When Microsoft Messaging Looks Secure but Isn’t — Exchange Server, Hybrid and Microsoft 365 Security with Thomas Stensitzki [MVP]

Yeah, welcome back to the Amcet65 show podcast. Today we are going deep into one of the most critical and often underestimated areas of the Microsoft ecosystem, messaging security. E-Mats remain one of the most important systems in every organization. It carries business decisions, financial information, customer, data, credentials, contracts and sometimes the entry-history of a company communication. Yet many Microsoft messaging environments look secure on the surface, will still contain serious weakness, amnesty, yeah, my today's guest is Tomasz Dynitski. Tomasz is the principal technology consultant and owner of the Branky course, GmbH in Koga G, where he specialised in enterprise, consulting and training for Microsoft Exchange, Microsoft 65 and hybrid collaboration environments. He has been Microsoft MVP for Microsoft C-65 and experienced since 2018 and holds some of the most advanced messaging certification Microsoft have ever offered, including Microsoft's certificate solution, master messaging and Microsoft certificate master of Exchange Server. Tomasz has more than 25 years of experience working with Exchange Server, Hybrid Envoyaments, Microsoft 65 and enterprise messaging architectures. He is also Microsoft Certificate Trainer, form of NCT Community Lead, author of several books including Exchange Server, the Sandbook for Adness Art 1, speaker at events such Exchange Summit, Expept Live, Scottish Summit and the host of Exchange Unplugged Podcast. Today we will discuss the risk that administrators often underestimate it's different between one premise, hybrid and cloud only messaging, Exchange Online Security identity, Mailflow, Auditification, Operation of the mistakes and what organizations need to understand before it's too late. Tomasz, welcome, beauty show. I hope I have nothing to forget. Well, okay, it's a pleasure being on the show. That's quite an introduction. So actually I haven't listened to such introduction for quite some time. So I thought, oh yeah, so that's just definitely describes I'm old. Yeah, you say you're old. You are working for more than 25 years in the Microsoft Acro system, especially in the Microsoft messaging technology. What organly attract you to exchange it? Enterprise messaging? Well, so we do have a limit for this episode, don't we? To put it right, so I started working with Exchange Server, more or less I was just going to show you about 2000, yeah, in the time from of the early 2000s and for whatever reason, I stayed with this and I started working with the Microsoft and the technology field of Microsoft as a generalist. So I even did some stuff on the dark side of the moon. So I worked as a programmer as well. But then I made a choice to focus on Exchange to being a specialist and even back then I had to make a decision between the red and the blue pills. So it should be it was either SharePoint or Exchange and Exchange 1 for various reasons. That's why, you know, but it's I think that exchange and emails even though that it's already quite often been said that email is dead nobody's going to use email but this is simply not the case. Yeah, I think when I have the chance, I don't make so so much intro, I get the try to get a little bit deep dive. What are the the main security difference between Exchange Server on-prem, Exchange Online and yeah, Hybrid deployments? So let me start with the letter because so Exchange Hybrid is nothing less than just a logical configuration or between the two. So your on-premises Exchange organization and your Exchange Online tenant are from a logical perspective being configured to work as a single entity so to speak. So they trust each other even though that your that both environments are literally hundreds of kilometers apart. But your expectation is when you use Exchange Online that any email being sent from on-prem shows up as an internal email and vice versa. So and this is the tricky part on where Microsoft has quite strict configuration defaults to make that happen and this is the Hybrid configuration for Mailflow in that case. And yeah, you know, sometimes you see not so good and sometimes you see well performing the environments. What would I often see is or I think many many of the organizations I see they move to the Microsoft 365 because they believe the cloud automatically solves the security problem. A problem they they show me hey here stands it's secure on the website. We make it. Which which problem do Microsoft solve? And which remains the customer's responsibility? Well, first of all, it doesn't solve any problems right out of the box. You can compare the if you set up your new tenant and you get your first Exchange Online license into that tenant, you get an instance of Exchange which technically you can compare with just doing a simple default setup of Exchange Server. So it comes with default settings. Yes, it works. So there's quite a low barrier to use it to start using email with Exchange Online. But nevertheless all the communication flow, all the transport pipelines, all the transport configuration for anti spam, anti mailware, anti fishing, and what's the however you can think of runs in default and you still have to tweak and configure depending on your needs. So that's the general message from Microsoft. Here you go. Here's a switch on and you can use email but you have to configure it depending on your needs. This what did you think is hybrid Exchange? Inherently more complicated for security perspective or is it the Exchange on-prem? First of all, I'd say it's not complicated. It gets complicated and in this case I need to throw the ball over to the network team, to the firewall team, and everyone else being responsible for network security. So when it comes to having the possibility to use the standard default configuration for let's say a full classic