-ip-entities-on-azure-frontdoor-waf-3/): How it works Previously, I’ve blogged about two variants that we used at Prof-IT Services to block malicious IP addresses on Azure Frontdoor that were going over a certain threshold. We’ve now created a more simplified version, that only uses a C# function app, managed identity, and log analytics workspace. Blocking abusive IP addresses that hit a certain threshold, prevents Treat Actors from finding vulnerabilities, as there is a maximum amount of request they can attempt before all traffic is blocked. The KQL query in this blog returns IP addresses that have more than 500 blocked requests in a time ... Read more - [The G-Door: Microsoft 365 & the risk of unmanaged Google Doc accounts](https://prof-it.services/the-g-door-microsoft-365-the-risk-of-unmanaged-google-doc-accounts/): It’s time to secure Google Workspace—even if you’re not using it. Read about our recent discovered vulnerability, called 'G-Door', which allows users to bypass Microsoft 365 conditional access rules. - [Automating Azure SQL Maintenance with Azure Automation](https://prof-it.services/automating-azure-sql-maintenance-with-azure-automation/): Keeping Your Azure SQL Databases Healthy: The Power of Automation In the realm of database management, maintaining optimal performance and storage efficiency for your Azure SQL Elastic pool and databases is critical. SQL databases are the backbone of countless business applications, supporting everything from transaction processing to analytics. However, as they grow over time, they can face challenges like bloated storage, performance issues, and cost inefficiencies. That’s where our automated maintenance script comes in. This blog will explore what this script does, why it is crucial for good database health, and why every database administrator should consider such automated solutions. ... Read more - [New User Instructions](https://prof-it.services/new-user-instructions/): Welcome! Follow these instructions to properly configure your account. Feel free to reach out to jpot@prof-it.services at any time if you have questions. You can sign into Windows on a company managed device, if you don’t have access to one yet, you can start out by using Office for Web. First sign in instructions are available in this article: Configure MFA for Office 365 Using Microsoft Authenticator – Prof-IT Services If you already have your dedicated Windows device, follow this article to configure Windows MFA: Windows Hello For Business Multi Factor Authentication (MFA) – Prof-IT Services For your mobile phone, ... Read more - [Sync Teams Folder to OneDrive](https://prof-it.services/sync-teams-folder-to-onedrive/): Introduction If your organization has a Microsoft 365 work or school subscription or uses SharePoint Server 2019 and Teams, you can sync your Microsoft SharePoint and Teams files to a folder on your computer. This lets you work directly in File Explorer and access files even when you’re offline. And when you go back online, any changes made to those files will sync automatically. In this blog we are providing the steps to enable sync to OneDrive for your account. Requirements To set up a Microsoft Teams sync to OneDrive, you must have the following Set up the Team file share ... Read more - [Malware Analysis - Shortcuts in zip file](https://prof-it.services/malware-analysis-shortcuts-in-zip-file/): Recently, we encountered two distinct variants of a payload delivered through Google Drive, both containing a malicious shortcut. While these threats were successfully mitigated, it’s crucial to understand their mechanisms and implement protective measures. In this blog, we’ll dissect these threats and explore strategies for defending against them. Threat Analysis The malicious shortcuts in the zip files were disguised with a PDF icon, concealing their true nature as shortcuts. This tactic is a common trick to deceive users into executing malicious payloads. Shortcut 1:The shortcut executes a command to download a batch file XhFYm3tTsdlS.bat from a remote server and creates ... Read more - [Identifying Duplicate Files Across All SharePoint Sites Using PowerShell](https://prof-it.services/identifying-duplicate-files-across-all-sharepoint-sites-using-powershell/): Managing a SharePoint environment can be a complex task, especially when it comes to ensuring that your storage is being used efficiently. Duplicate files across various sites and document libraries can quickly consume valuable space, slow down search results, and create confusion among users. Fortunately, with the power of PowerShell and the PnP (Patterns and Practices) PowerShell module, you can automate the process of identifying and removing these duplicates. In this blog, we’ll walk you through a