I’ve always been able to install Windows and keep files in Windows old folder. Now trying to install 24h2 preview I see only these options. Does this mean it will really delete ALL files and not move to the Windows old folder?

​I’ve always been able to install Windows and keep files in Windows old folder. Now trying to install 24h2 preview I see only these options. Does this mean it will really delete ALL files and not move to the Windows old folder?   Read More

​

Great things are here and on the horizon. Microsoft Copilot innovation, combined with the familiarity and scale of Microsoft 365, unlocks productivity and transforms business processes for everyone across all functions and every industry in this new era of AI.

We want to share the on-demand recording of the Microsoft 365 Community Conference opening keynote that puts it all into perspective: The Age of Copilots, plus a bonus video from Microsoft Build highlighting custom copilots from SharePoint. (aka: “Click to Copilot”)

First, Jeff Teper (President of Collaboration Apps and Platforms at Microsoft) presented a 75-minute vision and strategy session in Orlando, FL, filled with insights, product demos and real-world context across Copilot, Teams, and SharePoint.

Watch on-demand | “The Age of Copilots” with Jeff Teper and co-presenters Miceile Barrett, Derek Snyder, and Naomi Moneypenny (Presented live, Tuesday, April 30th, 2024, at the Microsoft 365 Community Conference in Orlando, FL):

NOTE | You can watch all on-demand session recordings from the Microsoft 365 Community Conference (more added each week over the coming weeks); enjoy and share. Plus, review much of what was covered in the opening keynote in this article, “Microsoft SharePoint Roadmap Update – May 2024” by Dave Cohen.

Jeff Teper presenting “The Age of Copilots” at the Microsoft 365 Community Conference in Orlando, FL | April 30th, 2024.

“The Age of Copilots” co-presenters (left-to-right): Derek Snyder, Naomi Moneypenny, Jeff Teper, and Miceile Barrett.

The Age of Copilots continues…

Second, on the heels of the Microsoft 365 Community Conference arose Microsoft Build. Build highlighted a new capability in this age of copilots, the ability to create custom copilots – in SharePoint. And this time Jeff joined Satya Nadella, Kevin Scott, and Rajesh Jha within the Build opening keynote (KEY01).

Jeff introduced the ability for anyone to create custom copilots from SharePoint. In just a few clicks, you— whether an admin or business user— can create and share a copilot from SharePoint that’s grounded in the curated, authoritative content you choose. Since you rarely work alone, you can also easily share your copilots with others in Teams chat, email, and more. It’s like a subject matter expert ready to help you, your team, department, or even the whole company while respecting all your existing security settings and permissions.

In context of the age of copilots, we’re excited to share this on-demand video, “Microsoft Build opening keynote | KEY01” (video jumps to Jeff’s segment 1 hour and 7 minutes in):

Example of a built-in, custom copilot on a SharePoint communication site – created in a few clicks: Select “Create a copilot” and choose the folders or files that you want your copilot scoped to. The copilot will reason over only this content when providing responses.

Discover more, “Create custom copilots from SharePoint,” – recent blog written by Jeff Teper.

Next steps

We can’t wait to see how you leverage AI in the age of copilots, including future custom copilots our incredible SharePoint user base will create! Everyone will now be empowered to create, use, and share copilots for better collaboration and knowledge sharing —always with the trusted Microsoft governance capabilities you already have.

Sign up for the custom copilots from SharePoint private preview today and stay tuned for the public preview coming later this year. Plus, watch a bonus, related, depth Build breakout session, “Integrating your bots and Copilot experiences natively into SharePoint and Viva Connections.”

Reminders:

Watch all on-demand session recordings from the Microsoft 365 Community Conference (more added each week over the coming weeks); enjoy and share.
Become a member of the Community News Desk right here within the Microsoft Tech Community — see more content like this, plus discover news, event guides, product series, and insights around the world.

Cheers, Mark Kashman

​Microsoft Tech Community – Latest Blogs –Read More 

In the fast-evolving landscape of cloud security, Microsoft Defender for Cloud (MDC) stands as a robust Cloud Native Application Protection Platform (CNAPP). One of its standout features is the premium Cloud Security Posture Management (CSPM) solution, known as Defender CSPM. Among the myriads of advanced capabilities offered by Defender CSPM, the “Governance Rule” feature is a game-changer. This empowers security teams to streamline and automate the assignment, management, and tracking of security recommendations.