hybrid which requires that your Exchange Service publish to the Internet using a reverse proxy. So when I say default, I already refer to security standard defaults. You do not expose your on-premises Exchange server to the Internet without any kind of reverse proxy in front of it. But that's standard for let's say decades now. So, Natheles, if you do not have any special security network requirements, normally a hybrid setup and sorry for any consultant charging more time year at default hybrid configuration between Exchange server and Exchange Online can be configured and put into a production in a day. But this is normally definitely true for lab environments, but the music, you know, all of this comes when you see an on-premises environment on a customer side. Classic customer environments do not run like a lab setup. So they have, you know, the security teams, the network teams, each of those teams has different views on how to configure things the best to their knowledge. Right? And this is where normally or not normally at say, sometimes there's slightly some tension between the Exchange Messaging team and the Security Network of people. And what will you say, how important is identity security compared with traditional email security controls? So I'd say identity security comes first. So you do have to protect the identity of each user, even though regardless if it's a real person, so a human being or if it's a technical service account, whatever, these are all the same identities requiring the very same identity protection mechanisms in place. Right? So you should not think about having a vehicle security idea for some kind of a room or service account, whatever you can think of. Right? And which roles, which administrative roles are especially associative in the Exchange Online? So we do have the the Exchange Administrator role that comes from an Android perspective. So Exchange Online, even though that it's based on the on-premises product, but it has been forked quite a few years ago, but nevertheless, Exchange Online uses in turnies, so-called role-based access control, the AeroBug role model, which is pretty specific to provide access to certain functionality within Exchange, but from an identity protection perspective. And in this case, we talk about EntraID. We do have the Exchange Administrator, which is more as the goal and key to configure anything messaging related. So we do have recipient management, which is our help desk, so that help desk role, which allows certain base functionality to exchange recipients objects, but we are focusing on Exchange Admins and if you do have license, the privileged identity management, so PIM, you should definitely configure your Exchange Amendment using PIM because it's about just having administrative access to your tenant when you need it. And how should children organizations especially manage emergency or break glass accounts? We talk about break glass accounts. First of all, you should still have a, for example, a phyto-key in place. So the days are over, if you simply use on or disable MFA for break glass accounts and use such a, what kind of 256 character-long, complicated password, which no one is capable of entering, and it's printed on some kind of emergency, emergency cheat, which is in a locker where nobody has a key. Now these days, the break glass account should have a phyto-key, should be secured by a phyto-key. So I do not use some kind of MFA, for example, using a personal Microsoft Authenticator, which is used by Administrator A, but Administrator A, as you can think, is on vacation when that emergency happens. So, but yeah, I think a little bit, do you say the MFA protection, is it enough to protect that specific access, or did we need more or something other? Okay, so when it comes to accessing a tenant by default, as long as I do have the proper credentials, I can access that very tenant from anywhere in the world. So you need to think, or start thinking about, how sensitive is information in my M365 tenant? Shall I reduce access to their tenant for administrative logins to certain countries, to certain regions, maybe to a well-known IP address, so that administrative access is only possible from our headquarters, or from subsidiaries, whatever you can think of. But as you already mentioned, brakeless accounts, you should always think and plan for the unthinkable. So, how do you access your tenant if you have configured that only access from your headquarters, but for whatever reason your headquarters is trucked by disaster? So, no network or intake access from that very headquarters is possible. So, how do you access your tenant in that case? So, it's quite a scenario or multiple scenarios you have to think of. What I think about is the dangers of using a Legend-C, Identifications, or all the management methods. So, my question is, how should companies deal with old applications that still require basic authentication or a Legend-C SMTP? Okay, don't use it. So, it's a simple answer, but it's not a simple answer that fits, you know, or everybody needs it. But if your applications, in the case we are talking about soft applications, or even hardware devices about whatever you can think of, so anything that can or want to send an email, and it's not capable of using modern authentication methods. So, we therefore cannot directly connect and authenticate to exchange online, you should definitely consider keeping an on-premises relaying host in place, simplifying your network infrastructure so that the connectivity of such applications then connects to your on-premises relay SMTP server, quote-unquote, and exchange. And then transfer the authentication misses or even the SMTP routing on a more secure manner for the relay system towards exchange online. Yeah, I think, yeah, identity attack path is heck out famous. Absolutely. Can you walk us through a realistic attack path that begins with a compromised user count