PowerShell script that scans all sites in a SharePoint tenant, identifies duplicate files, and generates a comprehensive report. Why Remove Duplicate Files? Duplicate ... Read more - [Session Token Theft in Microsoft 365](https://prof-it.services/how-to-guard-against-cookie-token-theft-for-microsoft-365-teams/): Session hijacking occurs when an attacker steals a valid session token—essentially, the key to a user’s active login session. In the case of Microsoft Teams, once a user logs in, their session token remains active and allows them to continue their work without repeatedly entering their password. While convenient, this token persistence also introduces a risk: if an attacker can obtain the session token, they can potentially access Teams and act as the legitimate user. Cookie File-Based Theft vs. Session Adversary-In-The-Middle (AITM) Theft Cookie file-based theft and session Adversary-in-the-Middle (AITM) theft are both methods attackers use to hijack user sessions, ... Read more - [IT-Boost TOTP Secret Exposure](https://prof-it.services/it-boost-totp-secret-exposure/): IT-Boost’s TOTP secrets were exposed due to browser-based OTP calculations, allowing extraction and potential security risks. ConnectWise released a fix using a secure TOTP API. Users should cycle secrets to prevent breaches. Read more in this blog about the vulnerability, risks, and best practices for secure TOTP implementation. - [Balance Device Wave Groups for granular Intune deployments](https://prof-it.services/balance-device-wave-groups-for-granular-intune-deployments/): We've developed a C# Function App designed to balance devices from a main group into various Wave groups. This app can run on a recurring schedule, rebalancing devices as needed when there are changes in the number of devices due to growth or shrinkage. - [Share files with External Users](https://prof-it.services/share-files-with-external-users/): Follow these steps to share files and folders from OneDrive and SharePoint with external users without inviting them as a guest user. Sharing the document or folder Accessing the document or folder The external user will receive an email, opening the folder or file will require additional verification. - [Platform Upgrade: Microsoft 365 agentless CSS phishing protection](https://prof-it.services/platform-upgrade-microsoft-365-advanced-agentless-phishing-detection/): Exciting news! 🎉 We’ve recently created this advanced CSS phishing protection, and we’re making it available for everyone, for free! Threat Actors (TAs) frequently target finance or accounting personnel, and once they gain access, they often send altered invoices to existing customers with fraudulent account details. Depending on the business, the resulting financial and reputational damage can be severe. In some cases, we’ve observed losses reaching up to $100,000 from a single compromised account. The following examples highlight recent high-value breaches where TAs successfully accessed user accounts. Each of these incidents could have been easily prevented by applying the mitigations ... Read more - [Prof-IT Vulnerability Management](https://prof-it.services/prof-it-vulnerability-management/): An important part of our managed Modern Workplace environment is vulnerability management. We actively monitor and remediate vulnerabilities coming from different platforms, and auto update third-party applications. Users that have devices with third-party applications or operating systems that are not managed will receive weekly update notifications by email, and daily notifications on their Windows desktop. - [Monitoring Dashboard](https://prof-it.services/prof-it-powerbi-monitoring-dashboard/): We keep track and monitor all vital device health and information. A multi-tenant monitoring dashboard is available for admins who would like insights in their respective platforms. Reporting is based on Azure Monitoring, minimum data is imported, costs are billed based on the amount of ingested data. Once onboarding is completed, you can access the dashboard using the following process on portal.azure.com. The group “ModernDeviceManagement” is required for access right, you have to sign out and in before access is activated. Azure Workbooks – Microsoft Azure – open the workbook “ModernDeviceManagement” and click open workbook again. - [Exchange Online External Forwarding Risk - quarantine bypass](https://prof-it.services/exchange-online-external-forwarding-risk-quarantine-bypass/): I’ve recently encountered an issue where malicious email was imported into the Zendesk platform, while it was successfully quarantined by Microsoft 365. In this post, I go over the options to mitigate this threat. The problem lies in the fact that forwarding takes place prior to the