In this blog, we’ll delve into best practices for leveraging Governance Rule to ensure effective, efficient, and timely remediation actions and explore practical use cases for maximizing its potential.

Understanding Governance Rule

Governance Rule in Defender CSPM is designed to simplify the management of security recommendations by enhancing accountability. You can define rules that assign an owner and a due date for addressing recommendations for specific resources. This provides resource owners with a clear set of tasks and deadlines for remediating recommendations. By making the assignment and tracking of these tasks more visible, Governance Rule ensures that critical security issues are promptly addressed, reducing the risk of breaches and enhancing overall security posture.

Best Practices for Utilizing Governance Rule

Define Clear Remediation Ownership
Assigning remediation tasks to specific owners is crucial for accountability. Governance Rule allows you to specify who is responsible for each security recommendation. Ensure that each task is assigned to the most appropriate individual or team with the necessary expertise and authority to address the issue. Clear ownership helps avoid confusion and ensures that remediation actions are taken seriously.
Set Realistic ETAs and Grace Periods
Establishing realistic Estimated Time of Arrival (ETA) and grace periods for remediation tasks is essential for maintaining a balance between urgency and feasibility. Overly aggressive timelines can lead to rushed and potentially ineffective fixes, while overly lenient deadlines may delay critical security improvements. Analyze the complexity and impact of each security finding to set achievable timelines that encourage timely resolution without compromising quality.
Prioritize Based on Risk
Not all security recommendations are created equal. Use severity-based prioritization to determine which issues need immediate attention and which can be scheduled for later remediation. Defender CSPM’s Governance Rule allows you to categorize tasks based on their severity and potential impact on your organization’s security posture. Focus on high-severity findings first to mitigate the most significant threats promptly.
Automate Workflow Integration
Leverage the automation capabilities of Governance Rule to integrate remediation workflows with your existing security tools and processes. Automated notifications, status updates, and task assignments can significantly reduce manual effort and improve coordination across teams. By integrating these workflows, you ensure that security recommendations are seamlessly managed from detection to resolution.

Regularly Monitor and Adjust Rules

The dynamic nature of cloud environments means that security needs can change rapidly. Regularly review and adjust your Governance Rules to ensure they remain aligned with your organization’s security objectives and compliance requirements. Monitor the performance of these rules and gather feedback from your security teams to identify areas for improvement.

Foster a Culture of Continuous Improvement

Encourage a culture where continuous improvement is the norm. Use insights gained from the Governance Rule feature to identify recurring security issues and root causes. Implement lessons learned to refine your security policies and practices, reducing the likelihood of similar issues arising in the future.

Before you begin

The Defender Cloud Security Posture Management (CSPM) plan must be enabled.
You need Contributor, Security Admin, or Owner permissions on the Azure subscriptions.
For AWS accounts and GCP projects, you need Contributor, Security Admin, or Owner permissions on the Defender for Cloud AWS or GCP connectors.

Using Governance Rule Priorities in Microsoft Defender for Cloud: A Practical Use Case

The Governance Rule feature in Microsoft Defender for Cloud (MDC) offers a powerful way to prioritize and manage security recommendations by assigning a Priority value from 1 (highest) to 1000 (lowest). This granularity allows organizations to tailor their remediation efforts based on the criticality of the issues at hand. Let’s explore a practical use case to illustrate how setting multiple rules with different priorities can enhance your security posture.

Multi-Tiered Security Remediation Strategy

Scenario: An organization operates a cloud infrastructure that supports various critical business functions, including financial transactions, customer data management, and internal communication systems. Each of these functions has different security requirements and a potential impact on the business if compromised.

Objective: To implement a multi-tiered security remediation strategy that ensures the most critical security issues are addressed first, while less critical issues are still managed effectively within appropriate timelines.

Step-by-Step Implementation

Identify Security Segments and Their Impact:

Tier 1: High-impact areas such as financial transaction systems and customer data management. Compromise in these areas could lead to significant financial loss and regulatory penalties.
Tier 2: Medium-impact areas such as internal communication systems and non-critical business applications. Breaches here could disrupt operations but with manageable consequences.
Tier 3: Low-impact areas such as development and testing environments. Issues here have a minimal immediate impact on business operations.