and yeah, eventually affects the messaging environment? Well, coming from a messaging background, I'd say, the simple attack start with a malicious email doesn't it? So, and the funny thing is that as long as you use HTML and colder emails, which we are mostly used because we like to have proper smileys in our email bodies. This such an email is not or has to be rendered by your email client, so by audio. So, and a such an email body as in each HTML can contain active content, so some kinds of scripts and such, which can already contain malicious URLs. And as soon as such an email is not being filtered by your anti-mailware, anti-fishing or anti-spam solutions, which it showed. So, I just make it more to have an advertisement in this place, watch out for a proper email security solution. Well, the code exit being executed does not necessarily mean that the user opening or just having an email in preview notices that something is going to happen. All right, so maybe there's some kind of automaticaling that starts to download additional malicious code because the URL itself did not look such malicious to the scanners, therefore it passed the scanning mechanism. So, it then passes, downloads the, finally, with the malicious code and whatever that happens. It's like a key logger or whatever you can think of. And then it fetches your credentials. Then there are multiple ways in how to fetch credentials either by having a key logger in place or by fetching already cash credentials out of the memory. And say, one of the bad things is if you use your daily user account, which you use for classic office communication, is the very same account which you use for your administrative work. So, if you're single, you're one account, you thus have additional privileges against, for example, the on-premises environment, like a, yeah, my default account is a domain administrator, which it shouldn't. Or, for example, for the cloud perspective, I, let's say, I am, have the permanent assignment of as a global administrator in the cloud. No, it shouldn't. So, it's a bad idea. Well, the attack path, in that case, is too low, right? Not too already gain action or do something on that very same day when you open that email. Maybe the code simply passes your credential information. Let's say, your current active or of token over to a, to a malicious third party and they start trying to use that very same authentication token, which is valid at that very moment from a different location. And in that case, we have, we need, what do we have to hope that, Entra, you know, sees that, oh, wait, you could just, um, worked or access the system from Berlin. And then in the very same second, I do have a very authenticated access from the other side of the world, which can't happen, it can be so that Entra then blocks such an authentication attempt. Is there any, I say, all of the events that we are security teams, a detection tool? Yep. So actually, the slightly depends on, if you're having the, a proper, entry ideal licensing in place. So, um, the events themselves are being locked, but it depends on your license, for example, if there's an automatic action in place for it. Let's say, if there's a suspicious logon attempt, Entra can force you to revalidate your credentials within the digital MFA as an example. Right. But it is definitely, uh, visible in the sign-in, sign-in logs. So, and you can see the reason, for example, why a log in fail. So let's say it comes from an already known malicious IP address. Um, it's being blocked because it looks like some kind of a instant, uh, let's see, let's see, correct term, something with, um, some kind of a, you know, um, travel situation, which is simply not possible. So, impossible travel as an example, right? So, just five minutes between log in from Germany and the next one from South Africa. In that case, Entra would say, nah, we are not ready yet. So, this is currently not a, uh, a later approach, which is a tricky thing, for example, if you use the very same account, let's say on, uh, in your office network, but you are connected via the band or into a data center, which is located in a different geography. And in that case, you log in comes a valid log in comes from a totally different region. So you do have to watch out, for example, adjusting any kind of automated log in, um, audits. So, uh, I think over here, we are running a little bit out of time, but, uh, yeah, uh, I see, I have so many questions. So, so, and we are on your way here and really want to talk about, uh, let's just talk about the mail flow. Why is understanding the complete mail pass is so important? Um, first of all, because SMTP as a protocol from the ATEs of the last century is such a tolerant protocol. You can, so SMTP routing allows you to do, um, very horrific things, right? So you can do whatever you want to route, uh, emails. And if you have to, for example, do you have to know where is my entry point for, uh, internet, mails as an example? So do you start your, uh, inbound emails on premises using a gateway or a multiple gateways in the parameter network, for example, before they reach exchange. And then, uh, if you are an enterprise, you might have multiple exchange database, available groups across multiple regions. So the email is being routed. Wherever it is needed and then out of sudden it needs to be routed, um, to exchange online, so to a totally different routing address. And then it has to pass again, a protection layer because even in hybrid, the message will pass through the shared online protection stack and, uh, partially through the Fender before it's finally being delivered two year, um, to the mailbox to the final recipients mailbox. And on its way from entering the SMTP gateway of the company until it reaches the final recipients mailbox, each hop, each connector has a different settings that might interfere with the proper delivery of that email. Even if it's message