email being processed by Microsoft 365’s spam and malware filters. This can lead to the forwarding of malicious emails, thus creating a potential security threat at whoever is receiving the email. The same can be seen when running a message trace (sorted by datetime): There are several methods to solve this issue, depending ... Read more - [Windows Hello For Business Multi Factor Authentication (MFA)](https://prof-it.services/windows-hello-for-business-multi-factor-authentication-mfa/): Additional Factor Configuration Windows Hello For Business sign-ins on physical devices are protected by “additional factors” by default. This ensures that users are not able to sign in with just the pin code without additional verification. Two different factors of the list below are required to securely sign in. PIN, Fingerprint and Hello can be configured in the sign-in options. Follow the steps below. Should Hello or Fingerprint not be available, it is best to connect a mobile phone by bluetooth. Follow the steps below. You can now sign in with PIN and additional factor! Additional factor not available In ... Read more - [Prof-IT Changelog](https://prof-it.services/prof-it-changelog/): 2024.07.28 Changed and renamed several CA rules related to mobile devices 2024.06.12 Raised several OS requirements for mobile devices: 2024.04.* Applocker restrictionsStarting April and onwards, applocker policies will be rolling out to all devices. This will limit locations where executables, scripts and installers will be allowed to launch from. This is to further mitigate possible threats. Details about rules will not be made publicly available. More information about AppLocker: AppLocker – Windows Security | Microsoft LearnSecurity groups for exclusions: Prof-IT Baseline Security Groups – Prof-IT Services WinGet Application UpdatesStarting April and onwards, third-party and Microsofts will be updated by WinGet ... Read more - [Prof-IT Device Conversion & User Onboarding](https://prof-it.services/prof-it-device-conversion-user-onboarding/): All configuration profiles and conditional access rules are deployed during the onboarding project and are targeted to specific user and device groups to allow granular onboarding and different security levels. Users that do not have a dedicated Windows or MAC device that can be managed, should not be onboarded to this baseline. Standard protection with MFA is applied. Users will sign-in with their Microsoft 365 account on Windows after onboarding, this requires their old profiles to be converted with the tool ProfWiz. Windows Professional is required at minimum. - [Prof-IT Baseline Service Description](https://prof-it.services/prof-it-baseline-service-description/): The Modern Workplace baseline is actively developed and updated on regular basis. And includes many best practices and optimizations. Any changes required to the baseline should never be done manually, as this will be overwritten by automation. Always contact Prof-IT for required changes. Optional Platform Settings Conditional Access Configure MFA for Office 365 Using Microsoft Authenticator – Prof-IT Services Windows Hello For Business Users are required to configure WHFB when they first sign in. It’s important to instruct the user on how to use it. Users need to configure a PIN, and optionally Fingerprint or Camera sign-in. MFA sign in ... Read more - [Intune Device Compliance](https://prof-it.services/prof-it-intune-device-compliance/): All devices should be compliance before company resources can be accessed. The compliance policies include the following: Compliance status for all devices can be verified on Devices – Microsoft Intune admin centerClick on the device you want to verify, Device compliance. Common issues Defender for Endpoint status can be an issue if there is a third-part AV installed. Uninstall all that you can find. Defender for Endpoint threat level – compliance issues regarding this should be taken verry seriously as it could indicate there is a threat on the device. Review incidents alerts, and the device on Security & Compliance ... Read more - [Intune Device Compliance and remediation](https://prof-it.services/intune-device-compliance-and-remediation/): Your computer needs to be compliant to be able to access company resources, to verify your enrolled devices, go to: https://portal.manage.microsoft.com/ Common Issues TPM and Secure Boot should be enabled, follow the instructions below to enable these. You will have to reboot your computer and access the Bios Settings. If you are not comfortable to do this, please contact your IT Helpdesk. Windows 11 and Secure Boot – Microsoft Support Enable TPM 2.0 on your PC – Microsoft Support - [Howto: Enroll your Computer](https://prof-it.services/howto-enroll-your-computer/): All