In this guest blog post, Simon Tuson, Senior Product Specialist, Product Innovation at Stibo Systems, explores the advantages of master data management deployments on Microsoft Fabric and how Stibo Systems can help.

Data is crucial to business success because it provides the insights needed to make informed decisions, optimize operations, and drive growth. Often, businesses ignore the investment behind that data. Let me explain how to maximize the return on your investment in master data management (MDM) by using Microsoft Fabric to extract every ounce of value from it.

Master data management adds value across business functions

Master data management is a business process requiring capable implementation to help companies curate their most trusted data across domains such as product, customer, location, and supplier. This data is critical for business operations to work effectively. Master data is an essential centerpiece for analytics purposes – serving as the single source of truth, or golden layer, of said data domains that underpin business intelligence (BI) and reporting on supply chain, sales, returns, and more. (The idea of a golden layer comes from the medallion lakehouse architecture, where data is ingested at the bronze layer, undergoes validation at the silver layer, and enhances business at the gold layer.) High-quality data is also critical to train high-performing machine learning (ML) models for predictive and prescriptive purposes such as forecasts.

Being able to leverage master data in a company’s BI platform is therefore instrumental to drive critical insights on business performance, such as financial performance, environmental, social, and governance performance (ESG), and other critical success factors.

Master data management multiplies the analytic power of Microsoft Fabric

Managing enterprise data can involve thousands of attributes, hundreds of relationships, and millions of records spread across disparate, often siloed systems. The ability to acquire, manage, and share information across the enterprise, and with ecosystem partners and customers – while providing governance to maintain integrity – requires a more agile, strategic solution, ready to address complex challenges.

Microsoft Fabric is well placed to support the need for delivering insights into activities such as data acquisition and data preparation, artificial intelligence (AI) tools for data science, and, importantly in this context, business intelligence through Microsoft Power BI. The Fabric platform integrates data sources into a cohesive stack to enable enterprises to perform end-to-end analytics. However, without master data from a properly curated master data management platform, little value can be gained from the insights.

Master data management adds value as a data source to Fabric in that it provides a trustworthy source of data across one or more data domains. Furthermore, a mature master data management platform will allow you to create and share collections of data that are targeted to specific business groups and needs, allowing you to avoid the ambiguity of unnecessary data and instead package data ready for consumption by applications within Fabric.

Figure 1: Multidomain master data management (MDM) and other data sources feed into Microsoft Fabric, which makes the validated data available to multiple data consumer groups.

Enhance Microsoft Fabric with Stibo Systems’ MDM

Recognized by Forrester as a leader in the management of multidomain enterprise data, Stibo Systems is a driving force between forward-thinking companies seeking to unlock the strategic value of their master data. Stibo Systems’ software-as-a-service MDM platform, in combination with its cloud-native data-as-a-service (DaaS) technology, offers not only the native capabilities to curate and control a company’s master data across domains through carefully designed data governance processes and capabilities, but also through its native integration with Microsoft Fabric.

With Stibo Systems, businesses can deliver master data to Microsoft Fabric as silver layer validated data tailored to the needs of data consumers, hence bypassing the bronze layer raw data, by utilizing preconfigured notebooks performing GraphQL queries against curated master data served at scale by the DaaS platform. Stibo Systems’ MDM makes data stored in legacy systems accessible, while enabling compliance reporting, dynamic marketing, supply chain optimization, and more by using AI and ML.

Companies can also serve up master data in combination with other data sources such as transactional data to build the insights they need to run the business. As a nice add-in to the integration, Stibo Systems’ master data management platform offers the capability to integrate Microsoft Power BI dashboards back into its user experience, enabling data stewards to act on data based on the reports they get from the platform.

Stibo Systems offers an end-to-end solution encompassing governed multidomain master data management, DaaS, and integration with Microsoft Fabric for end-to-end analytics and BI to drive business insights. If you’re interested in making informed decisions and achieving your goals, you can purchase Stibo Systems Master Data Management directly from the Microsoft Azure Marketplace. You can also learn more about the growing number of companies that have benefited from the dedication, professionalism, and impact of working with Stibo Systems.