Set Governance Rules with Priorities:

Rule 1: High Priority (1-100)

Criteria: Security recommendations related to Tier 1 systems.
Priority Value: 1-100
Description: Assign the highest priority to vulnerabilities and security findings in financial transaction systems and customer data management platforms. These tasks should be addressed immediately to prevent significant damage.

Rule 2: Medium Priority (101-500)

Criteria: Security recommendations related to Tier 2 systems.
Priority Value: 101-500
Description: Assign a medium priority to issues in internal communication systems and non-critical business applications. These should be remediated promptly but can be scheduled after Tier 1 issues are addressed.

Rule 3: Low Priority (501-1000)

Criteria: Security recommendations related to Tier 3 systems.
Priority Value: 501-1000
Description: Assign the lowest priority to findings in development and testing environments. While still important, these issues can be managed with a longer timeline, focusing on addressing them during regular maintenance cycles.

Automate and Monitor:

Use MDC’s Governance Rule automation to assign these tasks to appropriate teams or individuals based on their expertise.
Set up automated notifications and tracking to ensure that each priority level is being addressed according to the defined timelines.
Regularly review the progress and adjust priorities as necessary based on new findings, business impact analysis, and changes in the threat landscape.

Benefits of Multi-Priority Governance Rules

Focused Resource Allocation: Ensures that critical resources are directed towards addressing the most impactful security issues first, optimizing the use of your security team’s time and expertise.
Risk Management: Reduces the risk of severe breaches by prioritizing high-impact areas, thereby protecting essential business functions.
Scalability: As the organization grows and the cloud environment evolves, this prioritization strategy can scale to include new systems and adjust to changing priorities.
Efficiency: Automated workflows and clear prioritization reduce the time spent on manual task assignment and tracking, increasing overall operational efficiency

Leveraging Governance Rule Conditions for Efficient Remediation

The Governance Rule feature in Microsoft Defender for Cloud allows for detailed configuration of conditions, making it a versatile tool for managing remediation tasks. Here are some key conditions and their valuable use cases:

Impacted Recommendations: By Severity or By Specific Recommendation
Set Owner: By Resource Tag or By Email Address (one address only)
Set Remediation Timeframe: 7, 14, 30, 90 days with an option to set an equal Grace Period so the recommendation doesn’t affect the Secure Score
Set Email Notifications: Notify owners weekly about open and overdue tasks, notify the owner’s direct manager weekly about open and overdue tasks. Email configuration day of the week – select a day of the week.

Use Case 1: Prioritizing High-Severity Recommendations

Condition Configuration:

Impacted Recommendations: By Severity (High)
Set Owner: By Resource Tag (e.g., “HighPriorityTeam”)
Set Remediation Timeframe: 7 days with an equal grace period
Set Email Notifications: Notify owners weekly about open and overdue tasks, email configuration day: Monday

Description: This use case focuses on ensuring that high-severity security recommendations are addressed with utmost urgency. By assigning these tasks to a dedicated high-priority team and setting a tight remediation timeframe, critical vulnerabilities are mitigated quickly. Weekly email notifications keep the owners informed, ensuring accountability and prompt action.

Use Case 2: Managing Specific Recommendations for Compliance

Condition Configuration:

Impacted Recommendations: By Specific Recommendation (e.g., “Enable Multi-Factor Authentication”)
Set Owner: By Email Address (specific compliance officer)
Set Remediation Timeframe: 30 days with an equal grace period
Set Email Notifications: Notify owners weekly about open and overdue tasks, notify the owner’s direct manager weekly about open and overdue tasks, email configuration day: Wednesday

Description: Certain security recommendations are crucial for compliance with regulatory requirements. By targeting specific recommendations, such as enabling multi-factor authentication, and assigning them to a compliance officer, organizations can ensure these critical tasks are completed within a reasonable timeframe. The grace period prevents these tasks from negatively impacting the Secure Score while they are being addressed. Regular notifications keep everyone on track.

Use Case 3: Efficient Resource Tag-Based Assignment

Condition Configuration:

Impacted Recommendations: By Severity (Medium)
Set Owner: By Resource Tag (e.g., “AppTeam”)
Set Remediation Timeframe: 14 days with an equal grace period
Set Email Notifications: Notify owners weekly about open and overdue tasks, email configuration day: Thursday

Description: For medium-severity issues, assigning tasks based on resource tags allows for efficient distribution of remediation efforts among different teams. This use case assigns recommendations to the application development team, ensuring they handle vulnerabilities related to their specific domain. The 14-day remediation period is sufficient to address these issues without overwhelming the team, while weekly notifications help maintain progress.