computers should be joined to Entra ID, and managed by Intune. To enroll a device through Windows Settings, the device user first adds their Entra account: - [Prof-IT Baseline Security Groups](https://prof-it.services/prof-it-baseline-security-groups/): The Intune environment is granularly configurable based on security groups. Groups are either Device or User groups, identifiable by the prefix. The environment is to target two main groups, which allows for granular enrollment. Device Control Security Groups: User Control Security Groups: - [Microsoft Sentinel: Malicious Inbox Rule V2](https://prof-it.services/microsoft-sentinel-malicious-inbox-rule-v2/): This improved Sentinel Analytics Rule can be used to detect malicious Inbox Rules used by threat actors to hide invoice fraud activity. I've used the Inbox rule currently available as a template within Sentinel, and modified it to alert on Outlook rules I encountered in the wild. - [M365 Account Compromise Checklist](https://prof-it.services/m365-account-compromise-checklist/): A checklist to follow for Microsoft 365 accounts that are compromised - [[PS SCRIPT]: OneDrive Documents Redirection and Status check](https://prof-it.services/ps-script-onedrive-documents-redirection-and-status-check/): How do you ensure each endpoint is properly synced and redirected? What if important data is lost due to a misconfiguration? Run this script from RMM or Intune Proactive Remediations in the user context. Exit 1 and output are generated when issues occur. Do you need help with your Modern Workplace? Check out our service page! Don’t miss out on this related post! [PS SCRIPT]: Detecting Unlinked OneDrive SharePoint Document Libraries on Endpoints – Prof-IT Services - [Microsoft 365 Security / Necessities / Checklist](https://prof-it.services/microsoft-365-security-necessities/): Microsoft 365 is often considered safe, as it's always up to date and maintained by Microsoft. Unfortunately, this is not true! Well, at least some parts aren't. There are quite some options and products/features that should be configured to limit risk and exposure. In this post, I’m outlining the most important security settings and products, everyone should implement. - [Install Defender for Endpoint on Android](https://prof-it.services/install-windows-defender-for-endpoint-on-android/): Defender will protect your device from accessing malicious websites, and alert on outdated iOS versions which could be a security risk. No internet traffic is analyzed, nor are applications monitored. Follow the steps below to secure your device. Step 1 Go to the Play Store and Search for Microsoft Defender Endpoint then click Install to install the app Step 2 Open Microsoft Defender ATP Step 3 Click Get Started Step 4 Follow the on-screen instructions to complete onboarding the app. The details include end-user acceptance of Android permissions required by Defender for Endpoint on Android. - [Install Defender for Endpoint on iOS](https://prof-it.services/install-windows-defender-for-endpoint-on-ios/): Defender will protect your device from accessing malicious websites, and alert on outdated iOS versions which could be a security risk. No internet traffic is analyzed, nor are applications monitored. Follow the steps below to secure your device. Step 1 Go to the App Store and Search for Microsoft Defender Endpoint then click Get to install the application. Step 2 Open MSDefender Step 3 Click Get Started Step 4 Follow the on-screen instructions and add a VPN profile when prompted. Step 5 Defender should display it is protected and no action is needed. - [Send email from a second email address, Alias or shared mailbox with Microsoft 365.](https://prof-it.services/send-email-from-a-second-email-address-alias-or-shared-mailbox-with-microsoft-365/): There are multiple options that can be used to send email from an extra email address. 1. Send email from an Alias that is linked to your main account and mailbox. 2. Leveraging a Shared Mailbox. The process for Windows clients is the same as option #1. For Outlook Mobile: Click on the Home icon on the top left, and follow the steps as shown in the image below (from left to right). The shared mailbox is shown as a separate mailbox in the account list. Follow this article if you have not set up Outlook with your main account: ... Read more - [Enroll your Work Android device in Microsoft Intune (QR code enrollment)](https://prof-it.services/enroll-your-work-android-device-in-microsoft-intune-qr-code-enrollment/): Follow these instructions to enroll your company phone with a QR code. You can only enroll your phone when you first turn it on, or after a factory reset. If you have trouble accessing your organization’s resources, you might need