size, content, uh, conversion, whatever. That's why as an exchange administrator, you have to have a full understanding, a full view of your various, um, yeah, as a TP route. It's not just a single, there's definitely never a single line from the left to the right of a visual diagram. Yeah, interesting. There are also, I think, uh, how, how, how, what was I, I don't know, the right word for, for, for this package, but there are SPF, D Kim and, and, right, what is this services tools, I don't know, but the right word for, what did they do and how did they work and, you know, roll that, the, so, the, let's start with the SPF, which is already 15 years and older, so this is a policy framework, and then we have the, uh, domain, uh, key thing and the DMACC, so the reporting around, let's say, what's going to happen if SPF and they can fail. But all of the three are mechanisms not to protect me or my infrastructure for receiving emails, but, uh, I do configure these things for my domain, for sending emails, so, um, SPF, uh, describes the allowed hosts either my name or my IP address, that are allowed to send as my company domain. Say, so the SPF record of controls.com states, for example, the IP addresses of my sending, uh, on-premises servers, uh, they do include a reference to the, um, external third party marketing infrastructure that say, well, I, I, I, do, that I use to send newsletters because I do want that clients receive my newsletter with my company name and then my company email address because it's a corporate identity thing, right? Marketing, uh, only works, uh, if my marketing emails are being received as a control, so common, not as gmail.com as an example. And the receiving side then can check the SPF record, or normally these days they do, if the email is being, uh, or trying to be delivered from valid hosts. And I say, uh, one, one configuration of the SPF says, okay, if there is a failure in the mid, so there's a mismatch between the sending host and the SPF record, I, at the honor of the domain because it's a DNS record, I say, hey, receiving server, how should you, shall you, you know, react to this? You can either be very strict, so do not accept it. You can then either say, um, yeah, accept it, but you may flag it as, um, spam, so it's being received, uh, it's the receiving side, accepts that message, but delivers us to the inter-recipient, for example, with a, uh, some not spam confidence level slightly higher. So it might be spam and might be not take a look, de-recipient, right? Or you can say, it simply ignored, which is more or less here, like not having any kind of things, right? And then, but why some organizations implement these technologies, but they are still, yeah, remaining valuable to do spoofing, right? So because the larger general email providers, like, uh, Gmail and other ones, um, tend to not accept emails if the sending domain does not have any of those DNS entries in their zone. So they do check if there is a spare record, if there is a demarc record, uh, and such. So, and some companies, especially, let's say, small and medium-sized businesses, um, how should I phrase it? Um, simply edit the required DNS records to the company DNS zones, but the configured values, more or less state, I don't care except anything, right? Except from any sending IP, which is not good. It's like having none. So this, so this case, especially the demarc records, so the demarc record describes, uh, or defines a policy, uh, which might or might be not being, um, recognized by the receiving party. And it describes what to do if SPF or DKM or SPF and DK money, those fails. And the least risky policy is none. So do nothing. So this is more or less like, you know, a floodgate for allowing SPF from wherever. And, um, yeah, the other one would, the next level would then be Quarantine and the third option is a reject. And I think they are pretty safe explaining, but nevertheless, this is just what I say as the owner of a domain, how a receiving party should react. It does not define, uh, explicitly that the receiving party definitely reacts like I wanted to because there's something called like the administrative override. So a receiving party can say, yeah, um, our policy is to accept all of the emails because we do not want to, um, lose any possible email from our clients just, you know, to, uh, miss any kind of a contract or an order or whatever the reason is. And they can simply override what you said or what you couldn't figure it for your domain. So there's no guarantee. Um, I think we have this, this people made to people, but what happened when I say a marketing platform ticket system CRM platforms or other tasks or AI services, a set mail on, on behalf of the company. Um, my recommendation is you subdomains. So such services, any of those mentioned, such services should never send emails like directly as, let's say, at contoso.com as a sending address. They should send as ad use letter dot contoso.com, right? At, uh, CRM dot contoso.com because in that case, you can, it helps you to identify, um, the sending environments. And it helps you to, for example, define dedicated SPF and, uh, the payment on demarc, uh, values for such subdomains. Uh, so there's no requirement that you must configure those, but you can, which provides a different opportunity because it's simply to control the sending system is more granular. And, um, what, I think, I think, may, may, make, I think a little bit about, um, a company that calls you right, Thomas, uh, our emails get, gets, moved by using the connozco, consorto domain, or what's your, or, where's the gays you process here? And that case, I definitely would, uh, prefer to see if there is a demarc policy in place because with the demarc policy, you not only define the, uh, the policy, you know, if, uh, messages have to be rejected or quarantined, but you define an email address where sending systems, uh, send a so-called demarc report to because normally