| Azure Active Directory (Azure AD) and Azure AD Premium |
We provide remote guidance for securing your cloud identities for the following scenarios.
Secure foundation infrastructure
- Configuring and enabling strong authentication for your identities, including protecting with Azure Multi-Factor Authentication (MFA) (cloud only), the Microsoft Authenticator app, and combined registration for Azure MFA and self-service password reset (SSPR).
- Deploying FIDO2 or Microsoft Authenticator App.
- For non-Azure AD Premium customers, guidance is provided to secure your identities using security defaults.
- For Azure AD premium customers, guidance is provided to secure your identities with Conditional Access.
- Detecting and blocking the use of weak passwords with Azure AD Password Protection.
- Securing remote access to on-premises web apps with Azure AD Application Proxy.
- Enabling risk-based detection and remediation with Azure Identity Protection.
- Enabling a customized sign-in screen, including logo, text, and images with custom branding.
- Securely sharing apps and services with guest users using Azure AD B2B.
- Managing access for your Office 365 admins using role-based access control (RBAC) built-in administrative roles and to reduce the number of privileged admin accounts.
- Configuring hybrid Azure AD join.
- Configuring Azure AD join.
Monitor and reporting
-
Enabling remote monitoring for AD FS, Azure AD Connect, and domain controllers with Azure AD Connect Health.
Governance
-
Managing your Azure AD identity and access lifecycle at scale with Azure AD entitlement management.
-
Managing Azure AD group memberships, enterprise app access, and role assignments with Azure AD access reviews.
-
Reviewing Azure AD Terms of Use.
-
Managing and controlling access to privileged admin accounts with Azure AD Privileged Identity Management.
Automation and efficiencies
-
Enabling Azure AD SSPR.
- Allowing users to create and manage their own cloud security or Office 365 groups with Azure AD self-service group management.
- Managing delegated access to enterprise apps with Azure AD delegated group management.
- Enabling Azure AD dynamic groups.
- Organizing apps in the My Apps portal using collections.
|
The on-premises Active Directory and its environment have been prepared for Azure AD Premium, including remediation of identified issues that prevent integration with Azure AD and Azure AD Premium features. |
| Azure Information Protection |
For more information on Azure Information Protection, see Microsoft Information Protection further in this table.
|
|
| Discover & Respond |
Advanced eDiscovery
We provide remote guidance for:
- Creating a new case.
- Putting custodians on hold.
- Performing searches.
- Adding search results to a review set.
- Running analytics on a review set.
- Reviewing and tagging documents.
- Exporting data from the review set.
- Importing non-Office 365 data.
Advanced Audit (only supported in E5)
We provide remote guidance for:
- Enabling advanced auditing.
- Performing a search audit log UI and basic audit PowerShell commands.
Compliance Manager
We provide remote guidance for:
- Reviewing role types.
- Adding and configuring assessments.
- Assessing compliance by implementing improvement actions and determining how this impacts your compliance score.
- Reviewing built-in control mapping and assessing controls.
- Generating a report within an assessment.
The following is out of scope
- Custom scripting or coding.
- eDiscovery API.
- Data connectors.
- Compliance boundaries and security filters.
- Data investigations.
- Data subject requests.
- Design, architect, and third-party document review.
- Compliance with industry and regional regulations and requirements.
- Hands-on implementation of recommended improvement actions for assessments in Compliance Manager.
|
Aside from the Core onboarding portion in General, there are no minimum system requirements. |
| Insider Risk Management |
We provide remote guidance for:
- Creating policies and reviewing settings.
- Accessing reports and alerts.
- Creating cases.
- Creating notice templates.
- Guidance on creating the human resources (HR) connector.
Communication Compliance
We provide remote guidance for:
- Creating policies and reviewing settings.
- Accessing reports and alerts.
- Creating notice templates.
Compliance Manager
We provide remote guidance for:
- Reviewing role types.
- Adding and configuring assessments.
- Assessing compliance by implementing improvement actions and determining how this impacts your compliance score.