to update additional settings on your device. Sign in to the Microsoft Intune app to check for required updates. - [Get Entra ID User Group Membership with PowerShell on endpoints](https://prof-it.services/get-entra-id-user-group-membership-with-powershell-on-endpoints/): Use this PowerShell script and Azure logic app to get the Entra ID Group membership of a user in a safe and secure way. I’ve created this solution to be able to execute certain code based on the user’s group membership. Back in the day it would be easy to request the user’s group memberships with whoami /groups and you’re all set. This changed with Entra ID joined devices. In this blog I use a logic app to read the group membership, which is more secure vs using an appid and secret and connect to graph directly on endpoints, since ... Read more - [Enroll your Personal Android device in Microsoft Intune](https://prof-it.services/enroll-your-android-device-in-microsoft-intune/): There are multiple ways you can enroll your Android device into Intune. This article assumes you want to enroll your personal mobile phone with a work profile, managing only work apps. Watch this video tutorial for instructions on how to enroll your personal Android device in Microsoft Intune: https://www.youtube.com/watch?v=9Dl8HsGk4tI - [Enroll your iOS device in Microsoft Intune](https://prof-it.services/enroll-your-ios-device-in-microsoft-intune/): Watch this video tutorial for instructions on how to enroll your iOS device in Microsoft Intune: https://www.youtube.com/watch?v=mJyv6YcHi7c - [Set Up Office 365 Email on Your iPhone Using the Native App](https://prof-it.services/how-to-set-up-office-365-email-on-your-iphone-using-the-native-app/): #1) Advanced security policies could prevent you from using the native Mail app, and require you to onboard into Microsoft Intune first. Find how to here: https://prof-it.services/category/microsoft-365/intune/ #2) It’s not possible to connect to shared mailboxes in the native iOS mail app, use the Outlook app instead. Follow these step-by-step instructions to set up your Office 365 email on your iPhone, or watch this video tutorial: https://www.youtube.com/watch?v=mMpE0ZtqYP0 Step 1: Open Settings Step 2: Access Passwords & Accounts Step 3: Add Account Step 4: Choose Microsoft Exchange Step 5: Enter Your Email Address Step 6: Sign in with Microsoft Step 7: ... Read more - [Set Up Office 365 Email on Your iPhone Using the Outlook App](https://prof-it.services/how-to-set-up-office-365-email-on-your-iphone-using-the-outlook-app/): Follow these step-by-step instructions to set up your Office 365 email on your iPhone using the Outlook app: Step 1: Download and Install the Outlook App Step 2: Open the Outlook App Step 3: Get Started Step 4: Enter Your Email Address Step 5: Enter Your Office 365 Password Step 6: Grant Permissions (if prompted) Step 7: Customize Your Inbox (Optional) Step 8: Add Another Account or Go to Inbox Step 9: Verify Email Setup Your Office 365 email account is now set up on your iPhone using the Outlook app, and you can send and receive emails, sync your ... Read more - [Configure MFA for Microsoft 365 Using Microsoft Authenticator](https://prof-it.services/configure-mfa-for-office-365-using-microsoft-authenticator/): Follow these step-by-step instructions to configure Multi-Factor Authentication (MFA) for your Office 365 account using the Microsoft Authenticator app, or watch this video tutorial: Overview of multi factor authentication Step 1: Download and Install the Microsoft Authenticator App Step 2: Sign in to Office 365, order sign into your managed company Windows device. Step 3: MFA Activation Prompt Step 4: Set Up the Microsoft Authenticator App Step 5: Add Your Office 365 Account to Microsoft Authenticator Step 6: Scan the QR Code Step 7: Verify Your Account Step 8: Complete MFA Setup Your Office 365 account is now protected by ... Read more - [YubiKey Setup for Microsoft 365](https://prof-it.services/yubikey-setup-for-microsoft-365/): Follow these instructions to link a YubiKey security token to your account, which allows you to sign in on Microsoft Online Services such as Microsoft 365 and Office, but also on managed Windows computers. 