I do not know as a company, which other systems in the world use or send emails using my email address. But with a demarc entry, um, having that so-called, uh, uh, a Rua, the Rua, and an email address, which is the email address for aggregated demarc reports. I get an XML report, for example, from, GMX, or from Gmail, um, depending on the configuration I have, so on a daily basis, weekly basis, whatever I define, um, which I can, then, can analyze because I get an information from the third, from the, from other S&TP servers, from other email servers, who send mails with my controls, or.com email, uh, a, a, send valid emails, or, for example, send not so valid emails. And they are not very, there's a technical report, so I already said these are XML reports. I prefer to use the multiple demarc report, um, commercial demarc report engines out there, which then can automatically, uh, decipher such XML and make nice, fancy dashboard views, which are much more easy to consume and to analyze. And then you do have to find address. So, for example, if you do have, uh, a demarc policy, with a piece, a policy equals none, so there's no one over there, everyone can use it, because edits being received by anybody, like a valid email, because I said so anyone can send, right? So I then have to find you my SPF records, um, because there's a risk thing, especially about SPF records, because there is a little bit, uh, a technical defined limit of a maximum of 10 so-called SPF lookups. So, for example, my SPF record is far too long and the important systems are, are on a lookup position, 11 or 12, they might, they won't be properly rendered by receiving party. So, SPF optimization is a tricky thing and, um, if you use multiples external Z-Services, it's a good thing to move those then to, uh, as mentioned, to subdomains, because then you have, um, much more options. Well, when I think a long time, we have this, this, this, pushing problems, why, why is still so effective all all these, these, these many years, I think we have all these, these modern security controls, we have to defend them. Why, why, there's a, why, I have no one found here a solution? Well, how should I phrase it? Um, phishing emails have gone, I've got excellent of the years, you know, in the very beginning, they were easy to identify, right, misspellings, um, whatever, it was a pretty obvious, this is not a professional email, but these days, um, the phishing emails look like a proper email from a delivery service because, for whatever reason, everybody of us, you know, is in need for, let's say, for, for watching our for such a notification, because we have something, you know, all that somewhere, and for whatever reason, yeah, and I'm writing for the notification emails of the, uh, the HL, and yeah, yeah, or whatever attracts me, right? And it's, it, to be honest, there are certain moments, so known then, where such emails, even, but say, nearly got me, but at the very end, because the easiest thing is to watch out for if you move your mouse over a hyperlink in such an email, how, what does the link say in the, um, mouse over so in the tooltook, uh, you, uh, because the easiest thing these days is to embed some kind of a very similar character, which looks similar, for example, like an O or a zero, but is a character from a different chassis or from a different language from a different low-cal, which in the very first moment, looks like, um, it is no, but it isn't, and therefore, the different domain, which routes me to a very good fancy company site for a delivery service, which looks with the very same, and then, yeah, um, me unsure, but uh, quickly please enter your credentials, um, because we do have to verify and out of a sudden, bong, you even, um, you know, gave your username, add valid password as you think, to a third party. And this can even happen, I had a very same situation, uh, just a few, let's say two or three months ago, where I received a one-drive sharing link, which was very well made. Even the website looked pretty good, but then I was a little, no, as always, even so, especially, called cancer, use cancer, at ass summaries, or, for example, just ask the sender of that email, did you send me that? Is there a real email? There is no need to access that very content in that very minute. Double check, if it, so, it looks or feels suspicious. Yeah, there was one attack, I really felt really funny, it is, or really, really creative, was the R& Microsoft, uh, they, they changed their N to the R& and it looks like it's more, this, this, this, I've, I've thought, thought this was, it was a really funny, funny, good idea. Yes, it was, because especially depending on the resolution of the device, especially, especially if you're, your mobile device, right, it simply looks like them, because just that final digit between the two characters, which you normally, you know, on a spot I've had this pay, you simply don't see. It was more, this was a really, really funny, uh, attack, father thing. But, uh, what, what, what role can, can Microsoft Defender, uh, I think Microsoft Defender for Office 365 play and preventing and investigating the text? I think the very, the most important functionality these days, I say is the, um, uh, saffering functionality. So that it does not only scan in hyperlinks while they are, uh, during the process of, um, delivering that email, but to rewrite the embedded email link to a saffering URL. So the very time that you click that link, you do not directly go to the final target, but you're being the redirected to the Defender saffering portal. Um, and again, depending on the configuration in your tenant, you can either, if it's malicious, you're, you journey to that website or to that target link ends here, right? Because it's being identified and the administrator configured the saffering functionality, you say, okay, uh, it's pretty suspicious. You can't move on to that link. Because when I