- Reviewing built-in control mapping and assessing controls.
- Generating a report within an assessment.
The following is out of scope
- Creating and managing Power Automate flows.
- Data connectors (beyond the HR connector).
- Custom regular expression (RegEx) configurations.
- Design, architect, and third-party document review.
- Information barriers.
- Privileged access management.
- Compliance with industry and regional regulations and requirements.
- Hands-on implementation of recommended improvement actions for assessments in Compliance Manager.
|
Aside from the Core onboarding portion in General, there are no minimum system requirements. |
| Microsoft 365 Defender |
Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against sophisticated attacks. We provide remote guidance for:
- Providing an overview of the Microsoft 365 security center.
- Reviewing cross-product incidents, including focusing on what's critical by ensuring the full attack scope, impacted assets, and automated remediation actions that are grouped together.
- Demonstrating how Microsoft 365 Defender can orchestrate the investigation of assets, users, devices, and mailboxes that might have been compromised through automated self-healing.
- Explaining and providing examples of how customers can proactively hunt for intrusion attempts and breach activity affecting your email, data, devices, and accounts across multiple data sets.
- Showing customers how they can review and improve their security posture holistically using Microsoft Secure Score.
The following is out of scope
- Project management of the customer's remediation activities.
- Ongoing management, threat response, and remediation.
- Deployment guidance or education on:
- How to remediate or interpret the various alert types and monitored activities.
- How to investigate a user, computer, lateral movement path, or entity.
- Custom threat hunting.
- Supporting GCC-High or GCC-DoD (Office 365 US Government).
- Security information and event management (SIEM) or API integration.
|
| Microsoft Cloud App Security |
Microsoft Cloud App Security is a Cloud Access Security Broker (CASB) that provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your Microsoft and third-party cloud services. We provide remote guidance for:
- Configuring the portal, including:
- Importing user groups.
- Managing admin access and settings.
- Scoping your deployment to select certain user groups to monitor or exclude from monitoring.
- How to set up IP ranges and tags.
- Personalizing the end-user experience with your logo and custom messaging.
- Integrating first-party services including:
- Microsoft Defender for Endpoint.
- Microsoft Defender for Identity.
- Azure AD Identity Protection.
- Azure Information Protection.
- Setting up cloud discovery using:
- Microsoft Defender for Endpoints.
- Zscaler.
- iboss.
- Creating app tags and categories.
- Customizing app risk scores based on your organization’s priorities.
- Sanctioning and unsanctioning apps.
- Reviewing the Cloud App Security and Cloud Discovery dashboards.
- Connecting featured apps using app connectors.
- Protecting apps with Conditional Access App Control in the Conditional Access within Azure AD and Cloud App Security portals.
- Deploying Conditional Access App Control for featured apps.
- Using the activity and file logs.
- Managing OAuth apps.
- Reviewing and configuring policy templates.
- Providing configuration assistance with the top 20 use cases for CASBs (including the creation or updating of up to six (6) policies) except:
- Auditing the configuration of your internet as a service (IaaS) environments (#18).
- Monitoring user activities to protect against threats in your IaaS environments (#19).
- Understanding incident correlation in the Microsoft 365 Defender portal.
The following is out of scope
- Project management of the customer's remediation activities.
- Ongoing management, threat response, and remediation.
- Discussions comparing Cloud App Security to other CASB offerings.
- Configuring Cloud App Security to meet specific compliance or regulatory requirements.
- Deploying the service to a non-test production environment.
- Deploying Cloud App Discovery as a proof of concept.
- Supporting GCC-High or GCC-DoD (Office 365 US Government).
- Setting up the infrastructure, installation, or deployment of automatic log uploads for continuous reports using Docker or a log collector.
- Creating a Cloud Discovery snapshot report.
- Blocking app usage using block scripts.
- Connecting custom apps.
- Onboarding and deploying Conditional Access App Control for non-featured apps.
- Integrating with third-party identity providers (IsPs) and data loss prevention (DLP) providers.
- Training or guidance covering advanced hunting.