1: Go to the following website on a computer that is allowed to connect to company resources: https://mysignins.microsoft.com/security-info 6: On the next two screens, confirmation will be requested to access and configure the YubiKey. Confirm twice by clicking OK. All Set! From now on, you can sign into Windows and M365 with your YubiKey! - [[PS SCRIPT]: Detecting Unlinked OneDrive SharePoint Document Libraries on Endpoints](https://prof-it.services/detecting-unsynced-onedrive-sharepoint-document-libraries/): What happens with data that exists only locally on a Device? When users manually create a folder on their device, within the root directory of the SharePoint OneDrive Folder, it exists only locally, it’s un-synced and lacks the cloud functionality and benefits of SharePoint including file versioning and backups. I was unable to prevent users from creating folders. However, I was able to create a detection script, which can prevent users from losing important company data. The script can be run as system, as it loops through all user profiles. When executed, it loops through the OneDrive folders for all ... Read more - [Streamlining Intune: Automate Changing Device Names to include Primary user UPN](https://prof-it.services/streamlining-intune-changing-device-names-to-include-primary-user-upn-for-enhanced-management/): Follow the steps in this blog to seamlessly rename your Intune devices, appending the primary assigned user’s UPN along with a random suffix. I’ve created this Logic App that renames the devices as the Intune options are limited to the serial number and random generated values. Both are not easy to work with. I’ve chosen a random GUID, as some devices have serial numbers such as “0”, “DefaultString” or “ToBeFilledByOEM”. This logic app will rename devices to PREFIX-UPN+RANDOM. There is a 15 character device name limit, because of this the UPN is stripped, and the prefix should be 3 characters ... Read more - [Azure App Service Pmv3 deployment & migration](https://prof-it.services/azure-appservice-pmv3-deployment-migration/): Microsoft has released a new Azure Mv3 series App Service Plan, which has double the amount of ram. In this blog I explain how to deploy and migrate your existing web apps. The M series are hosted on different servers, you won’t be able to upgrade or scale to this plan. The subnet also can’t be the same as the original plan. Start by creating the new M series App Service Plan, when I deployed it, it was only available by Bash and not in the portal. That was easy! Migrating the web apps is a bit trickier; you can ... Read more - [HaloPSA Device Name Asset Tag Sync in C#](https://prof-it.services/halopsa-device-name-asset-tag-sync-in-c/): To make life a bit easier, I’ve written this C# .NET Core Console application to sync the asset device names to the Asset Tag so it is visible in the HaloPSA portal. The application loops through all the devices separately, so you might want to run it not too often to prevent rate limits. In short: Install Visual Studio Community, create a .NET Core Project, install the using packages with the NuGet package manager, and replace the variables in Bold with your specific HaloPSA and API credentials. You can also find the source on my github. - [Azure Storage Account File Shares - Lessons learned](https://prof-it.services/azure-storage-account-file-shares-lessons-learned/): Azure File Shares do not behave the same as a SMB share hosted on a Windows Server and there are challenges when you connect from non-domain joined computers. In this blog I’ll go over the lessons I learned implementing them. Feel free to shoot me a message on LinkedIn if you need help with any of these steps! DFS Namespaces – Important! DFS-N is vital for a good experience. Azure File Shares no not have an \\server\IPC$ root share, access is blocked and Office applications and Explorer do not like this resulting in a regularly +- 30 seconds hang. Explorer ... Read more - [Synchronize SharePoint libraries on endpoints by leveraging PS, Logic Apps and Entra ID Group memberships!](https://prof-it.services/sync-sharepoint-document-librarys-and-folders-with-azure-ad-group-assignments/): Use this PowerShell script and Azure logic app to sync library’s based on Azure AD Group assignments. Ever had to Sync 100 folders to 10 or more different security groups, and didn’t want to create configuration profiles for each group? Or had to wait up to 8 hours before Intune finally synced the sites? Back in the day it would be easy based on the user’s groups, a script with whoami /groups and you’re all set. This changed with Azure AD. I’ve come up with a way that handles this, which will save you time and gives you more control. ... Read more - [SOAR: Block Log Analytics IP Entities on Azure Frontdoor / WAF #2](https://prof-it.services/block-sentinel-log-analytics-entities-on-azure-waf-2/): Use this function and logic app, to block abusive IP addresses using a custom rule, that hit a certain block limit on Azure WAF / Frontdoor. Leveraging Log Analytics Alerts. This greatly improves security for your origins, as threat actors won’t be able to scan indefinitely (or until rate limit is reached) for vulnerabilities. In a previous blog I published details on how to block IP addresses from Sentinel. I recently found out Sentinel