☁️
Tminus365 Docs
  • 🚀Welcome to Tminus365 Docs
  • 🔐Security
    • Azure AD (Entra)
      • MFA Shall Be Required for All Users
      • MFA is enforced on accounts with Highly Privileged Roles
      • MFA is enforced for Azure Management
      • MFA registration and usage shall be periodically reviewed
      • Legacy Authentication shall be blocked
      • High Risk Users Shall Be Blocked
      • High Risk Sign-Ins Shall Be Blocked
      • Browser Sessions shall not be persistent for privileged users
      • MFA shall be required to enroll devices to Azure AD
      • Managed Devices shall be required for authentication
      • Guest User Access Shall be restricted
      • The number of users with highly privileged roles shall be limited
      • Users assigned highly privileged roles shall not have permanent permissions
      • Activation of privileged roles should be monitored and require approval
      • Highly privileged accounts shall be cloud-only
      • Highly privileged role assignments shall be periodically reviewed
      • Passwords shall not expire
      • Azure AD Logs shall be collected
      • Only Admins shall be allowed to register 3rd party applications
      • Non-admin users shall be prevented from providing consent to 3rd party applications
      • Authorized Applications shall be configured for Single Sign-On
      • Inactive accounts shall be blocked or deleted
    • Teams
      • Private Channels shall be utilized to restrict access to sensitive information
      • External Participants SHOULD NOT Be Enabled to Request Control of Shared Desktops or Windows in Meet
      • Anonymous Users SHALL NOT Be Enabled to Start Meetings
      • Automatic Admittance to Meetings SHOULD Be Restricted
      • External User Access SHALL Be Restricted
      • Unmanaged User Access SHALL Be Restricted
      • Contact with Skype Users SHALL Be Blocked
      • Teams Email Integration SHALL Be Disabled
      • Only Approved Apps SHOULD Be Installed
      • File Sharing and File Storage Options shall be blocked
      • Only the Meeting Organizer SHOULD Be Able to Record Live Events
      • Attachments SHOULD Be Scanned for Malware
      • Link Protection SHOULD Be Enabled
      • Restrict Users who can Create Teams Channels
      • Teams Channels shall have an expiration policy
      • Data Loss Prevention Solutions SHALL Be Enabled
    • Exchange
      • Automatic Forwarding to External Domains SHALL Be Disabled
      • Sender Policy Framework SHALL Be Enabled
      • DomainKeys Identified Mail SHOULD Be Enabled
      • Domain-Based Message Authentication, Reporting, and Conformance SHALL Be Enabled
      • Enable Email Encryption
      • Simple Mail Transfer Protocol Authentication SHALL Be Disabled
      • Calendar and Contact Sharing SHALL Be Restricted
      • External Sender Warnings SHALL Be Implemented
      • Data Loss Prevention Solutions SHALL Be Enabled
      • Emails SHALL Be Filtered by Attachment File Type
      • Zero-Hour Auto Purge for Malware SHOULD Be Enabled
      • Phishing Protections SHOULD Be Enabled
      • Inbound Anti-Spam Protections SHALL Be Enabled
      • Safe Link Policies SHOULD Be Enabled
      • Safe Attachments SHALL Be Enabled
      • IP Allow Lists SHOULD NOT be Implemented
      • Mailbox Auditing SHALL Be Enabled
      • Alerts SHALL Be Enabled
      • Audit Logging SHALL Be Enabled
      • Enhanced Filtering Shall be configured if a 3rd party email filtering tool is being used
    • SharePoint
      • File and Folder Links Default Sharing Settings SHALL Be Set to Specific People
      • External Sharing SHOULD be Set to “New and Existing Guests”
      • Sensitive SharePoint Sites SHOULD Adjust Their Default Sharing Settings
      • Expiration Times for Guest Access to a Site SHOULD Be Determined by specific needs
      • Users SHALL Be Prevented from Running Custom Scripts
    • OneDrive
      • Anyone Links SHOULD Be Turned Off
      • Expiration Date SHOULD Be Set for Anyone Links
      • Link Permissions SHOULD Be Set to Enabled Anyone Links to View
      • Windows and MacOS devices should be prevented from syncing the OneDrive Client on personal devices
      • Legacy Authentication SHALL Be Blocked
    • Intune
      • Personal Devices should be restricted from enrolling into the MDM solution
      • Devices shall be deleted that haven’t checked in for over 30 days
      • Devices compliance policies shall be configured for every supported device platform
      • Noncompliant devices shall be blocked from accessing corporate resources
      • MFA Shall be required for Intune Enrollment
      • Security Baselines should be configured for Windows Devices
      • Windows Update Rings shall be configured for Windows Devices
      • Update Policies shall be configured for Apple Devices
      • App Protection policies should be created for mobile devices
      • Mobile devices shall only be able to access corporate data through approved client apps
      • Lockout screen and password settings shall be configured for each device
      • Encryption shall be required on all devices
      • Windows Hello for Business should be configured where applicable
      • Authorized Applications should be deployed to managed devices
      • Device Use Shall be restricted until required applications are installed
      • Devices and Applications shall be wiped when a user leaves the organization or reports a lost/stolen
  • ⚙️Configurations
    • GDAP
      • My Automations Break with GDAP: The Fix!
      • Vendor Integrations Break with GDAP: The Fix!
      • Adding GDAP Relationships
      • Leveraging PIM with GDAP
      • GDAP Migration with Microsoft 365 Lighthouse
    • GoDaddy
      • Defederating GoDaddy 365
  • 🛡️CIS Controls
    • CIS Mapped to M365
  • 🔌Vendor Integrations
    • Pax8
      • Automating NCE subscription renewal notices
      • Leveraging the Pax8 API in Power Automate
    • IT Glue
      • Automating Intune Device Documentation in IT Glue
      • Automating Microsoft Documentation
    • Huntress
      • Leveraging the Huntress API in Power Automate
    • Syncro
      • Automating Microsoft 365 Documentation in Syncro
      • Custom Connector in Power Automate
      • Creating Tickets for Azure AD Risky Users
Powered by GitBook
On this page
  • Table of Contents
  • Project Links
  • Screenshots
  • Project Description
  • Information Collected
  • User Story
  • Installation
  • Usage
  • Credits and Reference
  • Tests
  • Contributing
  1. Vendor Integrations
  2. IT Glue