Use Case 4: Long-Term Low-Severity Management

Condition Configuration:

Impacted Recommendations: By Severity (Low)
Set Owner: By Email Address (general IT team lead)
Set Remediation Timeframe: 90 days with an equal grace period
Set Email Notifications: Notify owners weekly about open and overdue tasks, email configuration day: Friday

Description: Low-severity recommendations, while still important, can be managed over a longer period. This case assigns these tasks to the general IT team lead, allowing for a 90-day remediation period. The extended timeframe ensures that these issues are addressed without detracting them from more urgent tasks. Weekly notifications ensure that these tasks are not forgotten and are completed within the set period.

Use Case 5: Weekly Review and Reporting

Condition Configuration:

Impacted Recommendations: By Severity (All)
Set Owner: By Resource Tag (e.g., “SecurityOps”)
Set Remediation Timeframe: 30 days with an equal grace period
Set Email Notifications: Notify owners weekly about open and overdue tasks, email configuration day: Monday

Description: A comprehensive approach to managing all levels involves setting a 30-day remediation period for all recommendations and assigning them to the Security Operations team. Weekly notifications sent every Monday keep the team updated on open and overdue tasks, ensuring continuous review and progress on all security recommendations.

Integrating ServiceNow with Governance Rules in Microsoft Defender for Cloud

The integration of ServiceNow with Defender for Cloud allows you to create governance rules that automatically open tickets in ServiceNow for specific recommendations or severity levels. This capability provides significant value by enabling seamless collaboration between the two platforms. With ServiceNow tickets being created, viewed, and linked to recommendations directly from Defender for Cloud, organizations can streamline their incident management process. This integration ensures that security recommendations are promptly addressed, facilitating efficient and effective remediation efforts, and enhancing the overall security posture by providing clear visibility and accountability for each task.

For more detailed instructions, refer to the official documentation.

Conclusion

By configuring Governance Rules with specific conditions tailored to your organization’s needs, you can create a structured and efficient remediation process. Whether it’s prioritizing high-severity issues, managing compliance-related recommendations, or ensuring long-term management of low-severity findings, the flexible configuration options in MDC’s Governance Rule feature allow for a highly effective security strategy. Implementing these use cases will help your organization maintain a strong security posture, ensuring timely and efficient remediation actions across all areas of your cloud infrastructure.

The Governance Rule feature in Microsoft Defender CSPM is a powerful tool that can transform how organizations manage and mitigate security recommendations. By following these best practices, security teams can enhance their efficiency, effectiveness, and responsiveness to security findings. Embrace the capabilities of Governance Rule to stay ahead in the ever-changing world of cloud security, ensuring that your security measures are not only reactive but also proactive and adaptive.

Additional Resources

Watch a demonstration on how to use Governance Rule in this episode of Defender for Coud in the Field
Download the new Microsoft CNAPP eBook at aka.ms/MSCNAPP
Become a Defender for Cloud Ninja by taking the assessment at aka.ms/MDCNinja

Reviewers

Yuri Diogenes, Principal PM Manager, CxE Defender for Cloud

Tal Rosler, Senior PM lead, Microsoft Defender for Cloud

​Microsoft Tech Community – Latest Blogs –Read More 

Hi,

I converted a classic SharePoint calendar to use a modern calendar view as the default view (instructions used) and then added it as a tab on Teams. The calendar itself is displayed as expected except for the background of the items. The background color is different from a regular Teams calendar and the contrast between the background and text color is bad. I tried to change the color using view formatting for the day but that is not working. Is this a bug on Teams or do I need to adjust something in SharePoint?

​Hi, I converted a classic SharePoint calendar to use a modern calendar view as the default view (instructions used) and then added it as a tab on Teams. The calendar itself is displayed as expected except for the background of the items. The background color is different from a regular Teams calendar and the contrast between the background and text color is bad. I tried to change the color using view formatting for the day but that is not working. Is this a bug on Teams or do I need to adjust something in SharePoint?      Read More

​