​Microsoft Tech Community – Latest Blogs –Read More 

Hello there, I hope someone is able to help. I have a problem I am trying to solve involving two sheets.

I have attached screenshots, which I hope will be useful in understanding what I am trying to achieve here. 

Take a look at the formula in H7 on the Void Tracker. It’s nearly there, but it isn’t quite working. What I’m trying to get it to do is to look at column B in the property list and find all the properties listed as Void for all the cells in Column D with the address “99 The Avenue” in column D and return all the relevant rooms in column E. So, what I want it to do, is return me a list of “Room 2 Room 3 Room 4” in Cell H7 of the void tracker, as those rooms are listed as Void in column B under that address. It should not return Room 1 as that is not listed as Void.

However, it isn’t doing what I want, as you can see. The cell value that it is retuning is E14 of the Property list, but it’s just retuning that cell value four times.

If anyone can help, I’d greatly appreciate it.

Many thanks.

​Hello there, I hope someone is able to help. I have a problem I am trying to solve involving two sheets.I have attached screenshots, which I hope will be useful in understanding what I am trying to achieve here. Take a look at the formula in H7 on the Void Tracker. It’s nearly there, but it isn’t quite working. What I’m trying to get it to do is to look at column B in the property list and find all the properties listed as Void for all the cells in Column D with the address “99 The Avenue” in column D and return all the relevant rooms in column E. So, what I want it to do, is return me a list of “Room 2 Room 3 Room 4” in Cell H7 of the void tracker, as those rooms are listed as Void in column B under that address. It should not return Room 1 as that is not listed as Void. However, it isn’t doing what I want, as you can see. The cell value that it is retuning is E14 of the Property list, but it’s just retuning that cell value four times.If anyone can help, I’d greatly appreciate it. Many thanks.   Read More

​

This is Part 2 of our Blog series on how to collect events using DCRs for advanced use cases. For Part 1, please check The power of Data Collection Rules: Collecting events for advanced use cases in Microsoft USOP – Microsoft Community Hub.

PowerShell is a great tool for administrators to manage devices and servers in their environment. When using it to administer remote systems with PSRemoting, you don’t leave credentials behind on the target systems – as opposed to RDP with which your credentials would be stored in the Local Security Authority (LSA). This provides many security benefits and helps prevent Pass-The-Hash attacks and other credential theft scenarios

Since it is a preinstalled tool, adversaries have been known to use PowerShell to attack organizations. Companies that have set up a robust PowerShell configuration and monitoring have a clear advantage against those adversaries! Thanks to PowerShell’s numerous built-in security and monitoring features, it is easy to detect and disrupt adversaries.

In this article we will look how you can set up your own monitoring mechanism to spot executed PowerShell code in your environment using Microsoft Sentinel and the Unified SecOps Platform. We will not discuss the various security features that can be configured for a robust PowerShell environment, there are other resources for it, as mentioned in our first article A good resource to learn more about PowerShell security is for example the book “PowerShell Automation and Scripting for Cybersecurity: Hacking and defense for red and blue teamers” written by Miriam C. Wiesner: https://aka.ms/mw-book.

Step 1: Configure ScriptBlockLogging

In PowerShell, you can imagine a script block as a collection of commands and expressions that are executed together as one command: the “script block”.

Many companies become aware to the importance of logging only after an incident has occurred. At that point, it is not possible to detect what happened. Therefore, the PowerShell team decided to implement basic script block logging, starting with PowerShell 5, which can be useful to trace malicious activities performed prior to the incident.

The basic script block logging feature only captures some basic security-relevant script blocks as the default if not configured otherwise. This way, in case of a security incident, you have insights of what basic malicious activities were executed on your machine, however this also means that with this default configuration not every activity is captured. Therefore, to keep track of all the activities on business-critical servers and high value assets, we need to configure script block logging before we can start collecting and reviewing all relevant events.