- Automated investigation and remediation including Microsoft Power Automate playbooks.
- Security information and event management (SIEM) or API integration (including Azure Sentinel).
|
| Microsoft Defender for Endpoint |
Microsoft Defender for Endpoint is a platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats.
We provide remote guidance for:
- Deploying the technologies to secure your endpoints.
- Configuring endpoint protection and device restriction profiles.
- Assessing the OS version and device management (including Intune, Microsoft Endpoint Configuration Manager, Group Policy Objects (GPOs), and third-party configurations) as well as the status of your Windows Defender AV services or other endpoint security software.
- Assessing the status of your Windows AV services or other endpoint security software.
- Assessing proxies and firewalls restricting network traffic.
- Enabling the Microsoft Defender for Endpoint service by explaining how to deploy a Defender for Endpoint agent profile using an onboard endpoint.
- Deployment guidance, configuration assistance, and education on:
-
Threat and vulnerability management.
-
Attack surface reduction.
-
Next-generation protection.
-
Endpoint detection and response.
-
Automated investigation and remediation.
-
Secure score for devices.
- Microsoft Defender SmartScreen configuration using Microsoft Endpoint Manager.
- Reviewing simulations and tutorials (like practice scenarios, fake malware, and automated investigations).
- Overview of reporting and threat analytics features.
- Integrating Microsoft Defender for Office 365 with Microsoft Defender for Endpoint.
- Conduct walkthroughs of the Microsoft Defender Security Center portal.
- The following operating systems:
-
Windows 10.
-
Windows Server 2016.
-
Windows Server 2019.
-
Windows Server 2019 Core Edition.
-
Windows Server Semi-Annual Channel (SAC) version 1803.
-
macOS versions 10.13, 10.14, and 10.15.
Note: All Windows Server versions must be managed by the latest version of System Center Configuration Manager 2012 (versions 1012 R2, 1511, or 1602) or Microsoft Endpoint Configuration Manager (version 2002 or greater).
The following is out of scope
- Project management of the customer's remediation activities.
- Supporting GCC-High or GCC-DoD (Office 365 US Government).
- On-site support.
- Ongoing management and threat response.
- Onboarding or configuration for the following Microsoft Defender for Endpoint agents:
-
Windows Server 2008.
-
Windows Server 2012.
-
Linux.
-
Mobile devices (Android and iOS).
- Virtual Desktop Infrastructure (VDI) (persistent or non-persistent).
- Server onboarding and configuration:
-
Configuring a proxy server for offline communications.
-
Configuring Configuration Manager deployment packages on down-level Configuration Manager instances and versions.
-
Onboarding servers to Azure Security Center.
-
Servers not managed by Configuration Manager.
- macOS onboarding and configuration:
-
Manual Intune-based deployment.
-
JAMF-based deployment.
-
Other mobile device management (MDM) product-based deployment.
-
Manual deployment.
- Configuration of the following attack surface reduction capabilities:
-
Hardware-based isolation.
-
App control.
- Device control.
-
Exploit protection.
-
Network firewall.
- Configuration or management of account protection features like:
- Windows Hello
- Credential Guard
- Configuration or management of BitLocker.
- Enrollment or configuration of Microsoft Threat Experts.
- Configuration or training reviewing API or security information and event management (SIEM) connections.
- Enrollment or configuration of Microsoft 365 Defender.
- Training or guidance covering advanced hunting.
- Training or guidance covering the use of or creation of Kusto queries.
- Training or guidance covering Defender SmartScreen configuration using Group Policy Objects (GPOs), Windows Security, or Microsoft Edge.
Contact a Microsoft Partner for assistance with these services.
|
|
| Microsoft Defender for Identity |
Microsoft Defender for Identity is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. We provide remote guidance for:
- Running the sizing tool for resource capacity planning.
- Creating your instance of Defender for Identity.
- Connecting Defender for Identity to Active Directory.
- Deploying the sensor to capture and parse network traffic and Windows events directly from your domain controllers, including:
- Downloading the sensor package.
