Getting started with Quick Machine Recovery

by

This week is all about a relatively new recovery functionality in Windows. And that functionality is Quick Machine Recovery, which is also known as Cloud Remediation. Quick Machine Recovery is focused on the recovery of Windows devices when encountering critical errors that prevent the device from booting. A huge strength of Quick Machine Recovery is that it can automatically search for remediations online and use that to recover from widespread boot failures. In practice that means that Quick Machine Recovery helps with addressing the most severe failures within the environment. The type of system failures that gets devices stuck in the Windows Recovery Environment (WinRE). The type of system failures that require significant troubleshooting time. And that’s especially challenging when it’s a widespread outage. Quick …

Read more

Blocking Bluetooth on Android devices

by

This week is all about a new configuration option for corporate-owned Android Enterprise devices. That new configuration option is the ability to block the usage of Bluetooth. There can be many different reasons why organizations might want to block the usage of Bluetooth on (some) Android devices within the environment. That could be simply from a functional perspective to preserve battery and to extend the usage time, but that could also be more from a security perspective to prevent the device from being exploited. For the latter think about unauthorized access, data interception, malware distribution, or even something like bluejacking (sending messages to nearby devices). All pretty good reasons to think about the default availability of Bluetooth on Android devices within the environment. Especially on …

Read more

Blocking other browsers with policies for Microsoft Edge (be careful)

by

This week is all about creating awareness. Creating awareness for the configuration options that are available for Microsoft Edge via the Microsoft 365 admin center, also known as the Microsoft Edge management service. The Microsoft Edge management service is an alternative method, besides Microsoft Intune, for configuring the Microsoft Edge browser via the Cloud. The configurations are stored in the Cloud and the settings can be applied through a group assignment. The user must be signed into the browser to receive those settings, and the browser must be restarted to make new settings applicable. So, pretty similar to the capabilities within Microsoft Intune. Besides that, the Microsoft Edge management service also provides access to additional settings, such as organization branding, AI, and specific security settings. …

Read more

Experiencing the app relationship viewer

by

This week is a relatively short blog post, focused on providing awareness for the recently introduced app relationship viewer. The app relationship viewer can be used to see which apps are directly connected to the selected app. Those connected apps are also known as child apps. Child apps can be either dependent apps or superseded apps. A dependent app relationship is an app that is configured as a dependency for the installation of the selected app, and a superseded app relationship is an app that is configured to be superseded by the installation of the selected app. Those relationships are shown within the app relationship viewer. But not just for the selected app, but also for the child apps. This blog post provides a brief …

Read more

Explicitly denying elevation of specified files using Endpoint Privilege Management

by

This week is all about a new feature that was recently introduced in Endpoint Privilege Management (EPM), and that feature is the ability to explicitly deny elevation. Explicitly denying the elevation blocks the specified file from running in elevated context. That enables organizations to work the other way around. Instead of configuring which file elevations are allowed, this enables organizations to allow every elevation with the exception of the elevations of those specifically specified files. Of course, the recommendation is to tightly control which files are allowed to elevate. That is, however, not always the situation that every organization is in. Often simply getting insights into what users are installing is already a huge step forward. Especially in combination with no local administrator privileges. As …

Read more

Getting started with the Microsoft Defender Browser Protection extension for Google Chrome

by

This week is sort of a follow-up on the last couple of weeks. The last couple of weeks the focus was on getting started with the different Microsoft Purview extensions for Google Chrome and Mozilla Firefox, while this week the focus is on getting started with the Microsoft Defender Browser Protection extension for Google Chrome. The Microsoft Defender Browser Protection extension brings protection against online threats, like phishing and malicious websites, functionality known from SmartScreen in Microsoft Edge, to the Google Chrome browser. With that functionality it protects users against threats such as clicking on links in phishing emails and websites that are designed to trick users into downloading and installing malicious software. Of course Google Chrome also provides similar built-in functionality, but that will not …

Read more

Getting started with the Microsoft Purview extension for Mozilla Firefox

by

This week is sort of a follow-up on last week. Last week the focus was on getting started with the Microsoft Purview extension for Google Chrome, while this week the focus is on getting started with the Microsoft Purview extension for Mozilla Firefox. The story around the extension is pretty similar, as the Microsoft Purview extension for Mozilla Firefox extends the Endpoint data loss prevention (Endpoint DLP) capabilities to sensitive items in the Mozilla Firefox browser. And after the installation of that extension, on Windows devices, organizations get the ability to also monitor attempts to access or upload sensitive items to a Cloud service when using the Mozilla Firefox browser, and to actually enforce protective actions via data loss prevention policies. This post will provide a …

Read more

Getting started with the Microsoft Purview extension for Google Chrome

by

This week is all about the Microsoft Purview extension for the Google Chrome browser. Not because it’s something really new, but mainly to create some awareness around its existence. The Microsoft Purview extension for Google Chrome extends the Endpoint data loss prevention (Endpoint DLP) capabilities to sensitive items in the Google Chrome browser. After the installation of the Microsoft Purview extension for Google Chrome, on Windows devices, organizations get the ability to also monitor attempts to access or upload sensitive items to a Cloud service when using the Google Chrome browser, and to actually enforce protective actions via data loss prevention policies. This post will provide a brief overview of the Microsoft Purview extension for the Google Chrome browser, followed with the steps to automatically …

Read more

Preventing scareware with scareware blocker in Microsoft Edge

by

This week is all about a relatively new security feature within the Microsoft Edge browser, and that feature is scareware blocker. Scareware blocker is a security feature to protect against scareware attacks. Scareware attacks often display as full-screen pop-ups with all sorts of warnings claiming that the device has been compromised. The idea behind those attacks is often to frighten users into calling fraudulent support numbers or downloading harmful software. Scareware blocker can automatically detect and stop these attacks, by using machine learning. This post will start with a brief introduction about scareware blocker in Microsoft Edge, followed with the steps to enable it. This post will end with an overview of the user experience. Note: At the moment of writing scareware blocker is still …

Read more

Understanding custom device naming templates for Android devices

by

This week is about another nice new feature for the enrollment of Android Enterprise corporate-owned devices, and that feature is the ability to use custom device naming templates. Custom device naming templates enable IT administrators to adjust the name of Android Enterprise corporate-owned devices during the enrollment. That provides IT administrators with the ability to adhere naming conventions to their devices and with that organize the devices neatly within the console. That can also make it a whole lot easier to locate devices. This post will focus on the required configurations for using custom device naming templates for Android Enterprise corporate-owned devices. Note: Keep in mind that custom device naming templates will adjust the management name of the device. Introducing custom device naming templates for Android devices …

Read more