This can be done by using Group Policy. Depending on the PowerShell version for which you want to configure script block logging, navigate to the following GPO path(s):

Windows PowerShell: Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging
PowerShell Core: Computer Configuration > Administrative Templates > PowerShell Core > Turn on PowerShell Script Block Logging

Configure this Setting as “Enabled” and confirm with “OK”. Do not check the box to “Log script block invocation start / stop events” as this setting is verbose and would generate a lot of noise.

If you have both PowerShell versions in use in your environment, we recommend configuring and monitoring both.

In the PowerShell Core policy, you can find an option to “Use Windows PowerShell Policy Setting”. Unless you have a use case to have different configurations for both versions, you can simply enable this option to sync your Windows PowerShell script block settings.

Please note that the PowerShell Core administrative template files (*.admx)might need to be imported first before you can use them. This article points out how you can locate and install them: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_group_policy_settings

Step 2: Detect and review executed PowerShell code

Now that you have configured everything, it is time to collect PowerShell script block logging events and review the executed code.  The following script retrieves and filters event ID 4104 from both Windows PowerShell and PowerShell Core (excluding certain paths and user IDs) and then formats and displays the filtered event details :

$PSWinEventLog = @{ ProviderName = “Microsoft-Windows-PowerShell”; Id = 4104 }

$PSCoreEventLog = @{ ProviderName = “PowerShellCore”; Id = 4104 }

$PSWinEventLog, $PSCoreEventLog | ForEach-Object {
try {
Get-WinEvent -FilterHashtable $_ | Where-Object {
!($_.Properties[4].Value -Match “C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\”) `
-and ($_.Properties[2].Value -ne “prompt”) `
-and ($_.UserId -ne “S-1-5-18”) `
-and ($_.UserId -ne “S-1-5-19”) `
-and !( $_.Properties[4].Value -Match “.vscode\extensions\”) `
-and !($_.Properties[4].Value -Match “C:\Windows\TEMP\SDIAG_([A-Za-z0-9]+(-[A-Za-z0-9]+)+)\CL_Utility.ps1”)
} | Select-Object TimeCreated, `
@{Name=’ExecutedCode’;Expression={ $_.Properties[2].Value }},`
UserId, `
LevelDisplayName, `
@{Name=’Path’;Expression={$_.Properties[4].Value}}, `
ProviderName, `
@{Name=’ScriptblockId’;Expression={$_.Properties[3].Value}},`
@{Name=’CurrentPart’;Expression={$_.Properties[0].Value}},`
@{Name=’TotalParts’;Expression={$_.Properties[1].Value}}`
| fl
}
catch {}

PowerShell script block events can be split into multiple events if the executed script block was too large. In that case, the “CurrentPart” field would indicate this by containing a value higher than 1. The “CurrentPart” field indicates the order of the script block pieces.

It is recommended to adjust this query to your environment; are there script blocks that are being run by certain programs in your environment that you can safely exclude from your review. You can use the following documentation as a reference for filtering: Creating Get-WinEvent queries with FilterHashtable – PowerShell | Microsoft Learn.

PowerShell is a great tool for administrators to manage devices and servers in their environment. When using it to administer remote

PowerShell script block events can be split into multiple events if the executed script block was too large. In that case, the “CurrentPart” field would indicate this by containing a value higher than 1. The “CurrentPart” field indicates the order of the script block pieces.

It is recommended to adjust this query to your environment; are there script blocks that are being run by certain programs in your environment that you can safely exclude from your review. You can use the following documentation as a reference for filtering: Creating Get-WinEvent queries with FilterHashtable – PowerShell | Microsoft Learn.

Step 3: Configure the data collection Rule (DCR) to collect the required events

Using the Azure Monitor agent (AMA), you can select the events you would like to collect from your servers using Xpath queries (please see Filter Windows events using Xpath queries for reference). If you are not familiar with the agent or you have not installed AMA yet in the servers you would like to monitor, please check the first article of this series: include link.