- Configuring the sensor.
- Installing the sensor on your domain controller silently.
- Deploying the sensor to your multi-forest environment.
- Configuring the Windows Event Collector.
- Configuring the portal, including:
- Integrating Defender for Identity with Microsoft Cloud App Security (Cloud App Security licensing isn't required).
- Configuring entity tags.
- Tagging sensitive accounts.
- Receiving email notifications for health issues and security alerts.
- Configuring alert exclusions.
- Providing deployment guidance, configuration assistance, and education on:
- Understanding the Identity Security Posture Assessment report.
- Understanding the User Investigation Priority Score and User Investigation ranking report.
- Understanding the inactive user report.
- Explanation of the remediation options on a compromised account.
- Facilitating the migration from Advanced Threat Analytics (ATA) to Defender for Identity.
The following is out of scope
- Project management of the customer's remediation activities.
- Ongoing management, threat response, and remediation.
- Deploying Defender for Identity as a proof of concept.
- Supporting GCC-High or GCC-DoD (Office 365 US Government).
- Deploying or performing the following Defender for Identity sensor activities:
- Manual capacity planning.
- Running the Auditing tool.
- Deploying the standalone sensor.
- Deploying to Active Directory Federation Services (AD FS) servers.
- Deploying the sensor using a Network Interface Card (NIC) Teaming adaptor.
- Deploying the sensor through a third-party tool.
- Connecting to the Defender for Identity cloud service through a web proxy connection.
- Configuring the Microsoft account (MSA) in Active Directory.
- Creation and management of honeytokens.
- Enabling Network Name Resolution (NNR).
- Configuration of Deleted Objects container.
- Deployment guidance or education on:
- Remediating or interpreting various alert types and monitored activities.
- Investigating a user, computer, lateral movement path, or entity.
- Threat or advanced hunting.
- Incident response.
- Providing a security alert lab tutorial for Defender for Identity.
- Providing notification when Defender for Identity detects suspicious activities by sending security alerts to your syslog server through a nominated sensor.
- Configuring Defender for Identity to perform queries using security account manager remote (SAMR) protocol to identify local admins on specific machines.
- Configuring VPN solutions to add information from the VPN connection to a user’s profile page.
- Security information and event management (SIEM) or API integration (including Azure Sentinel).
|
- Aligned with Microsoft Defender for Identity prerequisites.
- Active Directory deployed.
- The domain controllers you intend to install Defender for Identity sensors on have internet connectivity to the Defender for Identity cloud service.
- Your firewall and proxy must be open to communicate with the Defender for Identity cloud service (*.atp.azure.com port 443 must be open).
- Domain controllers running on one of the following:
- Windows Server 2008 R2 SP1.
- Windows Server 2012.
- Windows Server 2012 R2.
- Windows Server 2016.
- Windows Server 2019 with KB4487044 (OS Build 17763.316 or later).
- Microsoft .NET Framework 4.7 or later.
- A minimum of five (5) GB of disk space is required and 10 GB is recommended.
- Two (2) cores and six (6) GB of RAM installed on the domain controller.
|
| Microsoft Defender for Office 365 |
Microsoft Defender for Office 365 safeguards your organization against malicious threats posed by email messages, links (URLs), and collaboration tools. Defender for Office 365 includes:
We provide remote guidance for:
- Enabling Safe Links, Safe Attachments, and anti-phishing.
- Configuring automation, investigation, and response.
- Using Attack Simulator.
- Reporting and threat analytics.
- Understanding incident correlation in the Microsoft 365 Defender portal.
The following is out of scope
- Project management of the customer's remediation activities.
- Ongoing management, threat response, and remediation.
- Supporting GCC-High or GCC-DoD (Office 365 US Government).
- Discussions comparing Defender for Office 365 to other security offerings.
- Deploying Defender for Office 365 as a proof of concept.
- Connecting custom apps.
- Training or guidance covering advanced hunting.
- Automated investigation and remediation including Microsoft Power Automate playbooks.