Automating Microsoft Documentation

PreviousAutomating Intune Device Documentation in IT GlueNextHuntress

Last updated 1 year ago

M365 DOCUMENTATION

Table of Contents

  • Project Links

  • Screenshots

  • Project Description

  • User Story

  • Technologies

  • Installation

  • Usage

  • Credits and Reference

  • Tests

  • Contributing

  • Questions

  • License

Project Links

Screenshots

Project Description

The following project was created to house scripts for documenting M365 tenants for customers that you manage. Today the documentation consist of CSV files and flexible assets in IT Glue. These scripts leverage the Secure Application model to create a secure connection to all customers under management in Partner Center.

Information Collected

Microsoft Users

  • DisplayName

  • FirstName

  • UPN

  • Role

  • JobTitle

  • LicensesAssigned

  • LastSignIn

  • createdDateTime

  • accountEnabled

  • AccountType

  • LastPasswordChange

  • PasswordExpiration

  • MFARegistered

  • ExchangeLastActive

  • MailboxStorageUsedGB

  • MailboxItemCount

  • HasArchive

  • AuthMethod:Phone

  • AuthMethod:Email

  • OneDriveLastActive

  • OneDriveStorageUsed

  • OneDriveFileCount

  • OneDriveViewed/EditedFileCount

  • OneDriveSyncedFileCount

  • OneDriveSharedInternalFileCount

  • OneDriveSharedExternalFileCount

  • SharePointLastActive

  • SharePointViewed/EditedFileCount

  • SharePointSyncedFileCount

  • SharePointSharedInternalFileCount

  • SharePointSharedExternalFileCount

  • SharePointVisitedPageCount

  • TeamsLastActive

  • TeamsChatCount

  • TeamsCallCount

  • TeamsMeetingCount

MS Groups

  • GroupName

  • Email

  • Group Type

  • Membership Type

  • Creation Date

  • Source

  • Security Enabled

  • Visibility

  • HideFromGal

  • Teams Connected

  • Owners

  • Members

MS Devices

  • DeviceName

  • Enabled

  • OS

  • Version

  • JoinType

  • UserName

  • ManagementType

  • Compliance

  • DeviceOwnership

  • RegisteredDate

  • LastActivityDate

  • AutopilotEnrolled

  • isEncrypted

  • SerialNumber

SharePoint Sites

  • Site Name

  • Site URL

  • Last Activity Date

  • Site File Count

  • Site Storage Used (GB)

  • Storage Allocated (GB)

  • Microsoft Group Connected

Exchange Settings

  • Legacy Auth Settings

  • Mail Transport Rules

  • OWA Policies

  • Accepted Domains

  • Mobile Device Policies

  • Retention Policies

  • Retention Policy Tags

  • Journal Rules

  • Antiphish Policies

  • Outbound Spam Policies

  • AntiSpam Policies

  • Malware Policies

  • Safe Attachment Policies

  • Safe Link Policies

  • DKIM settings

Azure AD Settings

  • Conditional Acces Policies

  • Legacy Auth Sign Ins

  • Named Locations

  • Self-Service Password Reset Settings

  • Can Users Register Applications

  • Can Users Consent for Applications

Intune Settings

  • Windows Compliance Policies

  • macOS Compliance Policies

  • iOS Compliance Policies

  • Android Compliance Policies

  • Windows Information Protection Policies

  • iOS App Protection Policies

  • Android App Protection Policies

  • Configuration Profiles

  • Applications

  • App Configuration Profiles

User Story

As an MSP, I would like granular documentation on users, groups, and organization settings that can help me be more proactive in managing customer environments.

Installation

  1. Leverage the Create_Auth.ps1 file if you have not already created an app registration to garner tokens for authenticating to customer environments.

  2. Leverage the Remove_AnonymidedReports.ps1 file to ensure all customers have reports that are not anonymized. You could do this at a per customer basis as well.

  3. Fork the repo to modify the scripts or leverage the scripts to start documenting customer environments.

Usage

I would start by running single tenant scripts to see if that creates the information you are looking for and modifying accordingly. This is especially important in IT Glue where you may want to modify the format of the flexible asset.

Credits and Reference

Kelvin Tegelaar for his work on the Secure Application Model that makes this possible. Gavin Stone for his script on garnering info on Conditional Access policies which I reused here. I will be looking to add this information into CIPP at a later date.

Tests

Run against a single customer tenant

Contributing

Open a pull request with any issues or feature enhancements.

🔌
https://github.com/msp4msps/m365_documentation
license
project-languages-used
github-follow
project-top-language