say you have to configure it, because there's an option to allow the end user, the option to, all right, so to move on to the very target anyway, which, well, the words that I think of are not for the public, um, right? So when this is, it's important, and um, it's, it's, the, the, the, the information for the security teams. So Defender that case, because Defender has a dedicated portal, which even with your role as an exchange administrator and enter, you have access to alpha to the functionality of the Defender portal, which is messaging, uh, related, right? So it's not the case that you only have access to the exchange admin center as an exchange administrator, but you do have a, for example, access to the Defender portal and to the messaging security staffs for the messaging, uh, to the email explorer, to verify very granularly any, or each email that is being routed via, um, yeah, which went through Defender. You can analyze the attachments, links, whatever you need. And again, it's a licensing thing. Yeah. So I recommend if, if you mean it's serious, or if you're serious, when it comes to email security, take definitely a look at the Defender P1 and P2 feature set and watch out for where Defender P1 and P2, uh, where's the part of any license plan? Sorry, example, it doesn't make any sense to license it on its own because, uh, you watch out or take a look at, uh, if it's, uh, for example, included in Microsoft 365, uh, E5, E3, depending on the functionality you want. Yes. It comes with a cost, but security comes always with a cost, right? Um, what I think about is, is a little bit, um, what, what role do is do is, I say, uh, infrastructure as a code play for, for, for, for, for, for exchange. Is that the topic? So, inf, uh, the, um, well, anything about having in now an API for, um, exchange, uh, let's say for Microsoft 365, in that case for parts of exchange online for Microsoft configuration API for M365, you definitely can, um, extract your, your current configuration and use that the, uh, code, quote unquote, so the export of configuration as a default set cell. If anyone changes the configuration using PowerShot or UI, some like any changes to your production environment, and then you'd have a data comparison between the configuration, which it should, how it should be, and see the difference compared to the products that you can then reverse such configurations because the configuration has to be done using the XML set and not the live configuration, the 10. All right. And, um, oh, I think, I'm not really sure if it's that, but I think so, because I, I think I can do the, the, the, I have, yeah, we have say PowerShell, we have, uh, the graph API, and we have now, we have mcp, did you think we have the new risk through these mcp on, from for the exchange out? Well, so mcp and anything that's, let's say, which is normally used by, uh, agents, connectors, and such, which normally targets only content, not the configuration itself. Right. And I can't say anything about, you know, about the future and what's going to be, but it's, in that case, more risky to you, for example, having, uh, wrongly configured permissions for any programmatic access to content, regardless of its sharepoint exchange, online or such, because exchange, online and sharepoint, uh, these two are the largest, let's say storage providers for the m365 space. Right. Because a very similar of all those, nice services that we use utilize, either of the two, so sharepoint or exchange as a storage engine for kind of files for stuff that you create as a user. And especially from an exchange perspective, your, nice and fancy inbox that you see in outlook is just a very small part of the folder structure of your inbox. So most of the folder structure of your exchange, online inbox is being hidden from you because it's only accessible via APIs. Anyway, um, yeah, uh, what I a little bit think about it's, we have these, uh, what is this called? I think Microsoft secure score. Yeah. Um, should organization use such tools as, as a primary security matter, or is it more, uh, yeah, it's green, it's fine. It's stuff. It's definitely not a one way street. So the secure score or even the compliance score that we have for the compliance portal are tools. They can help me as a, uh, as I'm illustrator, the owner of a tenant to make configuration decisions that Microsoft recommends to me. So if you take a complete close look at these things, uh, at both of the scores, um, they have always two sides. There's one that stuff Microsoft config is, which is normally 100% already because it's stuff that is configured by Microsoft in the environment in real infrastructure for you. And then there's the customer side, the stuff that I have to configure, which I have to make decisions on. So I don't have to make, um, educated decisions on. And the decisions to make, that's a funny part because secure score in that case is a, um, marketing vehicle because some things you can only configure if you do have a proper license in your tent. Right. So securing some stuff, let's, let's read so very little for my company. I do want to have this. Let's set, yeah, click here to start a trial. So watch out. So, um, but again, you do have to make an educated decision, um, on the required security functionality that you do want to enable disabled. So depending on what it's about, but again, it depends a proper licensing in your tent. Yeah. When, when we think, uh, all, all these, these topics, um, can we say how, how important is operational discipline compared with the individual security settings? Um, what do you mean by this? So just, um, yeah, we have these, I say, uh, I have my, my, my security settings, my individual stuff, I can click, I don't know, my, I don't know, uh, my defender, my, uh, I don't know what, what, all, all these, uh, as an end user, yeah, the end user, and, and how, our importance is the end user and how, uh, is, is the, yeah, say, the, the, what