To create your DCR, as this time we are collecting non-Security events, go to Connectors and select Windows Forwarded Events. From here, select create DCR, add your servers, and under Collect select Custom. Paste the following xPath queries:

For Windows PowerShell:  

Microsoft-Windows-PowerShell/Operational!*[System[(EventID=4104)]]

For PowerShell Core:

PowerShellCore/Operational!*[System[(EventID=4104)]]

To prevent getting events that we don’t need (e.g. events from background processes or system accounts), based on the query we constructed in Step 2, we can create a transformation in our DCR that will prevent those events from being ingested into Microsoft Sentinel, as they could be too verbose and we may not need them. For this purpose, you can add this transformation in your DCR:

“transformKql”: “source | where SystemUserId !in (‘S-1-5-18’, ‘S-1-5-19’) | extend ScriptBlockText = parse_json(EventData).ScriptBlockText, ScriptBlockId = tostring(EventData.ScriptBlockId), MessageNumber = tostring(EventData.MessageNumber), MessageTotal = tostring(EventData.MessageTotal), Path = tostring(EventData.Path) | where tostring(ScriptBlockText) != ‘prompt’ | where Path != ‘.vscode\\extensions\\’ and Path != ‘C:\\Windows\\TEMP\\SDIAG_([A-Za-z0-9]+(-[A-Za-z0-9]+)+)\\CL_Utility.ps1’ and Path != ‘C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\DataCollection\\'”

Alternatively, you can deploy this template from GitHub, which already includes the xPath queries described above, plus the transformation: Azure-Sentinel/DataConnectors/WindowsEvents/DataCollectionRulePowerShellEvents at master · Azure/Azure-Sentinel (github.com)

Step 4: Creating your detections

Now, we can go to Microsoft Sentinel or to the Unified security operations platform, which brings Microsoft Sentinel and Microsoft Defender XDR into a single unified portal (see how to Connect Microsoft Sentinel to Microsoft Defender XDR) and start querying your logs and generate detections.

It also makes sense to monitor for devices that never ran PowerShell code before, from which PowerShell code is executed unexpectedly. Are there devices that should never run PowerShell code (e.g. devices from Accounting or Marketing)? For this purpose, we could use a watchlist. Watchlists allow you to create a list of items you would like to use for correlation (e.g. high-value assets, terminated employees, service accounts, etc.). In our scenario, we have created a watchlist that determines to which team the machine belongs (Operations, Security, Marketing).

First, let’s have a look at our logs. On Microsoft Defender XDR, we can find them under Advanced Hunting. We are using this query to detect machines that are not part of the groups (Security and Operations) that we would expect to run PowerShell code using this query:

let AllowedGroups = dynamic([“Security”,”Operations”]);
WindowsEvent
| where EventID == 4104
| extend ScriptBlockText = parse_json(EventData).ScriptBlockText, ScriptBlockId = tostring(EventData.ScriptBlockId), MessageNumber = tostring(EventData.MessageNumber), MessageTotal = tostring(EventData.MessageTotal), Path = tostring(EventData.Path)
| lookup kind=inner _GetWatchlist(‘devicegroups’) on $left.Computer == $right.SearchKey
| where Group !in (AllowedGroups)
| project TimeGenerated, ScriptBlockText, SystemUserId, DeviceName, Group, EventLevelName, Path, MessageNumber, MessageTotal, ScriptBlockId, Channel
| sort by TimeGenerated, ScriptBlockId, MessageNumber

Above, we can see what machines that were not from the expected departments have ran PowerShell code.

After polishing our watchlist and query, we are ready to create a detection under Analytics:

Please remember to match the Host entity under “Entity mapping” when you create your analytic rule. This is critical for correlation across data sources and alerts.