- Security information and event management (SIEM) or API integration (including Azure Sentinel).
|
Aside from the Core onboarding portion in General, there are no minimum system requirements. |
| Microsoft Information Governance |
We provide remote guidance for:
- Creating and publishing retention labels and policies (only supported in E5).
- Records management (only supported in E5).
- Reviewing file plan creation.
- Creating and managing records (including event-based records).
- Reviewing disposition.
Compliance Manager
We provide remote guidance for:
- Reviewing role types.
- Adding and configuring assessments.
- Assessing compliance by implementing improvement actions and determining how this impacts your compliance score.
- Reviewing built-in control mapping and assessing controls.
- Generating a report within an assessment.
The following is out of scope
- Development of a records management file plan.
- Data connectors.
- Development of information architecture in SharePoint.
- Custom scripting and coding.
- Design, architect, and third-party document review.
- Support for E3.
- Compliance with industry and regional regulations and requirements.
- Hands-on implementation of recommended improvement actions for assessments in Compliance Manager.
|
Aside from the Core onboarding portion in General, there are no minimum system requirements. |
| Microsoft Information Protection |
We provide remote guidance for:
- Data classification (supported in E3 and E5).
- Sensitive information types (supported in E3 and E5).
- Creating sensitivity labels (supported in E3 and E5).
- Applying sensitivity labels (supported in E3 and E5).
- Trainable classifiers (supported in E5).
- Knowing your data with content explorer and activity explorer (supported in E5).
- Publishing labels using policies (manual and automatic) (supported in E5).
- Creating Endpoint data loss prevention (DLP) policies for Windows 10 devices (supported in E5).
- Creating DLP policies for Microsoft Teams chats and channels.
Compliance Manager
We provide remote guidance for:
- Reviewing role types.
- Adding and configuring assessments.
- Assessing compliance by implementing improvement actions and determining how this impacts your compliance score.
- Reviewing built-in control mapping and assessing controls.
- Generating a report within an assessment.
Azure Information Protection
We provide remote guidance for:
- Activating and configuring your tenant.
- Creating and setting up labels and policies (supported in P1 and P2).
- Applying information protection to documents (supported in P1 and P2).
- Automatically classifying and labeling information in Office apps (like Word, PowerPoint, Excel, and Outlook) running on Windows and using the Azure Information Protection client (supported in P2).
- Discovering and labeling files at rest using the Azure Information Protection scanner (supported in P1 and P2).
- Monitoring emails in transit using Exchange Online mail flow rules.
We also provide guidance if you want to apply protection using Microsoft Azure Rights Management Services (Azure RMS), Office 365 Message Encryption (OME), and data loss prevention (DLP).
The following is out of scope
- Customer key.
- Custom regular expressions (RegEx) development for sensitive information types.
- Creation or modification of keyword dictionaries.
- Custom scripting and coding.
- Azure Purview.
- Design, architect, and third-party document review.
- Compliance with industry and regional regulations and requirements.
- Hands-on implementation of recommended improvement actions for assessments in Compliance Manager.
|
Aside from the Core onboarding portion in General, there are no minimum system requirements with the exception of Azure Information Protection.
Azure Information Protection
Customer prerequisite responsibilities include:
- A list of file share locations to be scanned.
- An approved classification taxonomy.
- Understanding of any regulatory restriction or requirements regarding key management.
- A service account created for your on-premises Active Directory that has been synchronized with Azure AD.
- Labels configured for classification and protection.
- All prerequisites for the Azure Information Protection scanner are in place. For more information, see Prerequisites for installing and deploying the Azure Information Protection unified labeling scanner.
- Ensure user devices are running a supported operating system and have the necessary prerequisites installed. See the following for more details.
- Installation and configuration of the Azure RMS connector and servers including the Active Directory RMS (AD RMS) connector for hybrid support.