the company does on their side to, to, yeah, have an operational excellence or, operational discipline, it's always, you know, the tricky part is to find a proper balance on the one hand to keep the end users in a productive state so that I'm not going to limit them too much, but at the very same time, not opening too much or allowing the security level too much. So it's not that easy because I see clients, uh, on each side, uh, so some of them are very, very restrictive. Uh, for example, hardening the end client system where you do not even see your C drive, right? And on the other side where, and users are simply, you know, um, yeah, you are a local administrator, uh, because it keeps it simple for our help desk because you can install your printer, whatever you want, uh, on your own. So there is not even a process in place. For example, I do have to request being administrator or having a administrative rights on my client for the next hour and providing a reason to do so. So, and anything in between, right? But it, it, normally, it depends on your business. It depends on the data you're working with. So if you're only the, uh, let's say, um, in the medical sector, or have any sensitive data, which is in the regulated, uh, section, yeah, it's not necessarily the best idea to move to the cloud as an example without any additional configuration in place. Um, I think what's, or my favorite topic is governance, uh, and compliance, and, uh, yeah, also we have the DLP topic. So, so how should we, or how should messaging security connect it with the governance and compliance? Um, but it comes to compliance, use M365 DLP policies, use, uh, pervious sensitivity labels, um, but do it in a very, well, thoughtful and plentiful manner, right? Because rolling out the label, uh, sensitivity labels rolling out to DLP policies and applying, um, such things to objects to files, to emails, to folders, to other storage containers is not something that you're going to change, uh, easily, as soon as it is a product of use, right? But use those, um, this functionality to protect your data because of the other, if good things about sensitivity labels is, that's a sensitivity label, are travel with the secured object, right? Yeah, if I put the label on a file, it stays with that file. Regardless if I do it, uh, attach it as a tuning email, if I proiled to you, why USB stick or whatever uploaded, wherever a label document is a label document. Do you think it? Um, it's interesting. I think actually, this is not the, these topics, but comes in my mind. What's when, when the, the, the baddest parts or bad things happens, you're totally compromised, um, okay, you have done your, your backup, but, uh, I think, yeah, you can have, I don't know, uh, the company, it's, it's really complex, so, they save their, their backups and they have their data in these backups, but they, all to lose their, their, their configuration, how can they, yeah, I don't know, uh, backup, their, their, their configuration, is there any best practice and, uh, show, they own, show, they use their best, their, the, the configuration parts, when they get hacked. Well, I think this is definitely, uh, first of all, thing that you have to get in contact with your clock provider, it just being hacked and, for example, even having lost your tenant, it's not only about the data, for example, but all the domains and all your identity domains in that very tenant. You know, how useful is a configuration for my contoso.com identity stuff when, uh, when I cannot use that contoso.com domain in a newly set up tenant, because the system, the abstracts, the files tells me when I do want to add that domain, nah, that domain is already registered with another tenant and, and I do not have access to that tenant anymore. So there's no simple and quick answer to that. But if your responsible, um, come, you do should have a business continuity, uh, option for such a scenario in place, because starting thinking about that situation in that very moment is not the best idea because it's quite a stressful situation. When I'm also from an interesting, what, what did you think about AI? How, how will AI change email security in the next few years? What, what did you think? email security, um, I think would benefit from it, but again, because yeah, all the malicious parties are going to use AI, you know, to identify, um, zero-day compromises of exchange server, and maybe all the stuff that might be still in place in exchange online, whatever, so, um, this is the, is one side on the other side, AI, yeah, it's a small, you know, if it's, is it AI, or is it just machine learning, well, how can we say, because, this is already learning how you work and how you, how you send emails, right? I think everything, if, if elves, uh, contains AI, but, maybe, um, yeah, um, you're, you're, what, what, what, what, what did you, I don't know, how I spelled it right, granny, cause is your, is your company? Yes, what, what, what did you do with, with, with your company, or what project working you on? So, um, I'm primarily, um, clients of all sizes, so it's, it's a small, medium-sized businesses, but even, uh, globally large enterprises, anything in between, happy to, you, you know, move their on premises environment to a currently supported state, so, there's quite a lot of work to do for upgrading exchange server infrastructure to exchange those subscription addition. Unbelievable, even though that exchange was 2016 and 2019 are out of support since October last year, but, ah, they're still out there, and I even saw it exchange over 2013 environment last week, so, yes, because they work, they, they do not stop, they run, so, you know, never change running system, period, and moving to exchange online in a supported manner, for example, using some kind of a hybrid configuration, this is the software I, where clients definitely need help, because each infrastructure and the