This concludes Part 2 of our 3 Part blog series on how to collect events using DCRs for advanced use cases. For Part 1, please check The power of Data Collection Rules: Collecting events for advanced use cases in Microsoft USOP – Microsoft Community Hub, and stay tuned for Part 3, in which we show how to monitor for indications that Defender for Endpoint (MDE) was shut down.

We welcome your feedback and questions on this or any of the other parts of this blog article series and look forward to hearing from you.

Miriam Wiesner (@miriamxyra) – Senior Security Research PM for Microsoft Defender XDR | Maria de Sousa-Valadas Castaño – Senior Product Manager Unified SocOps Platform | Shirley Kochavi – Unified SocOps Platform

​Microsoft Tech Community – Latest Blogs –Read More 

I have inherited a spreadsheet which has pivot tables based on a named range. I am trying to make changes to the source data but I cant seem to find it. I can see the name in hte cell reference box but when i click on it nothing happens. It doesnt appear in the Name Manager. I have tried the find and GoTo the name range but nothing is happening. The person who created the spreadsheet is no longer available and it is to large to start from scracth. Any suggestions?

By the way I have searched for suggestions and have tried to click on the name in the cell reference field and i have also used the GoTo they have not worked. I can see the name but it is not taking me to the cell range

Thanks in advance

​I have inherited a spreadsheet which has pivot tables based on a named range. I am trying to make changes to the source data but I cant seem to find it. I can see the name in hte cell reference box but when i click on it nothing happens. It doesnt appear in the Name Manager. I have tried the find and GoTo the name range but nothing is happening. The person who created the spreadsheet is no longer available and it is to large to start from scracth. Any suggestions? By the way I have searched for suggestions and have tried to click on the name in the cell reference field and i have also used the GoTo they have not worked. I can see the name but it is not taking me to the cell range Thanks in advance  Read More

​

Hi,

​Hi, 1. Can anyone tell me the future roadmap for the User Profile Service Application (UPSA) in SharePoint Online? I know the UPSA is in the classic mode but it would be good to know if it is set to be deprecated by Microsoft in a number of years? and if it is then, what is it planning on being replaced with and when? 2. Also, Delve is retiring in December 2024 so what will be replacement of the Delve Page  Thanks in advance  Read More

​

Hi all

Looking for some help on why a retention label may not be working.

I’ve created a retention label policy to auto-apply to a file type to delete after 1 year from the date it was last modified. I’ve removed SharePoint and OneDrive from the retention policy (ie no retention being applied on those areas) hoping that the label can work and automatic apply deletion to the file types. The audit function in Purview shows that no retention labels are being applied to any data.

Prior to applying the retention label policy I ran a simulation which picked up the file types but since making live I cant see anything happening.  The file-types its looking for is not the standard office files but for a bespoke software with an alternative extension and this how the query was written in the retention label policy set up “(*.vx0) OR (*.vx1)”.

Any help or assistance much appreciated thanks.

​Hi all Looking for some help on why a retention label may not be working. I’ve created a retention label policy to auto-apply to a file type to delete after 1 year from the date it was last modified. I’ve removed SharePoint and OneDrive from the retention policy (ie no retention being applied on those areas) hoping that the label can work and automatic apply deletion to the file types. The audit function in Purview shows that no retention labels are being applied to any data. Prior to applying the retention label policy I ran a simulation which picked up the file types but since making live I cant see anything happening.  The file-types its looking for is not the standard office files but for a bespoke software with an alternative extension and this how the query was written in the retention label policy set up “(*.vx0) OR (*.vx1)”. Any help or assistance much appreciated thanks.   Read More

​

Hello,

Long time lurker, first time poster (I think!)

I’m looking for a no code option, in the first instance. I have PA in my arsenal but am hoping not to have a solution outside Excel. My company frowns upon vba. It’s not banned but there has to be a good reason & my 20 minute job wouldn’t qualify.

On a Monday, there is a report that is run with the current date and last week number in the format of ‘ddmmyy’ report – Wk 37. (Don’t even ask with that formatting!)