- Setup and configuration of Bring Your Own Key (BYOK), Double Key Encryption (DKE) (unified labeling client only), or Hold Your Own Key (HYOK) (classic client only) should you require one of these options for your deployment.
|
| Microsoft Intune |
We provide remote guidance on getting ready to use Intune as the cloud-based mobile device management (MDM) and mobile app management (MAM) provider for your apps and devices. The exact steps depend on your source environment and are based on your mobile device and mobile app management needs. The steps can include:
- Licensing your end users.
- Configuring identities to be used by Intune by leveraging either your on-premises Active Directory or cloud identities (Azure AD).
- Adding users to your Intune subscription, defining IT admin roles, and creating user and device groups.
- Configuring your MDM authority, based on your management needs, including:
- Setting Intune as your MDM authority when Intune is your only MDM solution.
- Providing MDM guidance for:
- Configuring tests groups to be used to validate MDM management policies.
- Configuring MDM management policies and services like:
- App deployment for each supported platform through web links or deep links.
- Conditional Access policies.
- Deployment of email, wireless networks, and VPN profiles if you have an existing certificate authority, wireless network, or VPN infrastructure in your organization.
- Connecting to the Intune Data Warehouse.
- Integrating Intune with:
- Team Viewer for remote assistance (a Team Viewer subscription is required).
- Mobile Threat Defense (MTD) partner solutions (an MTD subscription is required).
- A telecom expense management solution (a telecom expense management solution subscription is required).
- Enrolling devices of each supported platform to Intune.
- Providing app protection guidance on:
- Configuring app protection policies for each supported platform.
- Configuring Conditional Access policies for managed apps.
- Targeting the appropriate user groups with the previously mentioned MAM policies.
- Using managed-apps usage reports.
- Providing migration guidance from legacy PC management to Intune MDM.
Cloud-attach
We guide you through getting ready to cloud-attach existing Configuration Manager environments with Intune. The exact steps depend on your source environment. These steps can include:
- Licensing your end users.
- Configuring identities to be used by Intune by leveraging your on-premises Active Directory and cloud identities.
- Adding users to your Intune subscription, defining IT admin roles, and creating user and device groups.
- Providing guidance setting up hybrid Azure AD join.
- Providing guidance on setting up Azure AD for MDM auto-enrollment.
- Providing guidance on how to set up cloud management gateway when used as a solution for co-management of remote internet-based device management.
- Configuring supported workloads that you want to switch to Intune.
- Installing the Configuration Manager client on Intune-enrolled devices.
Deploy Outlook mobile for iOS and Android securely
We can provide guidance to help you deploy Outlook mobile for iOS and Android securely in your organization to ensure your users have all the required apps installed.
The steps to securely deploy Outlook mobile for iOS and Android with Intune depends on your source environment. It can include:
- Downloading the Outlook for iOS and Android, Microsoft Authenticator, and Intune Company Portal apps through the Apple App Store or Google Play Store.
- Providing guidance on setting up:
- The Outlook for iOS and Android, Microsoft Authenticator, and Intune Company Portal apps deployment with Intune.
- App protection policies.
- Conditional Access policies.
- App configuration policies.
|
IT admins need to have existing Certificate Authority, wireless network, and VPN infrastructures already working in their production environments when planning on deploying wireless network and VPN profiles with Intune.
Note: The FastTrack service benefit doesn't include assistance for setting up or configuring Certificate Authorities, wireless networks, VPN infrastructures, or Apple MDM push certificates for Intune.
Note: The FastTrack service benefit doesn't include assistance for setting up or upgrading either the Configuration Manager site server or Configuration Manager client to the minimum requirements needed to support cloud-attach. Contact a Microsoft Partner for assistance with this.
Intune integrated with Microsoft Defender for Endpoint
Note: We provide assistance on integrating Intune with Microsoft Defender for Endpoint and creating device compliance policies based on its Windows 10 risk level assessment. We don't provide assistance on purchasing, licensing, or activation. Contact a Microsoft Partner for assistance with this.
Windows Autopilot
IT admins are responsible for registering their devices to their organization by either having the hardware vendor upload their hardware IDs on their behalf or by uploading it themselves into the Windows Autopilot service.
|