possibilities to connect to exchange online, either for a single full migration, so moving all mailboxes to exchange online, then getting rid of, ah, on-prem, or for a, ah, full hybrid setup, because the environment will stay in a hybrid setup for, for ever, because for, well, some companies tend to say that, ah, some content, let's say, the sea level mailboxes remain on premises because there's highly sensitive content, and we do not trust the cloud providers, yadda, yadda, yadda, um, because they do not understand the content of sensitivity labels, but that's a different story. Um, so, and anything in between, and most companies already have some kind of a security flow, a gateway, a combination in place, and then they need to have consultancy about, can we use it, ah, with exchange online, can we, how do we have our mailboxes, all of the, the entry, the, the, the, it was changed from on-prem to the exchange online and such, so, let's just stop it, so, ah, I do. Yeah. Cool, and, ah, you are also our podcast those with the exchange, um, plaque, um, plaque, what, what can listeners expect from your podcast? So the exchange, um, plaque, the podcast is a, ah, it's not, I do not publish on a regular basis, because it's about technical content, technical situations, stuff that you need to know, or that you don't want to have to watch out for, ah, and, and this stuff, and, ah, I do have, um, come time to time, I have guests, where we talk about their expertise, that they are sharing the knowledge, so, ah, I just had the, the upcoming episode I talk with, um, my team's end up about, well, about DMug and such, because since, ah, this year DMug is now an official standard, it's not just an, ah, proposal anymore. And, well, so exchange on plaque is focusing as you can guess, on exchange and messaging related to topics, so, and it's more or less seen in a combination, with the community project website for exchange, for it, it's pros.block, which is the other thing that I do, um, because I believe that we need to persist, exchange related knowledge, because I think it's vanishing, right? So, um, yeah, we have a little bit over the time, but I hope you have some time for the rapid fire round, to the end of it normally in every, every round, is it okay? Okay, um, yeah, it's, ah, I asked the question, you give a short answer, so exchange server, exchange online. Exchange server. Hybrid, temporary, fast or a long term architecture? Long term architecture. Power shell or portal? Power shell. Always. London is famous for for the big band and, um, the parents is famous for the, Eiffel Tower, what's Hucleof in famous for? Um, again, so Hucleof is definitely famous for a TV online shopping center, which does have, it's a Germany distribution center there. Not naming the TV channel. The most underrated security controller. Oh, you said quick, huh? Um, save links. Um, most dangerous default setting. The default domain in your M365 tent. Um, what do you say is the most overrated security metric? The most overrated you said. Oh, oh, that's a tricky one. Next question. Okay, if Satya Dadaia called you and said Thomas, you get all the money and the resources for Microsoft, you, you, you need. What feature will you be about, please, change? Uh, do you want to give you an exchange server? Uh, I would have definitely, uh, two things, sorry for that Satya. Um, it's on the one hand, a, uh, DK implementation, uh, for exchange server. And an automatic automated certificate exchange, watching out for the short-time server certificate lifetimes, built in into the product. Okay, then the last one, uh, who showed I and why next and what question should I ask? Um, did you already talk to Manfred Haber? No. Um, yeah, so I think Manfred Haber is the right one to choose and because he, uh, provides, uh, infrastructure for, uh, a service server and ACS, um, infrastructure for hybrid. So, the same question on hybrid stuff. So is it either, uh, as a, as a local or anything in between? Oh, okay, cool. So, yeah, um, then my final question is, uh, Thomas, if you leave all of us with one clear principle about secure and exchange servers, hybrid environments and microsys, the five messaging, what will it be? Um, stay up to date, follow the, uh, exchange product group log, patch your exchange servers if you have any and watch out for default changes, uh, and just the last one, remember the duplication of exchange web services, exchange online. Okay, then, Thomas, thank you for joining me on the um, 65 podcast and sharing such, uh, yeah, detailed and practical look into Microsoft messaging security. Yeah, you're experiencing across the exchange server, hybrid environments, exchange online enterprise architecture training and incident group boards gives the, our list does a unique perspective on the, uh, topic that almost, yeah, affects every organization. They, let's use emails. The key messages from today's conversion is key, Microsoft's messaging platforms can be powerful and secure, but security does not happen automatically. It depends on identity protection. Correct configuration, secure mail flow, continuous monitoring, strong operational process and clear understanding of their responsible sits. Yeah, you can learn more about Thomas if you look at his company, uh, website, thank you, us and his, uh, block and his YouTube channel and also the exchange, um, like podcast. Yeah, we will include all the links in the show notes on the um, 65 podcast page. Yeah, if you enjoy these episodes, please subscribe to the um 65 show podcast, share with your colleagues and yeah, let us review here. It's, it's very important for us, small, uh, podcast tools and yeah, Thomas, thank you again for for joining us, uh, or me today and every listener, keep learning, keep questioning your defaults and keep building safer Microsoft environments. So see you in the next episode on the MCC35 podcast to show or on the exchange. I'd like to. Thanks for having me.