has a limit of max 10 entities, making it less suitable for sites with more traffic and frequent attacks. For this reason, I’ve modified the script ... Read more - [Automate Azure SQL Backup with Private Links leveraging PowerShell and Automation Accounts](https://prof-it.services/azure-sql-backup-with-private-links/): Azure SQL Services work great, have high availability options, built-in backup functionality, but what if someone breaks into your Azure Tenants and deletes everything!? There are (expensive) SQL backup solutions that use various CPU-intensive techniques to backup databases, but there are Azure native techniques as well by using Az.SQL. The downside is that it’s difficult to automate unless you leave “Azure Services” open in Network Access which is a huge security risk. The Solution I’ve worked on automating this with AzSqlDatabaseExport + NetworkIsolation which leverages Private Links to export the data to Storage Accounts, not requiring any public endpoints. From ... Read more - [SOAR: Block Sentinel IP Entities on Azure Frontdoor / WAF](https://prof-it.services/block-sentinel-entities-on-azure-waf/): Please read blog 2 instead, using Log Analytics is more cost effective and doesn’t have a 10 entity limit. https://potsolutions.nl/2023/05/20/block-sentinel-log-analytics-entities-on-azure-waf-2/ Update 2025.02.22 – Just released blog 3: SOAR: Block Log Analytics IP Entities on Azure Frontdoor / WAF #3 – Prof-IT Azure Frontdoor is a powerful tool for managing web traffic, but it doesn’t always provide enough protection against malicious incoming requests. In particular, it doesn’t have a built-in feature for blocking IP addresses that are scanning for vulnerabilities or behaving abusively. To address this issue, I created a function app that allows you to block abusive hosts for a ... Read more ## Pages - [Knowledge Base](https://prof-it.services/knowledge-base/): Admin Manuals 4 articles Last Updated: February 15, 2025 Platform Documentation 6 articles Last Updated: February 15, 2025 User Manuals 13 articles Last Updated: February 16, 2025 - [Contact Us](https://prof-it.services/contact-us/): Contact Us Anytime If you have any questions or concerns, please do nothesitate to contact us. We would love to hear from you. United States 2578 Broadway #579 New York 10025 +31 20 399 1110 The Netherlands Paxlaan 10 #9129 2131 PZ, Hoofddorp +31 20 399 1110 - [Blog](https://prof-it.services/blog/) - [Modern Workplace](https://prof-it.services/modern-workplace/): Experience a Secure and Efficient Modern Workplace. Built on the robust foundation of the Microsoft 365 platform and fortified with security features from our cutting-edge automation engine, our modern workplace services are designed to provide your users with a stable and user-friendly environment. Within this environment, we ensure that all your valuable data is not just safe but also monitored, assuring you of a secure and hassle-free experience. Some benefits are: A Phish-resistant environment! Microsoft Secure Score of over 80% Permanent Single Sign-On (SSO) to any federated website Automated application deployment Automatic device enrollment (sign-in on any new computer, and ... Read more - [Home](https://prof-it.services/): Simplified & Secure IT Solutions for Every Business Get enterprise-grade security, optimized settings, and full compliance—all at an affordable price. Our solutions leverage Microsoft-native and in-house developed applications, eliminating the need for additional management products. Designed for businesses of all sizes, ranging from 10 to 2000 users, we provide seamless, efficient, and secure IT solutions. Book a Consultation Latest News & Blogs Microsoft 365 Why You Should Only Use Intune Compliant Devices in Your Organization Written by jpot@prof-it.services Azure SOAR: Block Log Analytics IP Entities on Azure Frontdoor / WAF #3 Written by jpot@prof-it.services Security The G-Door: Microsoft 365 & the risk of ... Read more - [Privacy Policy](https://prof-it.services/privacy-policy/): OUR PRIVACY POLICY Prof-IT Services (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, and disclosed by Prof-IT Services. This Privacy Policy applies to our website, and its associated subdomains (collectively, our “Service”) alongside our application, Prof-IT Services. By accessing or using our Service, you signify that you have read, understood, and agree to our collection, storage, use, and disclosure of your personal information as described in this Privacy Policy and our Terms of Service. Definitions and key terms To help explain things as clearly as possible in ... Read more ## Optional - [Agent (MCP protocol)](websites-agents.hostinger.com/prof-it.services/mcp) [comment]: # (Generated by Hostinger Tools Plugin)