I need to copy a table from that report into my spreadsheet, basically. Each week, the same cells are copy and then pasted in the same area. I’ve tried to set up a dynamic formula which works but I can’t get it to hyperlink.

=”=’K:pathgoeshereSLT KPI Reports[” & G3 & ” – SLT KPI – Wk ” & E3 & “.xlsx]Overview’!$L$3”

Cell G3 is hard coded with the date, i couldn’t get the microsoft date format right to work properly with =Today()-4 (I run the report on a Friday)

Cell E3 is the week number – isoweeknum(cell)-1

I feel like I’m missing something really easy – any help would be appreciated

​Hello,Long time lurker, first time poster (I think!)I’m looking for a no code option, in the first instance. I have PA in my arsenal but am hoping not to have a solution outside Excel. My company frowns upon vba. It’s not banned but there has to be a good reason & my 20 minute job wouldn’t qualify.On a Monday, there is a report that is run with the current date and last week number in the format of ‘ddmmyy’ report – Wk 37. (Don’t even ask with that formatting!)I need to copy a table from that report into my spreadsheet, basically. Each week, the same cells are copy and then pasted in the same area. I’ve tried to set up a dynamic formula which works but I can’t get it to hyperlink. =”=’K:pathgoeshereSLT KPI Reports[” & G3 & ” – SLT KPI – Wk ” & E3 & “.xlsx]Overview’!$L$3″Cell G3 is hard coded with the date, i couldn’t get the microsoft date format right to work properly with =Today()-4 (I run the report on a Friday)Cell E3 is the week number – isoweeknum(cell)-1I feel like I’m missing something really easy – any help would be appreciated  Read More

​

Hi!

On project for the web i’ve created a calendar template from a “calendar resource” and assigned them a 08:00 AM – 17:00 PM GMT+1 working hour

Holiday are “non working day” in this calendar (summer and winter holiday)

Is there a way to let the plan’s PM to manage his collaborator holiday without admin access to project admin dashboard?

Otherways every time that a users go on holiday i should go on his resourse and modify his working day

Thanks!

​Hi! On project for the web i’ve created a calendar template from a “calendar resource” and assigned them a 08:00 AM – 17:00 PM GMT+1 working hourHoliday are “non working day” in this calendar (summer and winter holiday) Is there a way to let the plan’s PM to manage his collaborator holiday without admin access to project admin dashboard?Otherways every time that a users go on holiday i should go on his resourse and modify his working day Thanks!  Read More

​

Help with the best strategy to prevent workbook flash before Login form displays

​Help with the best strategy to prevent workbook flash before Login form displays  Read More

​

Buenos diás,

Al inicia el ordenador y una vez iniciado cada media hora me sale este mensaje de error:

“Esta version de windows expirara el dia 15/09/2024. Debe mover a una nueva compilacion tan pronto como sea posible, Conectarse interner para obtener mas información.”

Agradeceria me indicasen como puedo eliminar dicho mensaje sin necesidad de reinstalar windows ya que tengo programas e información que no me gustaría perder. Mi versiónb de windows es original y dispondo del correspondiente codigo de activación. Aunque escriba dicho codigo de nuevo, me sigue dando el mismo error.

Gracias de antemano. Un cordial saludo

​Buenos diás,Al inicia el ordenador y una vez iniciado cada media hora me sale este mensaje de error:”Esta version de windows expirara el dia 15/09/2024. Debe mover a una nueva compilacion tan pronto como sea posible, Conectarse interner para obtener mas información.”Agradeceria me indicasen como puedo eliminar dicho mensaje sin necesidad de reinstalar windows ya que tengo programas e información que no me gustaría perder. Mi versiónb de windows es original y dispondo del correspondiente codigo de activación. Aunque escriba dicho codigo de nuevo, me sigue dando el mismo error. Gracias de antemano. Un cordial saludo  Read More

​